{
  "swagger": "2.0",
  "schemes": [
    "https"
  ],
  "host": "management.azure.com",
  "info": {
    "description": "API spec for Microsoft.Security (Azure Security Center) resource provider",
    "title": "Security Center",
    "version": "2017-08-01-preview",
    "x-apisguru-categories": [
      "cloud"
    ],
    "x-logo": {
      "url": "https://api.apis.guru/v2/cache/logo/https_assets.onestore.ms_cdnfiles_onestorerolling-1606-01000_shell_v3_images_logo_microsoft.png"
    },
    "x-origin": [
      {
        "format": "swagger",
        "url": "https://raw.githubusercontent.com/Azure/azure-rest-api-specs/master/specification/security/resource-manager/Microsoft.Security/preview/2017-08-01-preview/iotSecuritySolutionAnalytics.json",
        "version": "2.0"
      }
    ],
    "x-preferred": false,
    "x-providerName": "azure.com",
    "x-serviceName": "security-iotSecuritySolutionAnalytics",
    "x-tags": [
      "Azure",
      "Microsoft"
    ]
  },
  "consumes": [
    "application/json"
  ],
  "produces": [
    "application/json"
  ],
  "securityDefinitions": {
    "azure_auth": {
      "authorizationUrl": "https://login.microsoftonline.com/common/oauth2/authorize",
      "description": "Azure Active Directory OAuth2 Flow",
      "flow": "implicit",
      "scopes": {
        "user_impersonation": "impersonate your user account"
      },
      "type": "oauth2"
    }
  },
  "security": [
    {
      "azure_auth": [
        "user_impersonation"
      ]
    }
  ],
  "parameters": {
    "AggregatedAlertName": {
      "description": "Identifier of the aggregated alert",
      "in": "path",
      "name": "aggregatedAlertName",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "AggregatedRecommendationName": {
      "description": "Identifier of the aggregated recommendation",
      "in": "path",
      "name": "aggregatedRecommendationName",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "SolutionName": {
      "description": "The solution manager name",
      "in": "path",
      "name": "solutionName",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    }
  },
  "paths": {
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/iotSecuritySolutions/{solutionName}/analyticsModels": {
      "get": {
        "description": "Security Analytics of a security solution",
        "operationId": "IoTSecuritySolutionsAnalytics_GetAll",
        "parameters": [
          {
            "description": "API version for the operation",
            "in": "query",
            "name": "api-version",
            "required": true,
            "type": "string"
          },
          {
            "description": "Azure subscription ID",
            "in": "path",
            "name": "subscriptionId",
            "pattern": "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$",
            "required": true,
            "type": "string"
          },
          {
            "description": "The name of the resource group within the user's subscription. The name is case insensitive.",
            "in": "path",
            "maxLength": 90,
            "minLength": 1,
            "name": "resourceGroupName",
            "pattern": "^[-\\w\\._\\(\\)]+$",
            "required": true,
            "type": "string",
            "x-ms-parameter-location": "method"
          },
          {
            "$ref": "#/parameters/SolutionName"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/IoTSecuritySolutionAnalyticsModelList"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "description": "Error response structure.",
              "properties": {
                "error": {
                  "description": "Error details.",
                  "properties": {
                    "code": {
                      "description": "An identifier for the error. Codes are invariant and are intended to be consumed programmatically.",
                      "readOnly": true,
                      "type": "string"
                    },
                    "message": {
                      "description": "A message describing the error, intended to be suitable for display in a user interface.",
                      "readOnly": true,
                      "type": "string"
                    }
                  },
                  "type": "object",
                  "x-ms-external": true
                }
              },
              "type": "object",
              "x-ms-external": true
            }
          }
        },
        "tags": [
          "IoT Security Solutions Analytics"
        ],
        "x-ms-examples": {
          "Get Security Solutions Analytics": {
            "parameters": {
              "api-version": "2017-08-01-preview",
              "resourceGroupName": "MyGroup",
              "solutionName": "default",
              "subscriptionId": "20ff7fc3-e762-44dd-bd96-b71116dcdc23"
            },
            "responses": {
              "200": {
                "body": {
                  "value": [
                    {
                      "id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default",
                      "name": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default",
                      "properties": {
                        "devicesMetrics": [
                          {
                            "date": "2019-02-01T00:00:00Z",
                            "devicesMetrics": {
                              "high": 3,
                              "low": 70,
                              "medium": 15
                            }
                          },
                          {
                            "date": "2019-02-02T00:00:00Z",
                            "devicesMetrics": {
                              "high": 3,
                              "low": 65,
                              "medium": 45
                            }
                          }
                        ],
                        "metrics": {
                          "high": 5,
                          "low": 102,
                          "medium": 200
                        },
                        "mostPrevalentDeviceAlerts": [
                          {
                            "alertDisplayName": "Custom Alert - number of device to cloud messages in AMQP protocol is not in the allowed range",
                            "devicesCount": 200,
                            "reportedSeverity": "Low"
                          },
                          {
                            "alertDisplayName": "Custom Alert - execution of a process that is not allowed",
                            "devicesCount": 170,
                            "reportedSeverity": "Medium"
                          },
                          {
                            "alertDisplayName": "Successful Bruteforce",
                            "devicesCount": 150,
                            "reportedSeverity": "Low"
                          }
                        ],
                        "mostPrevalentDeviceRecommendations": [
                          {
                            "devicesCount": 200,
                            "recommendationDisplayName": "Install the Azure Security of Things Agent",
                            "reportedSeverity": "Low"
                          },
                          {
                            "devicesCount": 170,
                            "recommendationDisplayName": "High level permissions configured in Edge model twin for Edge module",
                            "reportedSeverity": "Low"
                          },
                          {
                            "devicesCount": 150,
                            "recommendationDisplayName": "Same Authentication Credentials used by multiple devices",
                            "reportedSeverity": "Medium"
                          }
                        ],
                        "topAlertedDevices": [
                          {
                            "alertsCount": 200,
                            "deviceId": "id1"
                          },
                          {
                            "alertsCount": 170,
                            "deviceId": "id2"
                          },
                          {
                            "alertsCount": 150,
                            "deviceId": "id3"
                          }
                        ],
                        "unhealthyDeviceCount": 1200
                      },
                      "type": "Microsoft.Security/IoTSecuritySolutionAnalyticsModelList"
                    }
                  ]
                }
              }
            }
          }
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/iotSecuritySolutions/{solutionName}/analyticsModels/default": {
      "get": {
        "description": "Security Analytics of a security solution",
        "operationId": "IoTSecuritySolutionsAnalytics_GetDefault",
        "parameters": [
          {
            "description": "API version for the operation",
            "in": "query",
            "name": "api-version",
            "required": true,
            "type": "string"
          },
          {
            "description": "Azure subscription ID",
            "in": "path",
            "name": "subscriptionId",
            "pattern": "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$",
            "required": true,
            "type": "string"
          },
          {
            "description": "The name of the resource group within the user's subscription. The name is case insensitive.",
            "in": "path",
            "maxLength": 90,
            "minLength": 1,
            "name": "resourceGroupName",
            "pattern": "^[-\\w\\._\\(\\)]+$",
            "required": true,
            "type": "string",
            "x-ms-parameter-location": "method"
          },
          {
            "$ref": "#/parameters/SolutionName"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/IoTSecuritySolutionAnalyticsModel"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "description": "Error response structure.",
              "properties": {
                "error": {
                  "description": "Error details.",
                  "properties": {
                    "code": {
                      "description": "An identifier for the error. Codes are invariant and are intended to be consumed programmatically.",
                      "readOnly": true,
                      "type": "string"
                    },
                    "message": {
                      "description": "A message describing the error, intended to be suitable for display in a user interface.",
                      "readOnly": true,
                      "type": "string"
                    }
                  },
                  "type": "object",
                  "x-ms-external": true
                }
              },
              "type": "object",
              "x-ms-external": true
            }
          }
        },
        "tags": [
          "IoT Security Solutions Analytics"
        ],
        "x-ms-examples": {
          "Get Security Solutions Analytics": {
            "parameters": {
              "api-version": "2017-08-01-preview",
              "resourceGroupName": "MyGroup",
              "solutionName": "default",
              "subscriptionId": "20ff7fc3-e762-44dd-bd96-b71116dcdc23"
            },
            "responses": {
              "200": {
                "body": {
                  "id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default",
                  "name": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default",
                  "properties": {
                    "devicesMetrics": [
                      {
                        "date": "2019-02-01T00:00:00Z",
                        "devicesMetrics": {
                          "high": 3,
                          "low": 70,
                          "medium": 15
                        }
                      },
                      {
                        "date": "2019-02-02T00:00:00Z",
                        "devicesMetrics": {
                          "high": 3,
                          "low": 65,
                          "medium": 45
                        }
                      }
                    ],
                    "metrics": {
                      "high": 5,
                      "low": 102,
                      "medium": 200
                    },
                    "mostPrevalentDeviceAlerts": [
                      {
                        "alertDisplayName": "Custom Alert - number of device to cloud messages in AMQP protocol is not in the allowed range",
                        "alertsCount": 200,
                        "reportedSeverity": "Low"
                      },
                      {
                        "alertDisplayName": "Custom Alert - execution of a process that is not allowed",
                        "alertsCount": 170,
                        "reportedSeverity": "Medium"
                      },
                      {
                        "alertDisplayName": "Successful Bruteforce",
                        "alertsCount": 150,
                        "reportedSeverity": "Low"
                      }
                    ],
                    "mostPrevalentDeviceRecommendations": [
                      {
                        "devicesCount": 200,
                        "recommendationDisplayName": "Install the Azure Security of Things Agent",
                        "reportedSeverity": "Low"
                      },
                      {
                        "devicesCount": 170,
                        "recommendationDisplayName": "High level permissions configured in Edge model twin for Edge module",
                        "reportedSeverity": "Low"
                      },
                      {
                        "devicesCount": 150,
                        "recommendationDisplayName": "Same Authentication Credentials used by multiple devices",
                        "reportedSeverity": "Medium"
                      }
                    ],
                    "topAlertedDevices": [
                      {
                        "alertsCount": 200,
                        "deviceId": "id1"
                      },
                      {
                        "alertsCount": 170,
                        "deviceId": "id2"
                      },
                      {
                        "alertsCount": 150,
                        "deviceId": "id3"
                      }
                    ],
                    "unhealthyDeviceCount": 1200
                  },
                  "type": "Microsoft.Security/IoTSecuritySolutionAnalyticsModel"
                }
              }
            }
          }
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/iotSecuritySolutions/{solutionName}/analyticsModels/default/aggregatedAlerts": {
      "get": {
        "description": "Security Analytics of a security solution",
        "operationId": "IoTSecuritySolutionsAnalyticsAggregatedAlerts_List",
        "parameters": [
          {
            "description": "API version for the operation",
            "in": "query",
            "name": "api-version",
            "required": true,
            "type": "string"
          },
          {
            "description": "Azure subscription ID",
            "in": "path",
            "name": "subscriptionId",
            "pattern": "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$",
            "required": true,
            "type": "string"
          },
          {
            "description": "The name of the resource group within the user's subscription. The name is case insensitive.",
            "in": "path",
            "maxLength": 90,
            "minLength": 1,
            "name": "resourceGroupName",
            "pattern": "^[-\\w\\._\\(\\)]+$",
            "required": true,
            "type": "string",
            "x-ms-parameter-location": "method"
          },
          {
            "$ref": "#/parameters/SolutionName"
          },
          {
            "description": "The number of results to retrieve.",
            "in": "query",
            "name": "$top",
            "required": false,
            "type": "integer"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/IoTSecurityAggregatedAlertList"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "description": "Error response structure.",
              "properties": {
                "error": {
                  "description": "Error details.",
                  "properties": {
                    "code": {
                      "description": "An identifier for the error. Codes are invariant and are intended to be consumed programmatically.",
                      "readOnly": true,
                      "type": "string"
                    },
                    "message": {
                      "description": "A message describing the error, intended to be suitable for display in a user interface.",
                      "readOnly": true,
                      "type": "string"
                    }
                  },
                  "type": "object",
                  "x-ms-external": true
                }
              },
              "type": "object",
              "x-ms-external": true
            }
          }
        },
        "tags": [
          "IoT Security Solutions Analytics"
        ],
        "x-ms-examples": {
          "Get Security Solutions Analytics": {
            "parameters": {
              "api-version": "2017-08-01-preview",
              "resourceGroupName": "MyGroup",
              "solutionName": "default",
              "subscriptionId": "20ff7fc3-e762-44dd-bd96-b71116dcdc23"
            },
            "responses": {
              "200": {
                "body": {
                  "value": [
                    {
                      "id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/IoT_Bruteforce_Fail/2019-02-02",
                      "name": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/IoT_Bruteforce_Fail/2019-02-02",
                      "properties": {
                        "actionTaken": "Detected",
                        "aggregatedDateUtc": "2019-02-02",
                        "alertDisplayName": "Failed Bruteforce",
                        "alertType": "IoT_Bruteforce_Fail",
                        "count": 50,
                        "description": "Multiple unsuccsseful login attempts identified. A Bruteforce attack on the device failed.",
                        "effectedResourceType": "IoT Device",
                        "logAnalyticsQuery": "SecurityAlert | where tolower(ResourceId) == tolower('/subscriptions/b77ec8a9-04ed-48d2-a87a-e5887b978ba6/resourceGroups/IoT-Solution-DemoEnv/providers/Microsoft.Devices/IotHubs/rtogm-hub') and tolower(AlertName) == tolower('Custom Alert - number of device to cloud messages in MQTT protocol is not in the allowed range') | extend DeviceId=parse_json(ExtendedProperties)['DeviceId'] | project DeviceId, TimeGenerated, DisplayName, AlertSeverity, Description, RemediationSteps, ExtendedProperties",
                        "remediationSteps": "",
                        "reportedSeverity": "Low",
                        "systemSource": "Devices",
                        "vendorName": "Microsoft"
                      },
                      "type": "Microsoft.Security/IoTSecurityAggregatedAlert"
                    },
                    {
                      "id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/IoT_Bruteforce_Success/2019-02-02",
                      "name": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/IoT_Bruteforce_Success/2019-02-02",
                      "properties": {
                        "actionTaken": "Detected",
                        "aggregatedDateUtc": "2019-02-02",
                        "alertDisplayName": "Successful Bruteforce",
                        "alertType": "IoT_Bruteforce_Success",
                        "count": 600000,
                        "description": "Multiple unsuccsseful login attempts identified followed by a succssful login. A Bruteforce attack on the device was Successfule",
                        "effectedResourceType": "IoT Device",
                        "logAnalyticsQuery": "SecurityAlert | where tolower(ResourceId) == tolower('/subscriptions/b77ec8a9-04ed-48d2-a87a-e5887b978ba6/resourceGroups/IoT-Solution-DemoEnv/providers/Microsoft.Devices/IotHubs/rtogm-hub') and tolower(AlertName) == tolower('Custom Alert - number of device to cloud messages in MQTT protocol is not in the allowed range') | extend DeviceId=parse_json(ExtendedProperties)['DeviceId'] | project DeviceId, TimeGenerated, DisplayName, AlertSeverity, Description, RemediationSteps, ExtendedProperties",
                        "remediationSteps": "",
                        "reportedSeverity": "Low",
                        "systemSource": "Devices",
                        "vendorName": "Microsoft"
                      },
                      "type": "Microsoft.Security/IoTSecurityAggregatedAlert"
                    }
                  ]
                }
              }
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/iotSecuritySolutions/{solutionName}/analyticsModels/default/aggregatedAlerts/{aggregatedAlertName}": {
      "get": {
        "description": "Security Analytics of a security solution",
        "operationId": "IoTSecuritySolutionsAnalyticsAggregatedAlert_Get",
        "parameters": [
          {
            "description": "API version for the operation",
            "in": "query",
            "name": "api-version",
            "required": true,
            "type": "string"
          },
          {
            "description": "Azure subscription ID",
            "in": "path",
            "name": "subscriptionId",
            "pattern": "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$",
            "required": true,
            "type": "string"
          },
          {
            "description": "The name of the resource group within the user's subscription. The name is case insensitive.",
            "in": "path",
            "maxLength": 90,
            "minLength": 1,
            "name": "resourceGroupName",
            "pattern": "^[-\\w\\._\\(\\)]+$",
            "required": true,
            "type": "string",
            "x-ms-parameter-location": "method"
          },
          {
            "$ref": "#/parameters/SolutionName"
          },
          {
            "$ref": "#/parameters/AggregatedAlertName"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/IoTSecurityAggregatedAlert"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "description": "Error response structure.",
              "properties": {
                "error": {
                  "description": "Error details.",
                  "properties": {
                    "code": {
                      "description": "An identifier for the error. Codes are invariant and are intended to be consumed programmatically.",
                      "readOnly": true,
                      "type": "string"
                    },
                    "message": {
                      "description": "A message describing the error, intended to be suitable for display in a user interface.",
                      "readOnly": true,
                      "type": "string"
                    }
                  },
                  "type": "object",
                  "x-ms-external": true
                }
              },
              "type": "object",
              "x-ms-external": true
            }
          }
        },
        "tags": [
          "IoT Security Solutions Analytics"
        ],
        "x-ms-examples": {
          "Get Security Solutions Analytics": {
            "parameters": {
              "aggregatedAlertName": "IoT_Bruteforce_Fail/2019-02-02",
              "api-version": "2017-08-01-preview",
              "resourceGroupName": "MyGroup",
              "solutionName": "default",
              "subscriptionId": "20ff7fc3-e762-44dd-bd96-b71116dcdc23"
            },
            "responses": {
              "200": {
                "body": {
                  "id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/IoT_Bruteforce_Fail/2019-02-02",
                  "name": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/IoT_Bruteforce_Fail/2019-02-02",
                  "properties": {
                    "actionTaken": "Detected",
                    "aggregatedDateUtc": "2019-02-02",
                    "alertDisplayName": "Failed Bruteforce",
                    "alertType": "IoT_Bruteforce_Fail",
                    "count": 50,
                    "description": "Multiple unsuccsseful login attempts identified. A Bruteforce attack on the device failed.",
                    "effectedResourceType": "IoT Device",
                    "logAnalyticsQuery": "SecurityAlert | where tolower(ResourceId) == tolower('/subscriptions/b77ec8a9-04ed-48d2-a87a-e5887b978ba6/resourceGroups/IoT-Solution-DemoEnv/providers/Microsoft.Devices/IotHubs/rtogm-hub') and tolower(AlertName) == tolower('Custom Alert - number of device to cloud messages in MQTT protocol is not in the allowed range') | extend DeviceId=parse_json(ExtendedProperties)['DeviceId'] | project DeviceId, TimeGenerated, DisplayName, AlertSeverity, Description, RemediationSteps, ExtendedProperties",
                    "remediationSteps": "",
                    "reportedSeverity": "Low",
                    "systemSource": "Devices",
                    "vendorName": "Microsoft"
                  },
                  "type": "Microsoft.Security/IoTSecurityAggregatedAlert"
                }
              }
            }
          }
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/iotSecuritySolutions/{solutionName}/analyticsModels/default/aggregatedAlerts/{aggregatedAlertName}/dismiss": {
      "post": {
        "description": "Security Analytics of a security solution",
        "operationId": "IoTSecuritySolutionsAnalyticsAggregatedAlert_Dismiss",
        "parameters": [
          {
            "description": "API version for the operation",
            "in": "query",
            "name": "api-version",
            "required": true,
            "type": "string"
          },
          {
            "description": "Azure subscription ID",
            "in": "path",
            "name": "subscriptionId",
            "pattern": "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$",
            "required": true,
            "type": "string"
          },
          {
            "description": "The name of the resource group within the user's subscription. The name is case insensitive.",
            "in": "path",
            "maxLength": 90,
            "minLength": 1,
            "name": "resourceGroupName",
            "pattern": "^[-\\w\\._\\(\\)]+$",
            "required": true,
            "type": "string",
            "x-ms-parameter-location": "method"
          },
          {
            "$ref": "#/parameters/SolutionName"
          },
          {
            "$ref": "#/parameters/AggregatedAlertName"
          }
        ],
        "responses": {
          "200": {
            "description": "Dismissed"
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "description": "Error response structure.",
              "properties": {
                "error": {
                  "description": "Error details.",
                  "properties": {
                    "code": {
                      "description": "An identifier for the error. Codes are invariant and are intended to be consumed programmatically.",
                      "readOnly": true,
                      "type": "string"
                    },
                    "message": {
                      "description": "A message describing the error, intended to be suitable for display in a user interface.",
                      "readOnly": true,
                      "type": "string"
                    }
                  },
                  "type": "object",
                  "x-ms-external": true
                }
              },
              "type": "object",
              "x-ms-external": true
            }
          }
        },
        "tags": [
          "IoT Security Solutions Analytics"
        ],
        "x-ms-examples": {
          "Get Security Solutions Analytics": {
            "parameters": {
              "aggregatedAlertName": "IoT_Bruteforce_Fail/2019-02-02/dismiss",
              "api-version": "2017-08-01-preview",
              "resourceGroupName": "IoTEdgeResources",
              "solutionName": "default",
              "subscriptionId": "20ff7fc3-e762-44dd-bd96-b71116dcdc23"
            },
            "responses": {
              "200": {}
            }
          }
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/iotSecuritySolutions/{solutionName}/analyticsModels/default/aggregatedRecommendations": {
      "get": {
        "description": "Security Analytics of a security solution",
        "operationId": "IoTSecuritySolutionsAnalyticsRecommendations_List",
        "parameters": [
          {
            "description": "API version for the operation",
            "in": "query",
            "name": "api-version",
            "required": true,
            "type": "string"
          },
          {
            "description": "Azure subscription ID",
            "in": "path",
            "name": "subscriptionId",
            "pattern": "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$",
            "required": true,
            "type": "string"
          },
          {
            "description": "The name of the resource group within the user's subscription. The name is case insensitive.",
            "in": "path",
            "maxLength": 90,
            "minLength": 1,
            "name": "resourceGroupName",
            "pattern": "^[-\\w\\._\\(\\)]+$",
            "required": true,
            "type": "string",
            "x-ms-parameter-location": "method"
          },
          {
            "$ref": "#/parameters/SolutionName"
          },
          {
            "description": "The number of results to retrieve.",
            "in": "query",
            "name": "$top",
            "required": false,
            "type": "integer"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/IoTSecurityAggregatedRecommendationList"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "description": "Error response structure.",
              "properties": {
                "error": {
                  "description": "Error details.",
                  "properties": {
                    "code": {
                      "description": "An identifier for the error. Codes are invariant and are intended to be consumed programmatically.",
                      "readOnly": true,
                      "type": "string"
                    },
                    "message": {
                      "description": "A message describing the error, intended to be suitable for display in a user interface.",
                      "readOnly": true,
                      "type": "string"
                    }
                  },
                  "type": "object",
                  "x-ms-external": true
                }
              },
              "type": "object",
              "x-ms-external": true
            }
          }
        },
        "tags": [
          "IoT Security Solutions Analytics"
        ],
        "x-ms-examples": {
          "Get Security Solutions Analytics": {
            "parameters": {
              "api-version": "2017-08-01-preview",
              "resourceGroupName": "IoTEdgeResources",
              "solutionName": "default",
              "subscriptionId": "075423e9-7d33-4166-8bdf-3920b04e3735"
            },
            "responses": {
              "200": {
                "body": {
                  "value": [
                    {
                      "id": "/subscriptions/075423e9-7d33-4166-8bdf-3920b04e3735/resourceGroups/IoTEdgeResources/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/OpenPortsOnDevice",
                      "name": "/subscriptions/075423e9-7d33-4166-8bdf-3920b04e3735/resourceGroups/IoTEdgeResources/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/OpenPortsOnDevice",
                      "properties": {
                        "description": "An allowed firewall policy was found in main firewall Chains (INPUT/OUTPUT). The policy should Deny all traffic by default define rules to allow necessary communication to/from the device",
                        "detectedBy": "Microsoft",
                        "healthyDevices": 10000,
                        "logAnalyticsQuery": "SecurityRecommendation | where tolower(AssessedResourceId) == tolower('/subscriptions/075423e9-7d33-4166-8bdf-3920b04e3735/resourceGroups/IoTEdgeResources/providers/Microsoft.Devices/IotHubs/t-ofdadu-hub') and tolower(RecommendationName) == tolower('OpenPortsOnDevice')",
                        "recommendationDisplayName": "Permissive firewall policy in one of the chains was found",
                        "recommendationName": "OpenPortsOnDevice",
                        "recommendationTypeId": "{20ff7fc3-e762-44dd-bd96-b71116dcdc23}",
                        "remediationSteps": "",
                        "reportedSeverity": "Low",
                        "unhealthyDeviceCount": 200
                      },
                      "type": "Microsoft.Security/IoTSecurityAggregatedRecommendation"
                    },
                    {
                      "id": "/subscriptions/075423e9-7d33-4166-8bdf-3920b04e3735/resourceGroups/IoTEdgeResources/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/TooLargeIPRange",
                      "name": "/subscriptions/075423e9-7d33-4166-8bdf-3920b04e3735/resourceGroups/IoTEdgeResources/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/IoT_InstallAgent",
                      "properties": {
                        "description": "An allow IP filter rule source IP range is too large. Overly permissive rules can expose your IoT hub to malicious actors.",
                        "detectedBy": "Microsoft",
                        "healthyDevices": 130000,
                        "logAnalyticsQuery": "SecurityRecommendation | where tolower(AssessedResourceId) == tolower('/subscriptions/075423e9-7d33-4166-8bdf-3920b04e3735/resourceGroups/IoTEdgeResources/providers/Microsoft.Devices/IotHubs/t-ofdadu-hub') and tolower(RecommendationName) == tolower('TooLargeIPRange')",
                        "recommendationDisplayName": "Permissive firewall policy in one of the chains was found",
                        "recommendationName": "TooLargeIPRange",
                        "recommendationTypeId": "{20ff7fc3-e762-44dd-bd96-b71116dcdc23}",
                        "remediationSteps": "",
                        "reportedSeverity": "High",
                        "unhealthyDeviceCount": 1
                      },
                      "type": "Microsoft.Security/IoTSecurityAggregatedRecommendation"
                    }
                  ]
                }
              }
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/iotSecuritySolutions/{solutionName}/analyticsModels/default/aggregatedRecommendations/{aggregatedRecommendationName}": {
      "get": {
        "description": "Security Analytics of a security solution",
        "operationId": "IoTSecuritySolutionsAnalyticsRecommendation_Get",
        "parameters": [
          {
            "description": "API version for the operation",
            "in": "query",
            "name": "api-version",
            "required": true,
            "type": "string"
          },
          {
            "description": "Azure subscription ID",
            "in": "path",
            "name": "subscriptionId",
            "pattern": "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$",
            "required": true,
            "type": "string"
          },
          {
            "description": "The name of the resource group within the user's subscription. The name is case insensitive.",
            "in": "path",
            "maxLength": 90,
            "minLength": 1,
            "name": "resourceGroupName",
            "pattern": "^[-\\w\\._\\(\\)]+$",
            "required": true,
            "type": "string",
            "x-ms-parameter-location": "method"
          },
          {
            "$ref": "#/parameters/SolutionName"
          },
          {
            "$ref": "#/parameters/AggregatedRecommendationName"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/IoTSecurityAggregatedRecommendation"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "description": "Error response structure.",
              "properties": {
                "error": {
                  "description": "Error details.",
                  "properties": {
                    "code": {
                      "description": "An identifier for the error. Codes are invariant and are intended to be consumed programmatically.",
                      "readOnly": true,
                      "type": "string"
                    },
                    "message": {
                      "description": "A message describing the error, intended to be suitable for display in a user interface.",
                      "readOnly": true,
                      "type": "string"
                    }
                  },
                  "type": "object",
                  "x-ms-external": true
                }
              },
              "type": "object",
              "x-ms-external": true
            }
          }
        },
        "tags": [
          "IoT Security Solutions Analytics"
        ],
        "x-ms-examples": {
          "Get Security Solutions Analytics": {
            "parameters": {
              "aggregatedRecommendationName": "OpenPortsOnDevice",
              "api-version": "2017-08-01-preview",
              "resourceGroupName": "IoTEdgeResources",
              "solutionName": "default",
              "subscriptionId": "075423e9-7d33-4166-8bdf-3920b04e3735"
            },
            "responses": {
              "200": {
                "body": {
                  "id": "/subscriptions/075423e9-7d33-4166-8bdf-3920b04e3735/resourceGroups/IoTEdgeResources/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/OpenPortsOnDevice",
                  "name": "/subscriptions/075423e9-7d33-4166-8bdf-3920b04e3735/resourceGroups/IoTEdgeResources/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/OpenPortsOnDevice",
                  "properties": {
                    "description": "An allowed firewall policy was found in main firewall Chains (INPUT/OUTPUT). The policy should Deny all traffic by default define rules to allow necessary communication to/from the device",
                    "detectedBy": "Microsoft",
                    "healthyDevices": 10000,
                    "logAnalyticsQuery": "SecurityRecommendation | where tolower(AssessedResourceId) == tolower('/subscriptions/075423e9-7d33-4166-8bdf-3920b04e3735/resourceGroups/IoTEdgeResources/providers/Microsoft.Devices/IotHubs/t-ofdadu-hub') and tolower(RecommendationName) == tolower('OpenPortsOnDevice')",
                    "recommendationDisplayName": "Permissive firewall policy in one of the chains was found",
                    "recommendationName": "OpenPortsOnDevice",
                    "recommendationTypeId": "{20ff7fc3-e762-44dd-bd96-b71116dcdc23}",
                    "remediationSteps": "",
                    "reportedSeverity": "Low",
                    "unhealthyDeviceCount": 200
                  },
                  "type": "Microsoft.Security/IoTSecurityAggregatedRecommendation"
                }
              }
            }
          }
        }
      }
    }
  },
  "definitions": {
    "IoTSecurityAggregatedAlert": {
      "allOf": [
        {
          "description": "Describes an Azure resource.",
          "properties": {
            "id": {
              "description": "Resource Id",
              "readOnly": true,
              "type": "string"
            },
            "name": {
              "description": "Resource name",
              "readOnly": true,
              "type": "string"
            },
            "type": {
              "description": "Resource type",
              "readOnly": true,
              "type": "string"
            }
          },
          "type": "object",
          "x-ms-azure-resource": true
        },
        {
          "$ref": "#/definitions/TagsResource"
        }
      ],
      "description": "Security Solution Aggregated Alert information",
      "properties": {
        "properties": {
          "$ref": "#/definitions/IoTSecurityAggregatedAlertProperties",
          "description": "Security Solution  Aggregated Alert data",
          "x-ms-client-flatten": true
        }
      },
      "type": "object"
    },
    "IoTSecurityAggregatedAlertList": {
      "description": "List of IoT aggregated security alerts",
      "properties": {
        "nextLink": {
          "description": "The URI to fetch the next page.",
          "readOnly": true,
          "type": "string"
        },
        "value": {
          "description": "List of aggregated alerts data",
          "items": {
            "$ref": "#/definitions/IoTSecurityAggregatedAlert"
          },
          "type": "array"
        }
      },
      "required": [
        "value"
      ]
    },
    "IoTSecurityAggregatedAlertProperties": {
      "description": "Security Solution Aggregated Alert data",
      "properties": {
        "actionTaken": {
          "description": "The action that was taken as a response to the alert (Active, Blocked etc.)",
          "readOnly": true,
          "type": "string"
        },
        "aggregatedDateUtc": {
          "description": "The date the incidents were detected by the vendor",
          "format": "date",
          "readOnly": true,
          "type": "string"
        },
        "alertDisplayName": {
          "description": "Display name of the alert type",
          "readOnly": true,
          "type": "string"
        },
        "alertType": {
          "description": "Name of the alert type",
          "readOnly": true,
          "type": "string"
        },
        "count": {
          "description": "Occurrence number of the alert within the aggregated date",
          "readOnly": true,
          "type": "integer"
        },
        "description": {
          "description": "Description of the incident and what it means",
          "readOnly": true,
          "type": "string"
        },
        "effectedResourceType": {
          "description": "Azure resource ID of the resource that got the alerts",
          "readOnly": true,
          "type": "string"
        },
        "logAnalyticsQuery": {
          "description": "query in log analytics to get the list of affected devices/alerts",
          "readOnly": true,
          "type": "string"
        },
        "remediationSteps": {
          "description": "Recommended steps for remediation",
          "readOnly": true,
          "type": "string"
        },
        "reportedSeverity": {
          "description": "Estimated severity of this alert",
          "enum": [
            "Informational",
            "Low",
            "Medium",
            "High"
          ],
          "readOnly": true,
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "reportedSeverity",
            "values": [
              {
                "value": "Informational"
              },
              {
                "value": "Low"
              },
              {
                "value": "Medium"
              },
              {
                "value": "High"
              }
            ]
          }
        },
        "systemSource": {
          "description": "The type of the alerted resource (Azure, Non-Azure)",
          "readOnly": true,
          "type": "string"
        },
        "vendorName": {
          "description": "Name of the vendor that discovered the incident",
          "readOnly": true,
          "type": "string"
        }
      },
      "type": "object"
    },
    "IoTSecurityAggregatedRecommendation": {
      "allOf": [
        {
          "description": "Describes an Azure resource.",
          "properties": {
            "id": {
              "description": "Resource Id",
              "readOnly": true,
              "type": "string"
            },
            "name": {
              "description": "Resource name",
              "readOnly": true,
              "type": "string"
            },
            "type": {
              "description": "Resource type",
              "readOnly": true,
              "type": "string"
            }
          },
          "type": "object",
          "x-ms-azure-resource": true
        },
        {
          "$ref": "#/definitions/TagsResource"
        }
      ],
      "description": "Security Solution Recommendation Information",
      "properties": {
        "properties": {
          "$ref": "#/definitions/IoTSecurityAggregatedRecommendationProperties",
          "description": "Security Solution data",
          "x-ms-client-flatten": true
        }
      },
      "type": "object"
    },
    "IoTSecurityAggregatedRecommendationList": {
      "description": "List of IoT aggregated security recommendations",
      "properties": {
        "nextLink": {
          "description": "The URI to fetch the next page.",
          "readOnly": true,
          "type": "string"
        },
        "value": {
          "description": "List of aggregated alerts data",
          "items": {
            "$ref": "#/definitions/IoTSecurityAggregatedRecommendation"
          },
          "type": "array"
        }
      },
      "required": [
        "value"
      ]
    },
    "IoTSecurityAggregatedRecommendationProperties": {
      "description": "Security Solution Recommendation Information",
      "properties": {
        "description": {
          "description": "Description of the incident and what it means",
          "readOnly": true,
          "type": "string"
        },
        "detectedBy": {
          "description": "Name of the vendor that discovered the issue",
          "readOnly": true,
          "type": "string"
        },
        "healthyDevices": {
          "description": "the number of the healthy devices within the solution",
          "readOnly": true,
          "type": "integer"
        },
        "logAnalyticsQuery": {
          "description": "query in log analytics to get the list of affected devices/alerts",
          "readOnly": true,
          "type": "string"
        },
        "recommendationDisplayName": {
          "description": "Display name of the recommendation type.",
          "readOnly": true,
          "type": "string"
        },
        "recommendationName": {
          "description": "Name of the recommendation",
          "type": "string"
        },
        "recommendationTypeId": {
          "description": "The recommendation-type GUID.",
          "readOnly": true,
          "type": "string"
        },
        "remediationSteps": {
          "description": "Recommended steps for remediation",
          "readOnly": true,
          "type": "string"
        },
        "reportedSeverity": {
          "description": "Estimated severity of this recommendation",
          "enum": [
            "Informational",
            "Low",
            "Medium",
            "High"
          ],
          "readOnly": true,
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "reportedSeverity",
            "values": [
              {
                "value": "Informational"
              },
              {
                "value": "Low"
              },
              {
                "value": "Medium"
              },
              {
                "value": "High"
              }
            ]
          }
        },
        "unhealthyDeviceCount": {
          "description": "the number of the unhealthy devices within the solution",
          "readOnly": true,
          "type": "integer"
        }
      },
      "type": "object"
    },
    "IoTSecurityAlertedDevice": {
      "description": "Statistic information about the number of alerts per device during the last period",
      "properties": {
        "alertsCount": {
          "description": "the number of alerts raised for this device",
          "readOnly": true,
          "type": "integer"
        },
        "deviceId": {
          "description": "Name of the alert type",
          "readOnly": true,
          "type": "string"
        }
      },
      "type": "object"
    },
    "IoTSecurityAlertedDevicesList": {
      "description": "List of devices with the count of raised alerts",
      "properties": {
        "nextLink": {
          "description": "The URI to fetch the next page.",
          "readOnly": true,
          "type": "string"
        },
        "value": {
          "description": "List of aggregated alerts data",
          "items": {
            "$ref": "#/definitions/IoTSecurityAlertedDevice"
          },
          "type": "array"
        }
      },
      "required": [
        "value"
      ]
    },
    "IoTSecurityDeviceAlert": {
      "description": "Statistic information about the number of alerts per alert type during the last period",
      "properties": {
        "alertDisplayName": {
          "description": "Display name of the alert",
          "readOnly": true,
          "type": "string"
        },
        "alertsCount": {
          "description": "the number of alerts raised for this alert type",
          "readOnly": true,
          "type": "integer"
        },
        "reportedSeverity": {
          "description": "Estimated severity of this alert",
          "enum": [
            "Informational",
            "Low",
            "Medium",
            "High"
          ],
          "readOnly": true,
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "reportedSeverity",
            "values": [
              {
                "value": "Informational"
              },
              {
                "value": "Low"
              },
              {
                "value": "Medium"
              },
              {
                "value": "High"
              }
            ]
          }
        }
      },
      "type": "object"
    },
    "IoTSecurityDeviceAlertsList": {
      "description": "List of alerts with the count of raised alerts",
      "properties": {
        "nextLink": {
          "description": "The URI to fetch the next page.",
          "readOnly": true,
          "type": "string"
        },
        "value": {
          "description": "List of top alerts data",
          "items": {
            "$ref": "#/definitions/IoTSecurityDeviceAlert"
          },
          "type": "array"
        }
      },
      "required": [
        "value"
      ]
    },
    "IoTSecurityDeviceRecommendation": {
      "description": "Statistic information about the number of recommendations per recommendation type",
      "properties": {
        "devicesCount": {
          "description": "the number of device with this recommendation",
          "readOnly": true,
          "type": "integer"
        },
        "recommendationDisplayName": {
          "description": "Display name of the recommendation",
          "readOnly": true,
          "type": "string"
        },
        "reportedSeverity": {
          "description": "Estimated severity of this recommendation",
          "enum": [
            "Informational",
            "Low",
            "Medium",
            "High"
          ],
          "readOnly": true,
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "reportedSeverity",
            "values": [
              {
                "value": "Informational"
              },
              {
                "value": "Low"
              },
              {
                "value": "Medium"
              },
              {
                "value": "High"
              }
            ]
          }
        }
      },
      "type": "object"
    },
    "IoTSecurityDeviceRecommendationsList": {
      "description": "List of recommendations with the count of devices",
      "properties": {
        "nextLink": {
          "description": "The URI to fetch the next page.",
          "readOnly": true,
          "type": "string"
        },
        "value": {
          "description": "List of aggregated recommendation data",
          "items": {
            "$ref": "#/definitions/IoTSecurityDeviceRecommendation"
          },
          "type": "array"
        }
      },
      "required": [
        "value"
      ]
    },
    "IoTSecuritySolutionAnalyticsModel": {
      "allOf": [
        {
          "description": "Describes an Azure resource.",
          "properties": {
            "id": {
              "description": "Resource Id",
              "readOnly": true,
              "type": "string"
            },
            "name": {
              "description": "Resource name",
              "readOnly": true,
              "type": "string"
            },
            "type": {
              "description": "Resource type",
              "readOnly": true,
              "type": "string"
            }
          },
          "type": "object",
          "x-ms-azure-resource": true
        }
      ],
      "description": "Security Analytics of a security solution",
      "properties": {
        "properties": {
          "$ref": "#/definitions/IoTSecuritySolutionAnalyticsModelProperties",
          "description": "Security Solution  Aggregated Alert data",
          "x-ms-client-flatten": true
        }
      },
      "type": "object"
    },
    "IoTSecuritySolutionAnalyticsModelList": {
      "description": "List of Security Analytics of a security solution",
      "properties": {
        "nextLink": {
          "description": "The URI to fetch the next page.",
          "readOnly": true,
          "type": "string"
        },
        "value": {
          "description": "List of Security Analytics of a security solution",
          "items": {
            "$ref": "#/definitions/IoTSecuritySolutionAnalyticsModel"
          },
          "type": "array"
        }
      },
      "required": [
        "value"
      ]
    },
    "IoTSecuritySolutionAnalyticsModelProperties": {
      "description": "Security Analytics of a security solution properties",
      "properties": {
        "devicesMetrics": {
          "description": "The list of devices metrics by the aggregated date.",
          "items": {
            "properties": {
              "date": {
                "description": "the date of the metrics",
                "format": "date-time",
                "type": "string"
              },
              "devicesMetrics": {
                "$ref": "#/definitions/IoTSeverityMetrics",
                "description": "devices alerts count by severity.",
                "type": "object"
              }
            }
          },
          "readOnly": true,
          "type": "array"
        },
        "metrics": {
          "$ref": "#/definitions/IoTSeverityMetrics",
          "description": "Security Analytics of a security solution",
          "readOnly": true,
          "type": "object"
        },
        "mostPrevalentDeviceAlerts": {
          "$ref": "#/definitions/IoTSecurityDeviceAlertsList",
          "description": "The list of most prevalent 3 alerts.",
          "type": "object"
        },
        "mostPrevalentDeviceRecommendations": {
          "$ref": "#/definitions/IoTSecurityDeviceRecommendationsList",
          "description": "The list of most prevalent 3 recommendations.",
          "type": "object"
        },
        "topAlertedDevices": {
          "$ref": "#/definitions/IoTSecurityAlertedDevicesList",
          "description": "The list of top 3 devices with the most attacked.",
          "type": "object"
        },
        "unhealthyDeviceCount": {
          "description": "number of unhealthy devices",
          "readOnly": true,
          "type": "integer"
        }
      }
    },
    "IoTSeverityMetrics": {
      "description": "Severity metrics",
      "properties": {
        "high": {
          "description": "count of high severity items",
          "type": "integer"
        },
        "low": {
          "description": "count of low severity items",
          "type": "integer"
        },
        "medium": {
          "description": "count of medium severity items",
          "type": "integer"
        }
      },
      "type": "object"
    },
    "TagsResource": {
      "description": "A container holding only the Tags for a resource, allowing the user to update the tags.",
      "properties": {
        "tags": {
          "additionalProperties": {
            "type": "string"
          },
          "description": "Resource tags",
          "type": "object"
        }
      }
    }
  }
}