{
  "swagger": "2.0",
  "schemes": [
    "https"
  ],
  "host": "management.azure.com",
  "info": {
    "description": "API spec for Microsoft.SecurityInsights (Azure Security Insights) resource provider",
    "title": "Security Insights",
    "version": "2019-01-01-preview",
    "x-apisguru-categories": [
      "cloud"
    ],
    "x-logo": {
      "url": "https://api.apis.guru/v2/cache/logo/https_assets.onestore.ms_cdnfiles_onestorerolling-1606-01000_shell_v3_images_logo_microsoft.png"
    },
    "x-origin": [
      {
        "format": "swagger",
        "url": "https://raw.githubusercontent.com/Azure/azure-rest-api-specs/master/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/SecurityInsights.json",
        "version": "2.0"
      }
    ],
    "x-preferred": false,
    "x-providerName": "azure.com",
    "x-serviceName": "securityinsights-SecurityInsights",
    "x-tags": [
      "Azure",
      "Microsoft"
    ]
  },
  "consumes": [
    "application/json"
  ],
  "produces": [
    "application/json"
  ],
  "securityDefinitions": {
    "azure_auth": {
      "authorizationUrl": "https://login.microsoftonline.com/common/oauth2/authorize",
      "description": "Azure Active Directory OAuth2 Flow",
      "flow": "implicit",
      "scopes": {
        "user_impersonation": "impersonate your user account"
      },
      "type": "oauth2"
    }
  },
  "security": [
    {
      "azure_auth": [
        "user_impersonation"
      ]
    }
  ],
  "parameters": {
    "Action": {
      "description": "The action",
      "in": "body",
      "name": "action",
      "required": true,
      "schema": {
        "$ref": "#/definitions/ActionRequest"
      },
      "x-ms-parameter-location": "method"
    },
    "ActionId": {
      "description": "Action ID",
      "in": "path",
      "name": "actionId",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "AggregationsName": {
      "description": "The aggregation name. Supports - Cases",
      "in": "path",
      "name": "aggregationsName",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "AlertRule": {
      "description": "The alert rule",
      "in": "body",
      "name": "alertRule",
      "required": true,
      "schema": {
        "$ref": "#/definitions/AlertRule"
      },
      "x-ms-parameter-location": "method"
    },
    "AlertRuleTemplateId": {
      "description": "Alert rule template ID",
      "in": "path",
      "name": "alertRuleTemplateId",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "ApiVersion": {
      "description": "API version for the operation",
      "enum": [
        "2019-01-01-preview"
      ],
      "in": "query",
      "name": "api-version",
      "required": true,
      "type": "string"
    },
    "Bookmark": {
      "description": "The bookmark",
      "in": "body",
      "name": "bookmark",
      "required": true,
      "schema": {
        "$ref": "#/definitions/Bookmark"
      },
      "x-ms-parameter-location": "method"
    },
    "BookmarkId": {
      "description": "Bookmark ID",
      "in": "path",
      "name": "bookmarkId",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "Case": {
      "description": "The case",
      "in": "body",
      "name": "case",
      "required": true,
      "schema": {
        "$ref": "#/definitions/Case"
      },
      "x-ms-parameter-location": "method"
    },
    "CaseComment": {
      "description": "The case comment",
      "in": "body",
      "name": "caseComment",
      "required": true,
      "schema": {
        "$ref": "#/definitions/CaseComment"
      },
      "x-ms-parameter-location": "method"
    },
    "CaseCommentId": {
      "description": "Case comment ID",
      "in": "path",
      "name": "caseCommentId",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "CaseId": {
      "description": "Case ID",
      "in": "path",
      "name": "caseId",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "ConsentId": {
      "description": "consent ID",
      "in": "path",
      "name": "consentId",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "DataConnector": {
      "description": "The data connector",
      "in": "body",
      "name": "dataConnector",
      "required": true,
      "schema": {
        "$ref": "#/definitions/DataConnector"
      },
      "x-ms-parameter-location": "method"
    },
    "DataConnectorId": {
      "description": "Connector ID",
      "in": "path",
      "name": "dataConnectorId",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "EntityExpandRequestBody": {
      "description": "The parameters required to execute an expand operation on the given entity.",
      "in": "body",
      "name": "parameters",
      "required": true,
      "schema": {
        "$ref": "#/definitions/EntityExpandParameters"
      },
      "x-ms-parameter-location": "method"
    },
    "EntityId": {
      "description": "entity ID",
      "in": "path",
      "name": "entityId",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "EntityQueryId": {
      "description": "entity query ID",
      "in": "path",
      "name": "entityQueryId",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "ODataFilter": {
      "description": "Filters the results, based on a Boolean condition. Optional.",
      "in": "query",
      "name": "$filter",
      "required": false,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "ODataOrderBy": {
      "description": "Sorts the results. Optional.",
      "in": "query",
      "name": "$orderby",
      "required": false,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "ODataSkipToken": {
      "description": "Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional.",
      "in": "query",
      "name": "$skipToken",
      "required": false,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "ODataTop": {
      "description": "Returns only the first n results. Optional.",
      "format": "int32",
      "in": "query",
      "name": "$top",
      "required": false,
      "type": "integer",
      "x-ms-parameter-location": "method"
    },
    "OperationalInsightsResourceProvider": {
      "description": "The namespace of workspaces resource provider- Microsoft.OperationalInsights.",
      "in": "path",
      "name": "operationalInsightsResourceProvider",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "RelationInputModel": {
      "description": "The relation input model",
      "in": "body",
      "name": "relationInputModel",
      "required": true,
      "schema": {
        "$ref": "#/definitions/RelationsModelInput"
      },
      "x-ms-parameter-location": "method"
    },
    "RelationName": {
      "description": "Relation Name",
      "in": "path",
      "name": "relationName",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "ResourceGroupName": {
      "description": "The name of the resource group within the user's subscription. The name is case insensitive.",
      "in": "path",
      "maxLength": 90,
      "minLength": 1,
      "name": "resourceGroupName",
      "pattern": "^[-\\w\\._\\(\\)]+$",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "RuleId": {
      "description": "Alert rule ID",
      "in": "path",
      "name": "ruleId",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "Settings": {
      "description": "The setting",
      "in": "body",
      "name": "settings",
      "required": true,
      "schema": {
        "$ref": "#/definitions/Settings"
      },
      "x-ms-parameter-location": "method"
    },
    "SettingsName": {
      "description": "The setting name. Supports- Fusion, UEBA",
      "in": "path",
      "name": "settingsName",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "SubscriptionId": {
      "description": "Azure subscription ID",
      "in": "path",
      "name": "subscriptionId",
      "pattern": "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$",
      "required": true,
      "type": "string"
    },
    "WorkspaceName": {
      "description": "The name of the workspace.",
      "in": "path",
      "maxLength": 90,
      "minLength": 1,
      "name": "workspaceName",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    }
  },
  "paths": {
    "/providers/Microsoft.SecurityInsights/operations": {
      "get": {
        "description": "Lists all operations available Azure Security Insights Resource Provider.",
        "operationId": "Operations_List",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          }
        ],
        "responses": {
          "200": {
            "description": "OK. Successfully retrieved operations list.",
            "schema": {
              "$ref": "#/definitions/OperationsList"
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/aggregations/{aggregationsName}": {
      "get": {
        "description": "Get aggregative result for the given resources under the defined workspace",
        "operationId": "CasesAggregations_Get",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/AggregationsName"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/Aggregations"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "Aggregations"
        ],
        "x-ms-examples": {
          "Get aggregative data for all cases under the defined workspace, between the time range if specified.": {
            "parameters": {
              "aggregationsName": "Cases",
              "api-version": "2019-01-01-preview",
              "operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/aggregations/Cases",
                  "kind": "CasesAggregation",
                  "name": "Cases",
                  "properties": {
                    "aggregationBySeverity": {
                      "totalCriticalSeverity": 13,
                      "totalHighSeverity": 14,
                      "totalInformationalSeverity": 26,
                      "totalLowSeverity": 15,
                      "totalMediumSeverity": 4
                    },
                    "aggregationByStatus": {
                      "totalDismissedStatus": 1,
                      "totalInProgressStatus": 30,
                      "totalNewStatus": 42,
                      "totalResolvedStatus": 2
                    }
                  },
                  "type": "Microsoft.SecurityInsights/aggregations"
                }
              }
            }
          }
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRuleTemplates": {
      "get": {
        "description": "Gets all alert rule templates.",
        "operationId": "AlertRuleTemplates_List",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/AlertRuleTemplatesList"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "Alert Rule Templates"
        ],
        "x-ms-examples": {
          "Get all alert rule templates.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "value": [
                    {
                      "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/AlertRuleTemplates/65360bb0-8986-4ade-a89d-af3cf44d28aa",
                      "kind": "Scheduled",
                      "name": "65360bb0-8986-4ade-a89d-af3cf44d28aa",
                      "properties": {
                        "alertRulesCreatedByTemplateCount": 0,
                        "createdDateUTC": "2019-02-27T00:00:00Z",
                        "description": "This alert monitors changes to Amazon VPC (Virtual Private Cloud) settings such as new ACL entries and routes in route tables.\nMore information: https://medium.com/@GorillaStack/the-most-important-aws-cloudtrail-security-events-to-track-a5b9873f8255 \nand https://aws.amazon.com/vpc/",
                        "displayName": "Changes to Amazon VPC settings",
                        "query": "let timeframe = 1d;\nAWSCloudTrail\n| where TimeGenerated >= ago(timeframe)\n| where EventName == \"CreateNetworkAclEntry\"\n    or EventName == \"CreateRoute\"\n| project TimeGenerated, EventName, EventTypeName, UserIdentityAccountId, UserIdentityPrincipalid, UserAgent, UserIdentityUserName, SessionMfaAuthenticated, SourceIpAddress, AWSRegion, EventSource, AdditionalEventData, ResponseElements\n| extend AccountCustomEntity = UserIdentityUserName, IPCustomEntity = SourceIpAddress",
                        "queryFrequency": "P1D",
                        "queryPeriod": "P1D",
                        "requiredDataConnectors": [
                          {
                            "connectorId": "AWS",
                            "dataTypes": {
                              "AWSCloudTrail": "Exist"
                            }
                          }
                        ],
                        "severity": "Low",
                        "status": "Available",
                        "tactics": [
                          "PrivilegeEscalation",
                          "LateralMovement"
                        ],
                        "triggerOperator": "GreaterThan",
                        "triggerThreshold": 0
                      },
                      "type": "Microsoft.SecurityInsights/AlertRuleTemplates"
                    },
                    {
                      "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/AlertRuleTemplates/f71aba3d-28fb-450b-b192-4e76a83015c8",
                      "kind": "Fusion",
                      "name": "f71aba3d-28fb-450b-b192-4e76a83015c8",
                      "properties": {
                        "alertRulesCreatedByTemplateCount": 0,
                        "createdDateUTC": "2019-07-25T00:00:00Z",
                        "description": "Place holder: Fusion uses graph powered machine learning algorithms to correlate between millions of lower fidelity anomalous activities from different products such as Azure AD Identity Protection, and Microsoft Cloud App Security, to combine them into a manageable number of interesting security cases.\n",
                        "displayName": "Advanced Multi-Stage Attack Detection",
                        "severity": "High",
                        "status": "Available",
                        "tactics": [
                          "Persistence",
                          "LateralMovement",
                          "Exfiltration",
                          "CommandAndControl"
                        ]
                      },
                      "type": "Microsoft.SecurityInsights/AlertRuleTemplates"
                    },
                    {
                      "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/AlertRuleTemplates/b3cfc7c0-092c-481c-a55b-34a3979758cb",
                      "kind": "MicrosoftSecurityIncidentCreation",
                      "name": "b3cfc7c0-092c-481c-a55b-34a3979758cb",
                      "properties": {
                        "alertRulesCreatedByTemplateCount": 0,
                        "createdDateUTC": "2019-07-16T00:00:00Z",
                        "description": "Create incidents based on all alerts generated in Microsoft Cloud App Security",
                        "displayName": "Create incidents based on Microsoft Cloud App Security alerts",
                        "productFilter": "Microsoft Cloud App Security",
                        "status": "Available"
                      },
                      "type": "Microsoft.SecurityInsights/AlertRuleTemplates"
                    }
                  ]
                }
              }
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRuleTemplates/{alertRuleTemplateId}": {
      "get": {
        "description": "Gets the alert rule template.",
        "operationId": "AlertRuleTemplates_Get",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/AlertRuleTemplateId"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/AlertRuleTemplate"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "Alert Rule Templates"
        ],
        "x-ms-examples": {
          "Get alert rule template by Id.": {
            "parameters": {
              "alertRuleTemplateId": "65360bb0-8986-4ade-a89d-af3cf44d28aa",
              "api-version": "2019-01-01-preview",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRuleTemplates/65360bb0-8986-4ade-a89d-af3cf44d28aa",
                  "kind": "Scheduled",
                  "name": "65360bb0-8986-4ade-a89d-af3cf44d28aa",
                  "properties": {
                    "alertRulesCreatedByTemplateCount": 0,
                    "createdDateUTC": "2019-02-27T00:00:00Z",
                    "description": "This alert monitors changes to Amazon VPC (Virtual Private Cloud) settings such as new ACL entries and routes in route tables.\nMore information: https://medium.com/@GorillaStack/the-most-important-aws-cloudtrail-security-events-to-track-a5b9873f8255 \nand https://aws.amazon.com/vpc/",
                    "displayName": "Changes to Amazon VPC settings",
                    "query": "let timeframe = 1d;\nAWSCloudTrail\n| where TimeGenerated >= ago(timeframe)\n| where EventName == \"CreateNetworkAclEntry\"\n    or EventName == \"CreateRoute\"\n| project TimeGenerated, EventName, EventTypeName, UserIdentityAccountId, UserIdentityPrincipalid, UserAgent, UserIdentityUserName, SessionMfaAuthenticated, SourceIpAddress, AWSRegion, EventSource, AdditionalEventData, ResponseElements\n| extend AccountCustomEntity = UserIdentityUserName, IPCustomEntity = SourceIpAddress",
                    "queryFrequency": "P1D",
                    "queryPeriod": "P1D",
                    "requiredDataConnectors": [
                      {
                        "connectorId": "AWS",
                        "dataTypes": {
                          "AWSCloudTrail": "Exist"
                        }
                      }
                    ],
                    "severity": "Low",
                    "status": "Available",
                    "tactics": [
                      "PrivilegeEscalation",
                      "LateralMovement"
                    ],
                    "triggerOperator": "GreaterThan",
                    "triggerThreshold": 0
                  },
                  "type": "Microsoft.SecurityInsights/AlertRuleTemplates"
                }
              }
            }
          }
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules": {
      "get": {
        "description": "Gets all alert rules.",
        "operationId": "AlertRules_List",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/AlertRulesList"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "Alert Rules"
        ],
        "x-ms-examples": {
          "Get all alert rules.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "value": [
                    {
                      "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                      "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                      "kind": "Scheduled",
                      "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                      "properties": {
                        "alertRuleTemplateName": null,
                        "description": "",
                        "displayName": "Rule2",
                        "enabled": true,
                        "lastModifiedUtc": "2019-01-01T13:15:30Z",
                        "query": "ProtectionStatus | extend HostCustomEntity = Computer | extend IPCustomEntity = ComputerIP_Hidden",
                        "queryFrequency": "PT1H",
                        "queryPeriod": "P2DT1H30M",
                        "severity": "High",
                        "suppressionDuration": "PT1H",
                        "suppressionEnabled": false,
                        "tactics": [
                          "Persistence",
                          "LateralMovement"
                        ],
                        "triggerOperator": "GreaterThan",
                        "triggerThreshold": 0
                      },
                      "type": "Microsoft.SecurityInsights/alertRules"
                    },
                    {
                      "etag": "\"260097e0-0000-0d00-0000-5d6fa88f0000\"",
                      "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/microsoftSecurityIncidentCreationRuleExample",
                      "kind": "MicrosoftSecurityIncidentCreation",
                      "name": "microsoftSecurityIncidentCreationRuleExample",
                      "properties": {
                        "alertRuleTemplateName": null,
                        "description": null,
                        "displayName": "testing displayname",
                        "displayNamesFilter": null,
                        "enabled": true,
                        "lastModifiedUtc": "2019-09-04T12:05:35.7296311Z",
                        "productFilter": "Microsoft Cloud App Security",
                        "severitiesFilter": null,
                        "tactics": []
                      },
                      "type": "Microsoft.SecurityInsights/alertRules"
                    },
                    {
                      "etag": "\"25005c11-0000-0d00-0000-5d6cc0e20000\"",
                      "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/myFirstFusionRule",
                      "kind": "Fusion",
                      "name": "myFirstFusionRule",
                      "properties": {
                        "alertRuleTemplateName": "f71aba3d-28fb-450b-b192-4e76a83015c8",
                        "description": "In this mode, Sentinel combines low fidelity alerts, which themselves may not be actionable, and events across multiple products, into high fidelity security interesting incidents. The system looks at multiple products to produce actionable incidents. Custom tailored to each tenant, Fusion not only reduces false positive rates but also can detect attacks with limited or missing information. \nIncidents generated by Fusion system will encase two or more alerts. By design, Fusion incidents are low volume, high fidelity and will be high severity, which is why Fusion is turned ON by default in Azure Sentinel.\n\nFor Fusion to work, please configure the following data sources in Data Connectors tab:\nRequired - Azure Active Directory Identity Protection\nRequired - Microsoft Cloud App Security\nIf Available - Palo Alto Network\n\nFor full list of scenarios covered by Fusion, and detail instructions on how to configure the required data sources, go to aka.ms/SentinelFusion",
                        "displayName": "Advanced Multi-Stage Attack Detection",
                        "enabled": false,
                        "lastModifiedUtc": "2019-09-02T07:12:34.9065092Z",
                        "severity": "High",
                        "tactics": [
                          "Persistence",
                          "LateralMovement",
                          "Exfiltration",
                          "CommandAndControl"
                        ]
                      },
                      "type": "Microsoft.SecurityInsights/alertRules"
                    }
                  ]
                }
              }
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules/{ruleId}": {
      "delete": {
        "description": "Delete the alert rule.",
        "operationId": "AlertRules_Delete",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/RuleId"
          }
        ],
        "responses": {
          "200": {
            "description": "OK"
          },
          "204": {
            "description": "No Content"
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "Alert Rules"
        ],
        "x-ms-examples": {
          "Delete an alert rule.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "ruleId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {},
              "204": {}
            }
          }
        }
      },
      "get": {
        "description": "Gets the alert rule.",
        "operationId": "AlertRules_Get",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/RuleId"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/AlertRule"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "Alert Rules"
        ],
        "x-ms-examples": {
          "Get a Fusion alert rule.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "ruleId": "myFirstFusionRule",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "etag": "\"260090e2-0000-0d00-0000-5d6fb8670000\"",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/myFirstFusionRule",
                  "kind": "Fusion",
                  "name": "myFirstFusionRule",
                  "properties": {
                    "alertRuleTemplateName": "f71aba3d-28fb-450b-b192-4e76a83015c8",
                    "description": "In this mode, Sentinel combines low fidelity alerts, which themselves may not be actionable, and events across multiple products, into high fidelity security interesting incidents. The system looks at multiple products to produce actionable incidents. Custom tailored to each tenant, Fusion not only reduces false positive rates but also can detect attacks with limited or missing information. \nIncidents generated by Fusion system will encase two or more alerts. By design, Fusion incidents are low volume, high fidelity and will be high severity, which is why Fusion is turned ON by default in Azure Sentinel.\n\nFor Fusion to work, please configure the following data sources in Data Connectors tab:\nRequired - Azure Active Directory Identity Protection\nRequired - Microsoft Cloud App Security\nIf Available - Palo Alto Network\n\nFor full list of scenarios covered by Fusion, and detail instructions on how to configure the required data sources, go to aka.ms/SentinelFusion",
                    "displayName": "Advanced Multi-Stage Attack Detection",
                    "enabled": true,
                    "lastModifiedUtc": "2019-09-04T13:13:11.5340061Z",
                    "severity": "High",
                    "tactics": [
                      "Persistence",
                      "LateralMovement",
                      "Exfiltration",
                      "CommandAndControl"
                    ]
                  },
                  "type": "Microsoft.SecurityInsights/alertRules"
                }
              }
            }
          },
          "Get a MicrosoftSecurityIncidentCreation rule.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "ruleId": "microsoftSecurityIncidentCreationRuleExample",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "etag": "\"260097e0-0000-0d00-0000-5d6fa88f0000\"",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/microsoftSecurityIncidentCreationRuleExample",
                  "kind": "MicrosoftSecurityIncidentCreation",
                  "name": "microsoftSecurityIncidentCreationRuleExample",
                  "properties": {
                    "alertRuleTemplateName": null,
                    "description": null,
                    "displayName": "testing displayname",
                    "displayNamesFilter": null,
                    "enabled": true,
                    "lastModifiedUtc": "2019-09-04T12:05:35.7296311Z",
                    "productFilter": "Microsoft Cloud App Security",
                    "severitiesFilter": null,
                    "tactics": []
                  },
                  "type": "Microsoft.SecurityInsights/alertRules"
                }
              }
            }
          },
          "Get a Scheduled alert rule.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "ruleId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                  "kind": "Scheduled",
                  "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                  "properties": {
                    "alertRuleTemplateName": null,
                    "description": "",
                    "displayName": "Rule2",
                    "enabled": true,
                    "lastModifiedUtc": "2019-01-01T13:15:30Z",
                    "query": "ProtectionStatus | extend HostCustomEntity = Computer | extend IPCustomEntity = ComputerIP_Hidden",
                    "queryFrequency": "PT1H",
                    "queryPeriod": "P2DT1H30M",
                    "severity": "High",
                    "suppressionDuration": "PT1H",
                    "suppressionEnabled": false,
                    "tactics": [
                      "Persistence",
                      "LateralMovement"
                    ],
                    "triggerOperator": "GreaterThan",
                    "triggerThreshold": 0
                  },
                  "type": "Microsoft.SecurityInsights/alertRules"
                }
              }
            }
          }
        }
      },
      "put": {
        "description": "Creates or updates the alert rule.",
        "operationId": "AlertRules_CreateOrUpdate",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/RuleId"
          },
          {
            "$ref": "#/parameters/AlertRule"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/AlertRule"
            }
          },
          "201": {
            "description": "Created",
            "schema": {
              "$ref": "#/definitions/AlertRule"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "Alert Rules"
        ],
        "x-ms-examples": {
          "Creates or updates a Fusion alert rule.": {
            "parameters": {
              "alertRule": {
                "etag": "3d00c3ca-0000-0100-0000-5d42d5010000",
                "kind": "Fusion",
                "properties": {
                  "alertRuleTemplateName": "f71aba3d-28fb-450b-b192-4e76a83015c8",
                  "enabled": "true"
                }
              },
              "api-version": "2019-01-01-preview",
              "operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
              "resourceGroupName": "myRg",
              "ruleId": "myFirstFusionRule",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "etag": "\"260090e2-0000-0d00-0000-5d6fb8670000\"",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/myFirstFusionRule",
                  "kind": "Fusion",
                  "name": "myFirstFusionRule",
                  "properties": {
                    "alertRuleTemplateName": "f71aba3d-28fb-450b-b192-4e76a83015c8",
                    "description": "In this mode, Sentinel combines low fidelity alerts, which themselves may not be actionable, and events across multiple products, into high fidelity security interesting incidents. The system looks at multiple products to produce actionable incidents. Custom tailored to each tenant, Fusion not only reduces false positive rates but also can detect attacks with limited or missing information. \nIncidents generated by Fusion system will encase two or more alerts. By design, Fusion incidents are low volume, high fidelity and will be high severity, which is why Fusion is turned ON by default in Azure Sentinel.\n\nFor Fusion to work, please configure the following data sources in Data Connectors tab:\nRequired - Azure Active Directory Identity Protection\nRequired - Microsoft Cloud App Security\nIf Available - Palo Alto Network\n\nFor full list of scenarios covered by Fusion, and detail instructions on how to configure the required data sources, go to aka.ms/SentinelFusion",
                    "displayName": "Advanced Multi-Stage Attack Detection",
                    "enabled": true,
                    "lastModifiedUtc": "2019-09-04T13:13:11.5340061Z",
                    "severity": "High",
                    "tactics": [
                      "Persistence",
                      "LateralMovement",
                      "Exfiltration",
                      "CommandAndControl"
                    ]
                  },
                  "type": "Microsoft.SecurityInsights/alertRules"
                }
              },
              "201": {
                "body": {
                  "etag": "\"260090e2-0000-0d00-0000-5d6fb8670000\"",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/myFirstFusionRule",
                  "kind": "Fusion",
                  "name": "myFirstFusionRule",
                  "properties": {
                    "alertRuleTemplateName": "f71aba3d-28fb-450b-b192-4e76a83015c8",
                    "description": "In this mode, Sentinel combines low fidelity alerts, which themselves may not be actionable, and events across multiple products, into high fidelity security interesting incidents. The system looks at multiple products to produce actionable incidents. Custom tailored to each tenant, Fusion not only reduces false positive rates but also can detect attacks with limited or missing information. \nIncidents generated by Fusion system will encase two or more alerts. By design, Fusion incidents are low volume, high fidelity and will be high severity, which is why Fusion is turned ON by default in Azure Sentinel.\n\nFor Fusion to work, please configure the following data sources in Data Connectors tab:\nRequired - Azure Active Directory Identity Protection\nRequired - Microsoft Cloud App Security\nIf Available - Palo Alto Network\n\nFor full list of scenarios covered by Fusion, and detail instructions on how to configure the required data sources, go to aka.ms/SentinelFusion",
                    "displayName": "Advanced Multi-Stage Attack Detection",
                    "enabled": true,
                    "lastModifiedUtc": "2019-09-04T13:13:11.5340061Z",
                    "severity": "High",
                    "tactics": [
                      "Persistence",
                      "LateralMovement",
                      "Exfiltration",
                      "CommandAndControl"
                    ]
                  },
                  "type": "Microsoft.SecurityInsights/alertRules"
                }
              }
            }
          },
          "Creates or updates a MicrosoftSecurityIncidentCreation rule.": {
            "parameters": {
              "alertRule": {
                "etag": "\"260097e0-0000-0d00-0000-5d6fa88f0000\"",
                "kind": "MicrosoftSecurityIncidentCreation",
                "properties": {
                  "displayName": "testing displayname",
                  "enabled": true,
                  "productFilter": "Microsoft Cloud App Security"
                }
              },
              "api-version": "2019-01-01-preview",
              "operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
              "resourceGroupName": "myRg",
              "ruleId": "microsoftSecurityIncidentCreationRuleExample",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "etag": "\"260097e0-0000-0d00-0000-5d6fa88f0000\"",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/microsoftSecurityIncidentCreationRuleExample",
                  "kind": "MicrosoftSecurityIncidentCreation",
                  "name": "microsoftSecurityIncidentCreationRuleExample",
                  "properties": {
                    "alertRuleTemplateName": null,
                    "description": null,
                    "displayName": "testing displayname",
                    "displayNamesFilter": null,
                    "enabled": true,
                    "lastModifiedUtc": "2019-09-04T12:05:35.7296311Z",
                    "productFilter": "Microsoft Cloud App Security",
                    "severitiesFilter": null,
                    "tactics": []
                  },
                  "type": "Microsoft.SecurityInsights/alertRules"
                }
              },
              "201": {
                "body": {
                  "etag": "\"260097e0-0000-0d00-0000-5d6fa88f0000\"",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/microsoftSecurityIncidentCreationRuleExample",
                  "kind": "MicrosoftSecurityIncidentCreation",
                  "name": "microsoftSecurityIncidentCreationRuleExample",
                  "properties": {
                    "alertRuleTemplateName": null,
                    "description": null,
                    "displayName": "testing displayname",
                    "displayNamesFilter": null,
                    "enabled": true,
                    "lastModifiedUtc": "2019-09-04T12:05:35.7296311Z",
                    "productFilter": "Microsoft Cloud App Security",
                    "severitiesFilter": null,
                    "tactics": []
                  },
                  "type": "Microsoft.SecurityInsights/alertRules"
                }
              }
            }
          },
          "Creates or updates a Scheduled alert rule.": {
            "parameters": {
              "alertRule": {
                "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                "kind": "Scheduled",
                "properties": {
                  "description": "",
                  "displayName": "Rule2",
                  "enabled": true,
                  "query": "ProtectionStatus | extend HostCustomEntity = Computer | extend IPCustomEntity = ComputerIP_Hidden",
                  "queryFrequency": "PT1H",
                  "queryPeriod": "P2DT1H30M",
                  "severity": "High",
                  "suppressionDuration": "PT1H",
                  "suppressionEnabled": false,
                  "tactics": [
                    "Persistence",
                    "LateralMovement"
                  ],
                  "triggerOperator": "GreaterThan",
                  "triggerThreshold": 0
                }
              },
              "api-version": "2019-01-01-preview",
              "operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
              "resourceGroupName": "myRg",
              "ruleId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                  "kind": "Scheduled",
                  "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                  "properties": {
                    "alertRuleTemplateName": null,
                    "description": "",
                    "displayName": "Rule2",
                    "enabled": true,
                    "lastModifiedUtc": "2019-01-01T13:15:30Z",
                    "query": "ProtectionStatus | extend HostCustomEntity = Computer | extend IPCustomEntity = ComputerIP_Hidden",
                    "queryFrequency": "PT1H",
                    "queryPeriod": "P2DT1H30M",
                    "severity": "High",
                    "suppressionDuration": "PT1H",
                    "suppressionEnabled": false,
                    "tactics": [
                      "Persistence",
                      "LateralMovement"
                    ],
                    "triggerOperator": "GreaterThan",
                    "triggerThreshold": 0
                  },
                  "type": "Microsoft.SecurityInsights/alertRules"
                }
              },
              "201": {
                "body": {
                  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                  "kind": "Scheduled",
                  "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                  "properties": {
                    "alertRuleTemplateName": null,
                    "description": "",
                    "displayName": "Rule2",
                    "enabled": true,
                    "lastModifiedUtc": "2019-01-01T13:15:30Z",
                    "query": "ProtectionStatus | extend HostCustomEntity = Computer | extend IPCustomEntity = ComputerIP_Hidden",
                    "queryFrequency": "PT1H",
                    "queryPeriod": "P2DT1H30M",
                    "severity": "High",
                    "suppressionDuration": "PT1H",
                    "suppressionEnabled": false,
                    "tactics": [
                      "Persistence",
                      "LateralMovement"
                    ],
                    "triggerOperator": "GreaterThan",
                    "triggerThreshold": 0
                  },
                  "type": "Microsoft.SecurityInsights/alertRules"
                }
              }
            }
          }
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules/{ruleId}/actions": {
      "get": {
        "description": "Gets all actions of alert rule.",
        "operationId": "Actions_ListByAlertRule",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/RuleId"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/ActionsList"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "Actions"
        ],
        "x-ms-examples": {
          "Get all actions of alert rule.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "ruleId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "value": [
                    {
                      "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                      "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5/actions/912bec42-cb66-4c03-ac63-1761b6898c3e",
                      "name": "912bec42-cb66-4c03-ac63-1761b6898c3e",
                      "properties": {
                        "workflowId": "cd3765391efd48549fd7681ded1d48d7"
                      },
                      "type": "Microsoft.SecurityInsights/alertRules/actions"
                    }
                  ]
                }
              }
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules/{ruleId}/actions/{actionId}": {
      "delete": {
        "description": "Delete the action of alert rule.",
        "operationId": "AlertRules_DeleteAction",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/RuleId"
          },
          {
            "$ref": "#/parameters/ActionId"
          }
        ],
        "responses": {
          "200": {
            "description": "OK"
          },
          "204": {
            "description": "No Content"
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "Actions"
        ],
        "x-ms-examples": {
          "Delete an action of alert rule.": {
            "parameters": {
              "actionId": "912bec42-cb66-4c03-ac63-1761b6898c3e",
              "api-version": "2019-01-01-preview",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "ruleId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {},
              "204": {}
            }
          }
        }
      },
      "get": {
        "description": "Gets the action of alert rule.",
        "operationId": "AlertRules_GetAction",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/RuleId"
          },
          {
            "$ref": "#/parameters/ActionId"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/ActionResponse"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "Actions"
        ],
        "x-ms-examples": {
          "Get an action of alert rule.": {
            "parameters": {
              "actionId": "912bec42-cb66-4c03-ac63-1761b6898c3e",
              "api-version": "2019-01-01-preview",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "ruleId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5/actions/912bec42-cb66-4c03-ac63-1761b6898c3e",
                  "name": "912bec42-cb66-4c03-ac63-1761b6898c3e",
                  "properties": {
                    "workflowId": "cd3765391efd48549fd7681ded1d48d7"
                  },
                  "type": "Microsoft.SecurityInsights/alertRules/actions"
                }
              }
            }
          }
        }
      },
      "put": {
        "description": "Creates or updates the action of alert rule.",
        "operationId": "AlertRules_CreateOrUpdateAction",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/RuleId"
          },
          {
            "$ref": "#/parameters/ActionId"
          },
          {
            "$ref": "#/parameters/Action"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/ActionResponse"
            }
          },
          "201": {
            "description": "Created",
            "schema": {
              "$ref": "#/definitions/ActionResponse"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "Actions"
        ],
        "x-ms-examples": {
          "Creates or updates an action of alert rule.": {
            "parameters": {
              "action": {
                "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5/actions/912bec42-cb66-4c03-ac63-1761b6898c3e",
                "name": "912bec42-cb66-4c03-ac63-1761b6898c3e",
                "properties": {
                  "triggerUri": "https://prod-31.northcentralus.logic.azure.com:443/workflows/cd3765391efd48549fd7681ded1d48d7/triggers/manual/paths/invoke?api-version=2016-10-01&sp=%2Ftriggers%2Fmanual%2Frun&sv=1.0&sig=signature"
                },
                "type": "Microsoft.SecurityInsights/alertRules/actions"
              },
              "actionId": "912bec42-cb66-4c03-ac63-1761b6898c3e",
              "api-version": "2019-01-01-preview",
              "operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
              "resourceGroupName": "myRg",
              "ruleId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5/actions/912bec42-cb66-4c03-ac63-1761b6898c3e",
                  "name": "912bec42-cb66-4c03-ac63-1761b6898c3e",
                  "properties": {
                    "workflowId": "cd3765391efd48549fd7681ded1d48d7"
                  },
                  "type": "Microsoft.SecurityInsights/alertRules/actions"
                }
              },
              "201": {
                "body": {
                  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5/actions/912bec42-cb66-4c03-ac63-1761b6898c3e",
                  "name": "912bec42-cb66-4c03-ac63-1761b6898c3e",
                  "properties": {
                    "workflowId": "cd3765391efd48549fd7681ded1d48d7"
                  },
                  "type": "Microsoft.SecurityInsights/alertRules/actions"
                }
              }
            }
          }
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/bookmarks": {
      "get": {
        "description": "Gets all bookmarks.",
        "operationId": "Bookmarks_List",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/BookmarkList"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "Bookmarks"
        ],
        "x-ms-examples": {
          "Get all bookmarks.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "value": [
                    {
                      "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                      "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/bookmarks/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                      "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                      "properties": {
                        "created": "2019-01-01T13:15:30Z",
                        "createdBy": {
                          "email": "john@contoso.com",
                          "name": "john doe",
                          "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70"
                        },
                        "displayName": "My bookmark",
                        "incidentInfo": {
                          "incidentId": "DDA55F97-170B-40B9-B8ED-CBFD05481E7D",
                          "relationName": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0018",
                          "severity": "Low",
                          "title": "New case 1"
                        },
                        "labels": [
                          "Tag1",
                          "Tag2"
                        ],
                        "notes": "Found a suspicious activity",
                        "query": "SecurityEvent | where TimeGenerated > ago(1d) and TimeGenerated < ago(2d)",
                        "queryResult": "Security Event query result",
                        "updated": "2019-01-01T13:15:30Z",
                        "updatedBy": {
                          "email": "john@contoso.com",
                          "name": "john doe",
                          "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70"
                        }
                      },
                      "type": "Microsoft.SecurityInsights/bookmarks"
                    }
                  ]
                }
              }
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/bookmarks/{bookmarkId}": {
      "delete": {
        "description": "Delete the bookmark.",
        "operationId": "Bookmarks_Delete",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/BookmarkId"
          }
        ],
        "responses": {
          "200": {
            "description": "OK"
          },
          "204": {
            "description": "No Content"
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "Bookmarks"
        ],
        "x-ms-examples": {
          "Delete a bookmark.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "bookmarkId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {},
              "204": {}
            }
          }
        }
      },
      "get": {
        "description": "Gets a bookmark.",
        "operationId": "Bookmarks_Get",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/BookmarkId"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/Bookmark"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "Bookmarks"
        ],
        "x-ms-examples": {
          "Get a bookmark.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "bookmarkId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/bookmarks/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                  "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                  "properties": {
                    "created": "2019-01-01T13:15:30Z",
                    "createdBy": {
                      "email": "john@contoso.com",
                      "name": "john doe",
                      "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70"
                    },
                    "displayName": "My bookmark",
                    "incidentInfo": {
                      "incidentId": "DDA55F97-170B-40B9-B8ED-CBFD05481E7D",
                      "relationName": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0018",
                      "severity": "Low",
                      "title": "New case 1"
                    },
                    "labels": [
                      "Tag1",
                      "Tag2"
                    ],
                    "notes": "Found a suspicious activity",
                    "query": "SecurityEvent | where TimeGenerated > ago(1d) and TimeGenerated < ago(2d)",
                    "queryResult": "Security Event query result",
                    "updated": "2019-01-01T13:15:30Z",
                    "updatedBy": {
                      "email": "john@contoso.com",
                      "name": "john doe",
                      "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70"
                    }
                  },
                  "type": "Microsoft.SecurityInsights/bookmarks"
                }
              }
            }
          }
        }
      },
      "put": {
        "description": "Creates or updates the bookmark.",
        "operationId": "Bookmarks_CreateOrUpdate",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/BookmarkId"
          },
          {
            "$ref": "#/parameters/Bookmark"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/Bookmark"
            }
          },
          "201": {
            "description": "Created",
            "schema": {
              "$ref": "#/definitions/Bookmark"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "Bookmarks"
        ],
        "x-ms-examples": {
          "Creates or updates a bookmark.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "bookmark": {
                "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/bookmarks/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                "properties": {
                  "created": "2019-01-01T13:15:30Z",
                  "createdBy": {
                    "email": "john@contoso.com",
                    "name": "john doe",
                    "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70"
                  },
                  "displayName": "My bookmark",
                  "labels": [
                    "Tag1",
                    "Tag2"
                  ],
                  "notes": "Found a suspicious activity",
                  "query": "SecurityEvent | where TimeGenerated > ago(1d) and TimeGenerated < ago(2d)",
                  "queryResult": "Security Event query result",
                  "updated": "2019-01-01T13:15:30Z",
                  "updatedBy": {
                    "email": "john@contoso.com",
                    "name": "john doe",
                    "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70"
                  }
                },
                "type": "Microsoft.SecurityInsights/bookmarks"
              },
              "bookmarkId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
              "operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/bookmarks/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                  "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                  "properties": {
                    "created": "2019-01-01T13:15:30Z",
                    "createdBy": {
                      "email": "john@contoso.com",
                      "name": "john doe",
                      "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70"
                    },
                    "displayName": "My bookmark",
                    "labels": [
                      "Tag1",
                      "Tag2"
                    ],
                    "notes": "Found a suspicious activity",
                    "query": "SecurityEvent | where TimeGenerated > ago(1d) and TimeGenerated < ago(2d)",
                    "queryResult": "Security Event query result",
                    "updated": "2019-01-01T13:15:30Z",
                    "updatedBy": {
                      "email": "john@contoso.com",
                      "name": "john doe",
                      "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70"
                    }
                  },
                  "type": "Microsoft.SecurityInsights/bookmarks"
                }
              },
              "201": {
                "body": {
                  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/bookmarks/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                  "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                  "properties": {
                    "created": "2019-01-01T13:15:30Z",
                    "createdBy": {
                      "email": "john@contoso.com",
                      "name": "john doe",
                      "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70"
                    },
                    "displayName": "My bookmark",
                    "labels": [
                      "Tag1",
                      "Tag2"
                    ],
                    "notes": "Found a suspicious activity",
                    "query": "SecurityEvent | where TimeGenerated > ago(1d) and TimeGenerated < ago(2d)",
                    "queryResult": "Security Event query result",
                    "updated": "2019-01-01T13:15:30Z",
                    "updatedBy": {
                      "email": "john@contoso.com",
                      "name": "john doe",
                      "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70"
                    }
                  },
                  "type": "Microsoft.SecurityInsights/bookmarks"
                }
              }
            }
          }
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/bookmarks/{bookmarkId}/relations": {
      "get": {
        "description": "Gets all bookmark relations.",
        "operationId": "BookmarkRelations_List",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/BookmarkId"
          },
          {
            "$ref": "#/parameters/ODataFilter"
          },
          {
            "$ref": "#/parameters/ODataOrderBy"
          },
          {
            "$ref": "#/parameters/ODataTop"
          },
          {
            "$ref": "#/parameters/ODataSkipToken"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/BookmarkRelationList"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "BookmarkRelations"
        ],
        "x-ms-examples": {
          "Get all bookmark relations.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "bookmarkId": "2216d0e1-91e3-4902-89fd-d2df8c535096",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "value": [
                    {
                      "etag": "190057d0-0000-0d00-0000-5c6f5adb0000",
                      "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/bookmarks/2216d0e1-91e3-4902-89fd-d2df8c535096/relations/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
                      "kind": "CasesToBookmarks",
                      "name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
                      "properties": {
                        "bookmarkId": "2216d0e1-91e3-4902-89fd-d2df8c535096",
                        "caseIdentifier": "afbd324f-6c48-459c-8710-8d1e1cd03812",
                        "caseSeverity": "High",
                        "caseTitle": "Test case",
                        "relationName": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014"
                      },
                      "type": "Microsoft.SecurityInsights/bookmarks/relations"
                    }
                  ]
                }
              }
            }
          }
        },
        "x-ms-odata": "#/definitions/BookmarkRelation",
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/bookmarks/{bookmarkId}/relations/{relationName}": {
      "delete": {
        "description": "Delete the bookmark relation.",
        "operationId": "BookmarkRelations_DeleteRelation",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/BookmarkId"
          },
          {
            "$ref": "#/parameters/RelationName"
          }
        ],
        "responses": {
          "200": {
            "description": "OK"
          },
          "204": {
            "description": "No Content"
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "BookmarkRelations"
        ],
        "x-ms-examples": {
          "Delete the bookmark relation.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "bookmarkId": "2216d0e1-91e3-4902-89fd-d2df8c535096",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "relationName": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {},
              "204": {}
            }
          }
        }
      },
      "get": {
        "description": "Gets a bookmark relation.",
        "operationId": "BookmarkRelations_GetRelation",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/BookmarkId"
          },
          {
            "$ref": "#/parameters/RelationName"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/BookmarkRelation"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "BookmarkRelations"
        ],
        "x-ms-examples": {
          "Get a bookmark relation.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "bookmarkId": "2216d0e1-91e3-4902-89fd-d2df8c535096",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "relationName": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "etag": "190057d0-0000-0d00-0000-5c6f5adb0000",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/bookmarks/2216d0e1-91e3-4902-89fd-d2df8c535096/relations/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
                  "kind": "CasesToBookmarks",
                  "name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
                  "properties": {
                    "bookmarkId": "2216d0e1-91e3-4902-89fd-d2df8c535096",
                    "caseIdentifier": "afbd324f-6c48-459c-8710-8d1e1cd03812",
                    "caseSeverity": "High",
                    "caseTitle": "Test case",
                    "relationName": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014"
                  },
                  "type": "Microsoft.SecurityInsights/bookmarks/relations"
                }
              }
            }
          }
        }
      },
      "put": {
        "description": "Creates the bookmark relation.",
        "operationId": "BookmarkRelations_CreateOrUpdateRelation",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/BookmarkId"
          },
          {
            "$ref": "#/parameters/RelationName"
          },
          {
            "$ref": "#/parameters/RelationInputModel"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/BookmarkRelation"
            }
          },
          "201": {
            "description": "Created",
            "schema": {
              "$ref": "#/definitions/BookmarkRelation"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "BookmarkRelations"
        ],
        "x-ms-examples": {
          "Creates or updates a bookmark relation.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "bookmarkId": "2216d0e1-91e3-4902-89fd-d2df8c535096",
              "operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
              "relationInputModel": {
                "properties": {
                  "sourceRelationNode": {
                    "relationNodeId": "afbd324f-6c48-459c-8710-8d1e1cd03812",
                    "relationNodeKind": "Case"
                  },
                  "targetRelationNode": {
                    "relationNodeId": "2216d0e1-91e3-4902-89fd-d2df8c535096",
                    "relationNodeKind": "Bookmark"
                  }
                }
              },
              "relationName": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "etag": "190057d0-0000-0d00-0000-5c6f5adb0000",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/bookmarks/2216d0e1-91e3-4902-89fd-d2df8c535096/relations/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
                  "kind": "CasesToBookmarks",
                  "name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
                  "properties": {
                    "bookmarkId": "2216d0e1-91e3-4902-89fd-d2df8c535096",
                    "caseIdentifier": "afbd324f-6c48-459c-8710-8d1e1cd03812",
                    "caseSeverity": "High",
                    "caseTitle": "Test case",
                    "relationName": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014"
                  },
                  "type": "Microsoft.SecurityInsights/bookmarks/relations"
                }
              },
              "201": {
                "body": {
                  "etag": "190057d0-0000-0d00-0000-5c6f5adb0000",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/bookmarks/2216d0e1-91e3-4902-89fd-d2df8c535096/relations/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
                  "kind": "CasesToBookmarks",
                  "name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
                  "properties": {
                    "bookmarkId": "2216d0e1-91e3-4902-89fd-d2df8c535096",
                    "caseIdentifier": "afbd324f-6c48-459c-8710-8d1e1cd03812",
                    "caseSeverity": "High",
                    "caseTitle": "Test case",
                    "relationName": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014"
                  },
                  "type": "Microsoft.SecurityInsights/bookmarks/relations"
                }
              }
            }
          }
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/cases": {
      "get": {
        "deprecated": true,
        "description": "Gets all cases.",
        "operationId": "Cases_List",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/ODataFilter"
          },
          {
            "$ref": "#/parameters/ODataOrderBy"
          },
          {
            "$ref": "#/parameters/ODataTop"
          },
          {
            "$ref": "#/parameters/ODataSkipToken"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/CaseList"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "Cases"
        ],
        "x-ms-examples": {
          "Get all cases.": {
            "parameters": {
              "$orderby": "properties/createdTimeUtc desc",
              "$top": 1,
              "api-version": "2019-01-01-preview",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "value": [
                    {
                      "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                      "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/cases/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                      "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                      "properties": {
                        "caseNumber": 3177,
                        "closeReason": "Resolved",
                        "closedReasonText": "case resolved",
                        "createdTimeUtc": "2019-01-01T13:15:30Z",
                        "description": "This is a demo case",
                        "endTimeUtc": "2019-01-01T13:05:30Z",
                        "labels": [
                          "Tag1",
                          "Tag2"
                        ],
                        "lastComment": "This is a demo case",
                        "lastUpdatedTimeUtc": "2019-01-01T13:15:30Z",
                        "owner": {
                          "email": "john@contoso.com",
                          "name": "john doe",
                          "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70"
                        },
                        "relatedAlertIds": [
                          "cf441808-2d50-4c10-81af-cdd0b908c121"
                        ],
                        "severity": "High",
                        "startTimeUtc": "2019-01-01T13:00:30Z",
                        "status": "Closed",
                        "title": "My case",
                        "totalComments": 3
                      },
                      "type": "Microsoft.SecurityInsights/cases"
                    }
                  ]
                }
              }
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/cases/{caseId}": {
      "delete": {
        "deprecated": true,
        "description": "Delete the case.",
        "operationId": "Cases_Delete",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/CaseId"
          }
        ],
        "responses": {
          "200": {
            "description": "OK"
          },
          "204": {
            "description": "No Content"
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "Cases"
        ],
        "x-ms-examples": {
          "Delete a case.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "caseId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {},
              "204": {}
            }
          }
        }
      },
      "get": {
        "deprecated": true,
        "description": "Gets a case.",
        "operationId": "Cases_Get",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/CaseId"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/Case"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "Cases"
        ],
        "x-ms-examples": {
          "Get a case.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "caseId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/cases/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                  "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                  "properties": {
                    "caseNumber": 3177,
                    "closeReason": "Resolved",
                    "closedReasonText": "case resolved",
                    "createdTimeUtc": "2019-01-01T13:15:30Z",
                    "description": "This is a demo case",
                    "endTimeUtc": "2019-01-01T13:05:30Z",
                    "labels": [
                      "Tag1",
                      "Tag2"
                    ],
                    "lastComment": "This is a demo case",
                    "lastUpdatedTimeUtc": "2019-01-01T13:15:30Z",
                    "owner": {
                      "email": "john@contoso.com",
                      "name": "john doe",
                      "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70"
                    },
                    "relatedAlertIds": [
                      "cf441808-2d50-4c10-81af-cdd0b908c121"
                    ],
                    "severity": "High",
                    "startTimeUtc": "2019-01-01T13:00:30Z",
                    "status": "Closed",
                    "title": "My case",
                    "totalComments": 3
                  },
                  "type": "Microsoft.SecurityInsights/cases"
                }
              }
            }
          }
        }
      },
      "put": {
        "deprecated": true,
        "description": "Creates or updates the case.",
        "operationId": "Cases_CreateOrUpdate",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/CaseId"
          },
          {
            "$ref": "#/parameters/Case"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/Case"
            }
          },
          "201": {
            "description": "Created",
            "schema": {
              "$ref": "#/definitions/Case"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "Cases"
        ],
        "x-ms-examples": {
          "Creates or updates a case.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "case": {
                "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                "properties": {
                  "closeReason": "Resolved",
                  "description": "This is a demo case",
                  "endTimeUtc": "2019-01-01T13:05:30Z",
                  "labels": [
                    "Tag1",
                    "Tag2"
                  ],
                  "owner": {
                    "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70"
                  },
                  "severity": "High",
                  "startTimeUtc": "2019-01-01T13:00:30Z",
                  "status": "Closed",
                  "title": "My case"
                }
              },
              "caseId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
              "operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/cases/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                  "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                  "properties": {
                    "caseNumber": 3177,
                    "closeReason": "Resolved",
                    "createdTimeUtc": "2019-01-01T13:15:30Z",
                    "description": "This is a demo case",
                    "endTimeUtc": "2019-01-01T13:05:30Z",
                    "labels": [
                      "Tag1",
                      "Tag2"
                    ],
                    "lastUpdatedTimeUtc": "2019-01-01T13:15:30Z",
                    "owner": {
                      "email": "john@contoso.com",
                      "name": "john doe",
                      "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70"
                    },
                    "relatedAlertIds": [
                      "cf441808-2d50-4c10-81af-cdd0b908c121"
                    ],
                    "severity": "High",
                    "startTimeUtc": "2019-01-01T13:00:30Z",
                    "status": "Closed",
                    "title": "My case"
                  },
                  "type": "Microsoft.SecurityInsights/cases"
                }
              },
              "201": {
                "body": {
                  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/cases/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                  "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                  "properties": {
                    "caseNumber": 3177,
                    "closeReason": "Resolved",
                    "createdTimeUtc": "2019-01-01T13:15:30Z",
                    "description": "This is a demo case",
                    "endTimeUtc": "2019-01-01T13:05:30Z",
                    "labels": [
                      "Tag1",
                      "Tag2"
                    ],
                    "lastUpdatedTimeUtc": "2019-01-01T13:15:30Z",
                    "owner": {
                      "email": "john@contoso.com",
                      "name": "john doe",
                      "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70"
                    },
                    "relatedAlertIds": [
                      "cf441808-2d50-4c10-81af-cdd0b908c121"
                    ],
                    "severity": "High",
                    "startTimeUtc": "2019-01-01T13:00:30Z",
                    "status": "Closed",
                    "title": "My case"
                  },
                  "type": "Microsoft.SecurityInsights/cases"
                }
              }
            }
          }
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/cases/{caseId}/comments": {
      "get": {
        "deprecated": true,
        "description": "Gets all case comments.",
        "operationId": "Comments_ListByCase",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/CaseId"
          },
          {
            "$ref": "#/parameters/ODataFilter"
          },
          {
            "$ref": "#/parameters/ODataOrderBy"
          },
          {
            "$ref": "#/parameters/ODataTop"
          },
          {
            "$ref": "#/parameters/ODataSkipToken"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/CaseCommentList"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "CaseComments"
        ],
        "x-ms-examples": {
          "Get all case comments.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "caseId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "value": [
                    {
                      "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/cases/73e01a99-5cd7-4139-a149-9f2736ff2ab5/comments/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
                      "name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
                      "properties": {
                        "createdTimeUtc": "2019-01-01T13:15:30Z",
                        "message": "Some message",
                        "userInfo": {
                          "email": "john@contoso.com",
                          "name": "john doe",
                          "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70"
                        }
                      },
                      "type": "Microsoft.SecurityInsights/cases/comments"
                    }
                  ]
                }
              }
            }
          }
        },
        "x-ms-odata": "#/definitions/CaseComment",
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/cases/{caseId}/comments/{caseCommentId}": {
      "get": {
        "deprecated": true,
        "description": "Gets a case comment.",
        "operationId": "Cases_GetComment",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/CaseId"
          },
          {
            "$ref": "#/parameters/CaseCommentId"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/CaseComment"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "CaseComments"
        ],
        "x-ms-examples": {
          "Get a case comment.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "caseCommentId": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
              "caseId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/cases/73e01a99-5cd7-4139-a149-9f2736ff2ab5/comments/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
                  "name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
                  "properties": {
                    "createdTimeUtc": "2019-01-01T13:15:30Z",
                    "message": "Some message",
                    "userInfo": {
                      "email": "john@contoso.com",
                      "name": "john doe",
                      "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70"
                    }
                  },
                  "type": "Microsoft.SecurityInsights/cases/comments"
                }
              }
            }
          }
        }
      },
      "put": {
        "deprecated": true,
        "description": "Creates the case comment.",
        "operationId": "CaseComments_CreateComment",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/CaseId"
          },
          {
            "$ref": "#/parameters/CaseCommentId"
          },
          {
            "$ref": "#/parameters/CaseComment"
          }
        ],
        "responses": {
          "201": {
            "description": "Created",
            "schema": {
              "$ref": "#/definitions/CaseComment"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "CaseComments"
        ],
        "x-ms-examples": {
          "Creates or updates a case comment.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "caseComment": {
                "properties": {
                  "message": "Some message"
                }
              },
              "caseCommentId": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
              "caseId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
              "operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "201": {
                "body": {
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/cases/73e01a99-5cd7-4139-a149-9f2736ff2ab5/comments/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
                  "name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
                  "properties": {
                    "createdTimeUtc": "2019-01-01T13:15:30Z",
                    "message": "Some message",
                    "userInfo": {
                      "email": "john@contoso.com",
                      "name": "john doe",
                      "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70"
                    }
                  },
                  "type": "Microsoft.SecurityInsights/cases/comments"
                }
              }
            }
          }
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/cases/{caseId}/relations": {
      "get": {
        "deprecated": true,
        "description": "Gets all case relations.",
        "operationId": "CaseRelations_List",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/CaseId"
          },
          {
            "$ref": "#/parameters/ODataFilter"
          },
          {
            "$ref": "#/parameters/ODataOrderBy"
          },
          {
            "$ref": "#/parameters/ODataTop"
          },
          {
            "$ref": "#/parameters/ODataSkipToken"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/CaseRelationList"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "CaseRelations"
        ],
        "x-ms-examples": {
          "Get all case relations.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "caseId": "afbd324f-6c48-459c-8710-8d1e1cd03812",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "value": [
                    {
                      "etag": "190057d0-0000-0d00-0000-5c6f5adb0000",
                      "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/cases/afbd324f-6c48-459c-8710-8d1e1cd03812/relations/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
                      "kind": "CasesToBookmarks",
                      "name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
                      "properties": {
                        "bookmarkId": "2216d0e1-91e3-4902-89fd-d2df8c535096",
                        "bookmarkName": "Test bookmark",
                        "caseIdentifier": "afbd324f-6c48-459c-8710-8d1e1cd03812",
                        "relationName": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014"
                      },
                      "type": "Microsoft.SecurityInsights/cases/relations"
                    }
                  ]
                }
              }
            }
          }
        },
        "x-ms-odata": "#/definitions/CaseRelation",
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/cases/{caseId}/relations/{relationName}": {
      "delete": {
        "deprecated": true,
        "description": "Delete the case relation.",
        "operationId": "CaseRelations_DeleteRelation",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/CaseId"
          },
          {
            "$ref": "#/parameters/RelationName"
          }
        ],
        "responses": {
          "200": {
            "description": "OK"
          },
          "204": {
            "description": "No Content"
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "CaseRelations"
        ],
        "x-ms-examples": {
          "Delete the case relation.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "caseId": "afbd324f-6c48-459c-8710-8d1e1cd03812",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "relationName": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {},
              "204": {}
            }
          }
        }
      },
      "get": {
        "deprecated": true,
        "description": "Gets a case relation.",
        "operationId": "CaseRelations_GetRelation",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/CaseId"
          },
          {
            "$ref": "#/parameters/RelationName"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/CaseRelation"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "CaseRelations"
        ],
        "x-ms-examples": {
          "Get a case relation.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "caseId": "afbd324f-6c48-459c-8710-8d1e1cd03812",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "relationName": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "etag": "190057d0-0000-0d00-0000-5c6f5adb0000",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/cases/afbd324f-6c48-459c-8710-8d1e1cd03812/relations/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
                  "kind": "CasesToBookmarks",
                  "name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
                  "properties": {
                    "bookmarkId": "2216d0e1-91e3-4902-89fd-d2df8c535096",
                    "bookmarkName": "Test bookmark",
                    "caseIdentifier": "afbd324f-6c48-459c-8710-8d1e1cd03812",
                    "relationName": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014"
                  },
                  "type": "Microsoft.SecurityInsights/cases/relations"
                }
              }
            }
          }
        }
      },
      "put": {
        "deprecated": true,
        "description": "Creates or updates the case relation.",
        "operationId": "CaseRelations_CreateOrUpdateRelation",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/CaseId"
          },
          {
            "$ref": "#/parameters/RelationName"
          },
          {
            "$ref": "#/parameters/RelationInputModel"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/CaseRelation"
            }
          },
          "201": {
            "description": "Created",
            "schema": {
              "$ref": "#/definitions/CaseRelation"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "CaseRelations"
        ],
        "x-ms-examples": {
          "Creates or updates a case relation.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "caseId": "afbd324f-6c48-459c-8710-8d1e1cd03812",
              "operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
              "relationInputModel": {
                "properties": {
                  "sourceRelationNode": {
                    "relationNodeId": "afbd324f-6c48-459c-8710-8d1e1cd03812",
                    "relationNodeKind": "Case"
                  },
                  "targetRelationNode": {
                    "relationNodeId": "2216d0e1-91e3-4902-89fd-d2df8c535096",
                    "relationNodeKind": "Bookmark"
                  }
                }
              },
              "relationName": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "etag": "190057d0-0000-0d00-0000-5c6f5adb0000",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/cases/afbd324f-6c48-459c-8710-8d1e1cd03812/relations/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
                  "kind": "CasesToBookmarks",
                  "name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
                  "properties": {
                    "bookmarkId": "2216d0e1-91e3-4902-89fd-d2df8c535096",
                    "bookmarkName": "Test bookmark",
                    "caseIdentifier": "afbd324f-6c48-459c-8710-8d1e1cd03812",
                    "relationName": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014"
                  },
                  "type": "Microsoft.SecurityInsights/cases/relations"
                }
              },
              "201": {
                "body": {
                  "etag": "190057d0-0000-0d00-0000-5c6f5adb0000",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/cases/afbd324f-6c48-459c-8710-8d1e1cd03812/relations/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
                  "kind": "CasesToBookmarks",
                  "name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014",
                  "properties": {
                    "bookmarkId": "2216d0e1-91e3-4902-89fd-d2df8c535096",
                    "bookmarkName": "Test bookmark",
                    "caseIdentifier": "afbd324f-6c48-459c-8710-8d1e1cd03812",
                    "relationName": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014"
                  },
                  "type": "Microsoft.SecurityInsights/cases/relations"
                }
              }
            }
          }
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors": {
      "get": {
        "description": "Gets all data connectors.",
        "operationId": "DataConnectors_List",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/DataConnectorList"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "Data Connectors"
        ],
        "x-ms-examples": {
          "Get all data connectors.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "value": [
                    {
                      "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                      "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/763f9fa1-c2d3-4fa2-93e9-bccd4899aa12",
                      "kind": "AzureSecurityCenter",
                      "name": "763f9fa1-c2d3-4fa2-93e9-bccd4899aa12",
                      "properties": {
                        "dataTypes": {
                          "alerts": {
                            "state": "Enabled"
                          }
                        },
                        "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0"
                      },
                      "type": "Microsoft.SecurityInsights/dataConnectors"
                    },
                    {
                      "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                      "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/c345bf40-8509-4ed2-b947-50cb773aaf04",
                      "kind": "ThreatIntelligence",
                      "name": "c345bf40-8509-4ed2-b947-50cb773aaf04",
                      "properties": {
                        "dataTypes": {
                          "indicators": {
                            "state": "Enabled"
                          }
                        },
                        "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8"
                      },
                      "type": "Microsoft.SecurityInsights/dataConnectors"
                    },
                    {
                      "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                      "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/f0cd27d2-5f03-4c06-ba31-d2dc82dcb51d",
                      "kind": "AzureActiveDirectory",
                      "name": "f0cd27d2-5f03-4c06-ba31-d2dc82dcb51d",
                      "properties": {
                        "dataTypes": {
                          "alerts": {
                            "state": "Enabled"
                          }
                        },
                        "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8"
                      },
                      "type": "Microsoft.SecurityInsights/dataConnectors"
                    },
                    {
                      "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                      "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                      "kind": "Office365",
                      "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                      "properties": {
                        "dataTypes": {
                          "exchange": {
                            "state": "Enabled"
                          },
                          "sharePoint": {
                            "state": "Enabled"
                          }
                        },
                        "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8"
                      },
                      "type": "Microsoft.SecurityInsights/dataConnectors"
                    },
                    {
                      "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                      "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/b96d014d-b5c2-4a01-9aba-a8058f629d42",
                      "kind": "MicrosoftCloudAppSecurity",
                      "name": "b96d014d-b5c2-4a01-9aba-a8058f629d42",
                      "properties": {
                        "dataTypes": {
                          "alerts": {
                            "state": "Enabled"
                          },
                          "discoveryLogs": {
                            "state": "Enabled"
                          }
                        },
                        "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8"
                      },
                      "type": "Microsoft.SecurityInsights/dataConnectors"
                    },
                    {
                      "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                      "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/07e42cb3-e658-4e90-801c-efa0f29d3d44",
                      "kind": "AzureAdvancedThreatProtection",
                      "name": "07e42cb3-e658-4e90-801c-efa0f29d3d44",
                      "properties": {
                        "dataTypes": {
                          "alerts": {
                            "state": "Enabled"
                          }
                        },
                        "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8"
                      },
                      "type": "Microsoft.SecurityInsights/dataConnectors"
                    },
                    {
                      "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                      "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/c345bf40-8509-4ed2-b947-50cb773aaf04",
                      "kind": "AmazonWebServicesCloudTrail",
                      "name": "c345bf40-8509-4ed2-b947-50cb773aaf04",
                      "properties": {
                        "awsRoleArn": "myAwsRoleArn",
                        "dataTypes": {
                          "logs": {
                            "state": "Enabled"
                          }
                        }
                      },
                      "type": "Microsoft.SecurityInsights/dataConnectors"
                    },
                    {
                      "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                      "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/06b3ccb8-1384-4bcc-aec7-852f6d57161b",
                      "kind": "MicrosoftDefenderAdvancedThreatProtection",
                      "name": "06b3ccb8-1384-4bcc-aec7-852f6d57161b",
                      "properties": {
                        "dataTypes": {
                          "alerts": {
                            "state": "Enabled"
                          }
                        },
                        "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8"
                      },
                      "type": "Microsoft.SecurityInsights/dataConnectors"
                    }
                  ]
                }
              }
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors/{dataConnectorId}": {
      "delete": {
        "description": "Delete the data connector.",
        "operationId": "DataConnectors_Delete",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/DataConnectorId"
          }
        ],
        "responses": {
          "200": {
            "description": "OK"
          },
          "204": {
            "description": "No Content"
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "Data Connectors"
        ],
        "x-ms-examples": {
          "Delete an Office365 data connector.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "dataConnectorId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {},
              "204": {}
            }
          }
        }
      },
      "get": {
        "description": "Gets a data connector.",
        "operationId": "DataConnectors_Get",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/DataConnectorId"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/DataConnector"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "Data Connectors"
        ],
        "x-ms-examples": {
          "Get a ASC data connector.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "dataConnectorId": "763f9fa1-c2d3-4fa2-93e9-bccd4899aa12",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/763f9fa1-c2d3-4fa2-93e9-bccd4899aa12",
                  "kind": "AzureSecurityCenter",
                  "name": "763f9fa1-c2d3-4fa2-93e9-bccd4899aa12",
                  "properties": {
                    "dataTypes": {
                      "alerts": {
                        "state": "Enabled"
                      }
                    },
                    "subscriptionId": "c0688291-89d7-4bed-87a2-a7b1bff43f4c"
                  },
                  "type": "Microsoft.SecurityInsights/dataConnectors"
                }
              }
            }
          },
          "Get a MCAS data connector.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "dataConnectorId": "b96d014d-b5c2-4a01-9aba-a8058f629d42",
              "operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/b96d014d-b5c2-4a01-9aba-a8058f629d42",
                  "kind": "MicrosoftCloudAppSecurity",
                  "name": "b96d014d-b5c2-4a01-9aba-a8058f629d42",
                  "properties": {
                    "dataTypes": {
                      "alerts": {
                        "state": "Enabled"
                      },
                      "discoveryLogs": {
                        "state": "Enabled"
                      }
                    },
                    "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8"
                  },
                  "type": "Microsoft.SecurityInsights/dataConnectors"
                }
              }
            }
          },
          "Get a MDATP data connector": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "dataConnectorId": "06b3ccb8-1384-4bcc-aec7-852f6d57161b",
              "operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/06b3ccb8-1384-4bcc-aec7-852f6d57161b",
                  "kind": "MicrosoftDefenderAdvancedThreatProtection",
                  "name": "06b3ccb8-1384-4bcc-aec7-852f6d57161b",
                  "properties": {
                    "dataTypes": {
                      "alerts": {
                        "state": "Enabled"
                      }
                    },
                    "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8"
                  },
                  "type": "Microsoft.SecurityInsights/dataConnectors"
                }
              }
            }
          },
          "Get a TI data connector.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "dataConnectorId": "c345bf40-8509-4ed2-b947-50cb773aaf04",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/c345bf40-8509-4ed2-b947-50cb773aaf04",
                  "kind": "ThreatIntelligence",
                  "name": "c345bf40-8509-4ed2-b947-50cb773aaf04",
                  "properties": {
                    "dataTypes": {
                      "indicators": {
                        "state": "Enabled"
                      }
                    },
                    "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8"
                  },
                  "type": "Microsoft.SecurityInsights/dataConnectors"
                }
              }
            }
          },
          "Get an AAD data connector.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "dataConnectorId": "f0cd27d2-5f03-4c06-ba31-d2dc82dcb51d",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/f0cd27d2-5f03-4c06-ba31-d2dc82dcb51d",
                  "kind": "AzureActiveDirectory",
                  "name": "f0cd27d2-5f03-4c06-ba31-d2dc82dcb51d",
                  "properties": {
                    "dataTypes": {
                      "alerts": {
                        "state": "Enabled"
                      }
                    },
                    "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8"
                  },
                  "type": "Microsoft.SecurityInsights/dataConnectors"
                }
              }
            }
          },
          "Get an AATP data connector.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "dataConnectorId": "07e42cb3-e658-4e90-801c-efa0f29d3d44",
              "operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/07e42cb3-e658-4e90-801c-efa0f29d3d44",
                  "kind": "AzureAdvancedThreatProtection",
                  "name": "07e42cb3-e658-4e90-801c-efa0f29d3d44",
                  "properties": {
                    "dataTypes": {
                      "alerts": {
                        "state": "Enabled"
                      }
                    },
                    "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8"
                  },
                  "type": "Microsoft.SecurityInsights/dataConnectors"
                }
              }
            }
          },
          "Get an AwsCloudTrail data connector.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "dataConnectorId": "c345bf40-8509-4ed2-b947-50cb773aaf04",
              "operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/c345bf40-8509-4ed2-b947-50cb773aaf04",
                  "kind": "AmazonWebServicesCloudTrail",
                  "name": "c345bf40-8509-4ed2-b947-50cb773aaf04",
                  "properties": {
                    "awsRoleArn": "myAwsRoleArn",
                    "dataTypes": {
                      "logs": {
                        "state": "Enabled"
                      }
                    }
                  },
                  "type": "Microsoft.SecurityInsights/dataConnectors"
                }
              }
            }
          },
          "Get an Office365 data connector.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "dataConnectorId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                  "kind": "Office365",
                  "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                  "properties": {
                    "dataTypes": {
                      "exchange": {
                        "state": "Enabled"
                      },
                      "sharePoint": {
                        "state": "Enabled"
                      }
                    },
                    "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8"
                  },
                  "type": "Microsoft.SecurityInsights/dataConnectors"
                }
              }
            }
          }
        }
      },
      "put": {
        "description": "Creates or updates the data connector.",
        "operationId": "DataConnectors_CreateOrUpdate",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/DataConnectorId"
          },
          {
            "$ref": "#/parameters/DataConnector"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/DataConnector"
            }
          },
          "201": {
            "description": "Created",
            "schema": {
              "$ref": "#/definitions/DataConnector"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "Data Connectors"
        ],
        "x-ms-examples": {
          "Creates or updates an Office365 data connector.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "dataConnector": {
                "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                "kind": "Office365",
                "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                "properties": {
                  "dataTypes": {
                    "exchange": {
                      "state": "Enabled"
                    },
                    "sharePoint": {
                      "state": "Enabled"
                    }
                  },
                  "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8"
                },
                "type": "Microsoft.SecurityInsights/dataConnectors"
              },
              "dataConnectorId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
              "operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                  "kind": "Office365",
                  "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                  "properties": {
                    "dataTypes": {
                      "exchange": {
                        "state": "Enabled"
                      },
                      "sharePoint": {
                        "state": "Enabled"
                      }
                    },
                    "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8"
                  },
                  "type": "Microsoft.SecurityInsights/dataConnectors"
                }
              },
              "201": {
                "body": {
                  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                  "kind": "Office365",
                  "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
                  "properties": {
                    "dataTypes": {
                      "exchange": {
                        "state": "Enabled"
                      },
                      "sharePoint": {
                        "state": "Enabled"
                      }
                    },
                    "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8"
                  },
                  "type": "Microsoft.SecurityInsights/dataConnectors"
                }
              }
            }
          }
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/entities": {
      "get": {
        "description": "Gets all entities.",
        "operationId": "Entities_List",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/EntityList"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "Entities"
        ],
        "x-ms-examples": {
          "Get all entities.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "value": [
                    {
                      "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/e1d3d618-e11f-478b-98e3-bb381539a8e1",
                      "kind": "Account",
                      "name": "e1d3d618-e11f-478b-98e3-bb381539a8e1",
                      "properties": {
                        "aadTenantId": "70fbdad0-7441-4564-b2b5-2b8862d0fee0",
                        "aadUserId": "f7033626-2572-46b1-bba0-06646f4f95b3",
                        "accountName": "administrator",
                        "friendlyName": "administrator",
                        "isDomainJoined": true,
                        "ntDomain": "domain",
                        "objectGuid": "11227b78-3c6e-436e-a2a2-02fc7662eca0",
                        "puid": "ee3cb2d8-14ba-45ef-8009-d6f1cacfa04d",
                        "sid": "S-1-5-18",
                        "upnSuffix": "contoso"
                      },
                      "type": "Microsoft.SecurityInsights/entities"
                    },
                    {
                      "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/fed9fe89-dce8-40f2-bf44-70f23fe93b3c",
                      "kind": "Host",
                      "name": "fed9fe89-dce8-40f2-bf44-70f23fe93b3c",
                      "properties": {
                        "azureID": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.Compute/virtualMachines/vm1",
                        "dnsDomain": "contoso",
                        "friendlyName": "vm1",
                        "hostName": "vm1",
                        "isDomainJoined": true,
                        "netBiosName": "contoso",
                        "ntDomain": "domain",
                        "omsAgentID": "70fbdad0-7441-4564-b2b5-2b8862d0fee0",
                        "osFamily": "Windows",
                        "osVersion": "1.0"
                      },
                      "type": "Microsoft.SecurityInsights/entities"
                    },
                    {
                      "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/af378b21-b4aa-4fe7-bc70-13f8621a322f",
                      "kind": "File",
                      "name": "af378b21-b4aa-4fe7-bc70-13f8621a322f",
                      "properties": {
                        "directory": "C:\\Windows\\System32",
                        "fileName": "cmd.exe",
                        "friendlyName": "cmd.exe"
                      },
                      "type": "Microsoft.SecurityInsights/entities"
                    }
                  ]
                }
              }
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/entities/{entityId}": {
      "get": {
        "description": "Gets an entity.",
        "operationId": "Entities_Get",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/EntityId"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/Entity"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "Entities"
        ],
        "x-ms-examples": {
          "Get a cloud application entity.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "entityId": "e1d3d618-e11f-478b-98e3-bb381539a8e1",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/e1d3d618-e11f-478b-98e3-bb381539a8e1",
                  "kind": "CloudApplication",
                  "name": "e1d3d618-e11f-478b-98e3-bb381539a8e1",
                  "properties": {
                    "appId": 1,
                    "appName": "AppName",
                    "friendlyName": "AppName",
                    "instanceName": "InstanceName"
                  },
                  "type": "Microsoft.SecurityInsights/entities"
                }
              }
            }
          },
          "Get a dns entity.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "entityId": "f4e74920-f2c0-4412-a45f-66d94fdf01f8",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/f4e74920-f2c0-4412-a45f-66d94fdf01f8",
                  "kind": "DnsResolution",
                  "name": "f4e74920-f2c0-4412-a45f-66d94fdf01f8",
                  "properties": {
                    "domainName": "domain",
                    "friendlyName": "domain",
                    "ipAddressEntityIds": [
                      "475d3120-33e0-4841-9f1c-a8f15a801d19"
                    ]
                  },
                  "type": "Microsoft.SecurityInsights/entities"
                }
              }
            }
          },
          "Get a file entity.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "entityId": "af378b21-b4aa-4fe7-bc70-13f8621a322f",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/af378b21-b4aa-4fe7-bc70-13f8621a322f",
                  "kind": "File",
                  "name": "af378b21-b4aa-4fe7-bc70-13f8621a322f",
                  "properties": {
                    "directory": "C:\\Windows\\System32",
                    "fileName": "cmd.exe",
                    "friendlyName": "cmd.exe"
                  },
                  "type": "Microsoft.SecurityInsights/entities"
                }
              }
            }
          },
          "Get a file hash entity.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "entityId": "ea359fa6-c1e5-f878-e105-6344f3e399a1",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/ea359fa6-c1e5-f878-e105-6344f3e399a1",
                  "kind": "FileHash",
                  "name": "ea359fa6-c1e5-f878-e105-6344f3e399a1",
                  "properties": {
                    "algorithm": "SHA256",
                    "friendlyName": "E923636F1093C414AAB39F846E9D7A372BEEFA7B628B28179197E539C56AA0F0(SHA256)",
                    "hashValue": "E923636F1093C414AAB39F846E9D7A372BEEFA7B628B28179197E539C56AA0F0"
                  },
                  "type": "Microsoft.SecurityInsights/entities"
                }
              }
            }
          },
          "Get a host entity.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "entityId": "e1d3d618-e11f-478b-98e3-bb381539a8e1",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/e1d3d618-e11f-478b-98e3-bb381539a8e1",
                  "kind": "Host",
                  "name": "e1d3d618-e11f-478b-98e3-bb381539a8e1",
                  "properties": {
                    "azureID": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.Compute/virtualMachines/vm1",
                    "dnsDomain": "contoso",
                    "friendlyName": "vm1",
                    "hostName": "vm1",
                    "isDomainJoined": true,
                    "netBiosName": "contoso",
                    "ntDomain": "domain",
                    "omsAgentID": "70fbdad0-7441-4564-b2b5-2b8862d0fee0",
                    "osFamily": "Windows",
                    "osVersion": "1.0"
                  },
                  "type": "Microsoft.SecurityInsights/entities"
                }
              }
            }
          },
          "Get a malware entity.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "entityId": "af378b21-b4aa-4fe7-bc70-13f8621a322f",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/af378b21-b4aa-4fe7-bc70-13f8621a322f",
                  "kind": "Malware",
                  "name": "af378b21-b4aa-4fe7-bc70-13f8621a322f",
                  "properties": {
                    "category": "Trojan",
                    "friendlyName": "Win32/Toga!rfn",
                    "malwareName": "Win32/Toga!rfn"
                  },
                  "type": "Microsoft.SecurityInsights/entities"
                }
              }
            }
          },
          "Get a process entity.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "entityId": "7264685c-038c-42c6-948c-38e14ef1fb98",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/7264685c-038c-42c6-948c-38e14ef1fb98",
                  "kind": "Process",
                  "name": "7264685c-038c-42c6-948c-38e14ef1fb98",
                  "properties": {
                    "commandLine": "\"cmd\"",
                    "friendlyName": "cmd.exe",
                    "imageFileEntityId": "bba7b47b-c1c1-4021-b568-5b07b9292f5e",
                    "processId": "0x2aa48"
                  },
                  "type": "Microsoft.SecurityInsights/entities"
                }
              }
            }
          },
          "Get a registry key entity.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "entityId": "e1d3d618-e11f-478b-98e3-bb381539a8e1",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/e1d3d618-e11f-478b-98e3-bb381539a8e1",
                  "kind": "RegistryKey",
                  "name": "e1d3d618-e11f-478b-98e3-bb381539a8e1",
                  "properties": {
                    "friendlyName": "SOFTWARE",
                    "hive": "HKEY_LOCAL_MACHINE",
                    "key": "SOFTWARE"
                  },
                  "type": "Microsoft.SecurityInsights/entities"
                }
              }
            }
          },
          "Get a registry value entity.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "entityId": "dc44bd11-b348-4d76-ad29-37bf7aa41356",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/dc44bd11-b348-4d76-ad29-37bf7aa41356",
                  "kind": "RegistryValue",
                  "name": "dc44bd11-b348-4d76-ad29-37bf7aa41356",
                  "properties": {
                    "friendlyName": "Data",
                    "keyEntityId": "e1d3d618-e11f-478b-98e3-bb381539a8e1",
                    "valueData": "Data",
                    "valueName": "Name",
                    "valueType": "String"
                  },
                  "type": "Microsoft.SecurityInsights/entities"
                }
              }
            }
          },
          "Get a security alert entity.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "entityId": "4aa486e0-6f85-41af-99ea-7acdce7be6c8",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/4aa486e0-6f85-41af-99ea-7acdce7be6c8",
                  "kind": "SecurityAlert",
                  "name": "e1d3d618-e11f-478b-98e3-bb381539a8e1",
                  "properties": {
                    "additionalData": {
                      "Query": "Heartbeat \n| extend AccountCustomEntity = \"administrator\"",
                      "Query Period": "05:00:00",
                      "Search Query Results Overall Count": "203",
                      "Total Account Entities": "1",
                      "Trigger Operator": "GreaterThan",
                      "Trigger Threshold": "200"
                    },
                    "alertDisplayName": "Suspicious account detected",
                    "alertType": "c8c99641-985d-4e4e-8e91-fb3466cd0e5b_46c7b6c0-ff43-44dd-8b4d-ceffff7aa7df",
                    "confidenceLevel": "Unknown",
                    "description": "",
                    "endTimeUtc": "2019-07-06T13:21:45.926185Z",
                    "friendlyName": "Suspicious account detected",
                    "intent": "Unknown",
                    "processingEndTime": "2019-07-06T13:56:53.5392366Z",
                    "productComponentName": "Scheduled Alerts",
                    "productName": "Azure Sentinel",
                    "severity": "Medium",
                    "startTimeUtc": "2019-07-06T08:21:45.926185Z",
                    "status": "New",
                    "systemAlertId": "4aa486e0-6f85-41af-99ea-7acdce7be6c8",
                    "timeGenerated": "2019-07-06T13:56:53.5392366Z",
                    "vendorName": "Microsoft"
                  },
                  "type": "Microsoft.SecurityInsights/entities"
                }
              }
            }
          },
          "Get a security group entity.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "entityId": "e1d3d618-e11f-478b-98e3-bb381539a8e1",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/e1d3d618-e11f-478b-98e3-bb381539a8e1",
                  "kind": "SecurityGroup",
                  "name": "e1d3d618-e11f-478b-98e3-bb381539a8e1",
                  "properties": {
                    "distinguishedName": "Name",
                    "friendlyName": "Name",
                    "objectGuid": "fb1b8e04-d944-4986-b39a-1ce9adedcd98",
                    "sid": "Sid"
                  },
                  "type": "Microsoft.SecurityInsights/entities"
                }
              }
            }
          },
          "Get a url entity.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "entityId": "e1d3d618-e11f-478b-98e3-bb381539a8e1",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/e1d3d618-e11f-478b-98e3-bb381539a8e1",
                  "kind": "Url",
                  "name": "e1d3d618-e11f-478b-98e3-bb381539a8e1",
                  "properties": {
                    "friendlyName": "https://bing.com",
                    "url": "https://bing.com"
                  },
                  "type": "Microsoft.SecurityInsights/entities"
                }
              }
            }
          },
          "Get an IoT device entity.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "entityId": "e1d3d618-e11f-478b-98e3-bb381539a8e1",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/e1d3d618-e11f-478b-98e3-bb381539a8e1",
                  "kind": "IoTDevice",
                  "name": "e1d3d618-e11f-478b-98e3-bb381539a8e1",
                  "properties": {
                    "deviceId": "device1",
                    "friendlyName": "device1",
                    "iotHubEntityId": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/8b2d9401-f953-e89d-2583-be9b4975870c"
                  },
                  "type": "Microsoft.SecurityInsights/entities"
                }
              }
            }
          },
          "Get an account entity.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "entityId": "e1d3d618-e11f-478b-98e3-bb381539a8e1",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/e1d3d618-e11f-478b-98e3-bb381539a8e1",
                  "kind": "Account",
                  "name": "e1d3d618-e11f-478b-98e3-bb381539a8e1",
                  "properties": {
                    "aadTenantId": "70fbdad0-7441-4564-b2b5-2b8862d0fee0",
                    "aadUserId": "f7033626-2572-46b1-bba0-06646f4f95b3",
                    "accountName": "administrator",
                    "friendlyName": "administrator",
                    "isDomainJoined": true,
                    "ntDomain": "domain",
                    "objectGuid": "11227b78-3c6e-436e-a2a2-02fc7662eca0",
                    "puid": "ee3cb2d8-14ba-45ef-8009-d6f1cacfa04d",
                    "sid": "S-1-5-18",
                    "upnSuffix": "contoso"
                  },
                  "type": "Microsoft.SecurityInsights/entities"
                }
              }
            }
          },
          "Get an azure resource entity.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "entityId": "e1d3d618-e11f-478b-98e3-bb381539a8e1",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/e1d3d618-e11f-478b-98e3-bb381539a8e1",
                  "kind": "AzureResource",
                  "name": "e1d3d618-e11f-478b-98e3-bb381539a8e1",
                  "properties": {
                    "friendlyName": "vm1",
                    "resourceId": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.Compute/virtualMachines/vm1"
                  },
                  "type": "Microsoft.SecurityInsights/entities"
                }
              }
            }
          },
          "Get an ip entity.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "entityId": "e1d3d618-e11f-478b-98e3-bb381539a8e1",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/e1d3d618-e11f-478b-98e3-bb381539a8e1",
                  "kind": "Ip",
                  "name": "e1d3d618-e11f-478b-98e3-bb381539a8e1",
                  "properties": {
                    "address": "10.3.2.8",
                    "friendlyName": "10.3.2.8"
                  },
                  "type": "Microsoft.SecurityInsights/entities"
                }
              }
            }
          }
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/entities/{entityId}/expand": {
      "post": {
        "description": "Expands an entity.",
        "operationId": "Entities_Expand",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/EntityId"
          },
          {
            "$ref": "#/parameters/EntityExpandRequestBody"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/EntityExpandResponse"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "Entities"
        ],
        "x-ms-examples": {
          "Expand an entity": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "entityId": "e1d3d618-e11f-478b-98e3-bb381539a8e1",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "parameters": {
                "endTime": "2019-05-26T00:00:00.000Z",
                "expansionId": "a77992f3-25e9-4d01-99a4-5ff606cc410a",
                "startTime": "2019-04-25T00:00:00.000Z"
              },
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "metaData": {
                    "aggregations": [
                      {
                        "count": 1,
                        "entityKind": "Account"
                      }
                    ]
                  },
                  "value": {
                    "entities": [
                      {
                        "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entities/e1d3d618-e11f-478b-98e3-bb381539a8e1",
                        "kind": "Account",
                        "name": "e1d3d618-e11f-478b-98e3-bb381539a8e1",
                        "properties": {
                          "accountName": "administrator",
                          "friendlyName": "administrator",
                          "ntDomain": "domain"
                        },
                        "type": "Microsoft.SecurityInsights/entities"
                      }
                    ]
                  }
                }
              }
            }
          }
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/entityQueries": {
      "get": {
        "description": "Gets all entity queries.",
        "operationId": "EntityQueries_List",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/EntityQueryList"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "EntityQueries"
        ],
        "x-ms-examples": {
          "Get all entity queries.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "value": [
                    {
                      "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entityQueries/37ca3555-c135-4a73-a65e-9c1d00323f5d",
                      "name": "37ca3555-c135-4a73-a65e-9c1d00323f5d",
                      "properties": {
                        "dataSources": [
                          "AzureActivity"
                        ],
                        "displayName": "Least active accounts on Azure from this IP",
                        "inputEntityType": "IP",
                        "inputFields": [
                          "address"
                        ],
                        "outputEntityTypes": [
                          "Account"
                        ],
                        "queryTemplate": "let AccountActivity_byIP = (v_IP_Address:string){\r\n                            AzureActivity\r\n                            | where Caller != '' and CallerIpAddress == v_IP_Address\r\n                            | summarize Account_Aux_StartTime = min(TimeGenerated), Account_Aux_EndTime = max(TimeGenerated), Count = count() by Caller, TenantId\r\n                            | top 10 by Count asc nulls last \r\n                            | extend UPN = iff(Caller contains '@', Caller, ''), Account_AadUserId = iff(Caller !contains '@', Caller,'')\r\n                            | extend Account_Name = split(UPN,'@')[0] , Account_UPNSuffix = split(UPN,'@')[1]\r\n                            | project Account_Name, Account_UPNSuffix, Account_AadUserId, Account_AadTenantId=TenantId, Account_Aux_StartTime , Account_Aux_EndTime};\r\n                            AccountActivity_byIP('<address>')"
                      },
                      "type": "Microsoft.SecurityInsights/entityQueries"
                    },
                    {
                      "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entityQueries/97a1d515-abf2-4231-9a35-985f9de0bb91",
                      "name": "97a1d515-abf2-4231-9a35-985f9de0bb91",
                      "properties": {
                        "dataSources": [
                          "AzureActivity"
                        ],
                        "displayName": "Most active accounts on Azure from this IP",
                        "inputEntityType": "IP",
                        "inputFields": [
                          "address"
                        ],
                        "outputEntityTypes": [
                          "Account"
                        ],
                        "queryTemplate": "let AccountActivity_byIP = (v_IP_Address:string){\r\n                            AzureActivity\r\n                            | where Caller != '' and CallerIpAddress == v_IP_Address\r\n                            | summarize Account_Aux_StartTime = min(TimeGenerated), Account_Aux_EndTime = max(TimeGenerated), Count = count() by Caller, TenantId\r\n                            | top 10 by Count desc nulls last \r\n                            | extend UPN = iff(Caller contains '@', Caller, ''), Account_AadUserId = iff(Caller !contains '@', Caller,'')\r\n                            | extend Account_Name = split(UPN,'@')[0] , Account_UPNSuffix = split(UPN,'@')[1]\r\n                            | project Account_Name, Account_UPNSuffix, Account_AadUserId, Account_AadTenantId=TenantId, Account_Aux_StartTime , Account_Aux_EndTime};\r\n                            AccountActivity_byIP('<address>')"
                      },
                      "type": "Microsoft.SecurityInsights/entityQueries"
                    }
                  ]
                }
              }
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/entityQueries/{entityQueryId}": {
      "get": {
        "description": "Gets an entity query.",
        "operationId": "EntityQueries_Get",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/EntityQueryId"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/EntityQuery"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "EntityQueries"
        ],
        "x-ms-examples": {
          "Get an entity query.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "entityQueryId": "07da3cc8-c8ad-4710-a44e-334cdcb7882b",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/entityQueries/07da3cc8-c8ad-4710-a44e-334cdcb7882b",
                  "name": "07da3cc8-c8ad-4710-a44e-334cdcb7882b",
                  "properties": {
                    "dataSources": [
                      "SecurityEvent"
                    ],
                    "displayName": "Parent processes running on host",
                    "inputEntityType": "Host",
                    "inputFields": [
                      "hostName"
                    ],
                    "outputEntityTypes": [
                      "Process"
                    ],
                    "queryTemplate": "let GetParentProcessesOnHost = (v_Host_HostName:string){\r\n                            SecurityEvent \r\n                            | where EventID == 4688 \r\n                            | where isnotempty(ParentProcessName)\r\n                            | where NewProcessName !contains ':\\\\Windows\\\\System32\\\\conhost.exe' and ParentProcessName !contains ':\\\\Windows\\\\System32\\\\conhost.exe'\r\n                            and NewProcessName !contains ':\\\\Windows\\\\Microsoft.NET\\\\Framework64\\\\v2.0.50727\\\\csc.exe' and ParentProcessName !contains ':\\\\Windows\\\\Microsoft.NET\\\\Framework64\\\\v2.0.50727\\\\csc.exe'\r\n                            and NewProcessName !contains ':\\\\Windows\\\\Microsoft.NET\\\\Framework64\\\\v2.0.50727\\\\cvtres.exe' and ParentProcessName !contains ':\\\\Windows\\\\Microsoft.NET\\\\Framework64\\\\v2.0.50727\\\\cvtres.exe'\r\n                            and NewProcessName!contains ':\\\\Program Files\\\\Microsoft Monitoring Agent\\\\Agent\\\\MonitoringHost.exe' and ParentProcessName !contains ':\\\\Program Files\\\\Microsoft Monitoring Agent\\\\Agent\\\\MonitoringHost.exe'\r\n                            and ParentProcessName !contains ':\\\\Windows\\\\CCM\\\\CcmExec.exe'\r\n                            | where(ParentProcessName !contains ':\\\\Windows\\\\System32\\\\svchost.exe' and (NewProcessName !contains ':\\\\Windows\\\\System32\\\\wbem\\\\WmiPrvSE.exe' or NewProcessName !contains ':\\\\Windows\\\\SysWOW64\\\\wbem\\\\WmiPrvSE.exe'))\r\n                            | where(ParentProcessName !contains ':\\\\Windows\\\\System32\\\\services.exe' and NewProcessName !contains ':\\\\Windows\\\\servicing\\\\TrustedInstaller.exe')\r\n                            | where toupper(Computer) contains v_Host_HostName or toupper(WorkstationName) contains v_Host_HostName\r\n                            | summarize min(TimeGenerated), max(TimeGenerated) by Account, Computer, ParentProcessName, NewProcessName, CommandLine, ProcessId\r\n                            | project min_TimeGenerated, max_TimeGenerated, Account, Computer, ParentProcessName, NewProcessName, CommandLine, ProcessId\r\n                            | project-rename Process_Host_UnstructuredName=Computer, Process_Account_UnstructuredName=Account, Process_CommandLine=CommandLine, Process_ProcessId=ProcessId, Process_ImageFile_FullPath=NewProcessName, Process_ParentProcess_ImageFile_FullPath=ParentProcessName\r\n                            | top 10 by min_TimeGenerated asc};\r\n                            GetParentProcessesOnHost(toupper('<hostName>'))"
                  },
                  "type": "Microsoft.SecurityInsights/entityQueries"
                }
              }
            }
          }
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/officeConsents": {
      "get": {
        "description": "Gets all office365 consents.",
        "operationId": "OfficeConsents_List",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/OfficeConsentList"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "Office Consents"
        ],
        "x-ms-examples": {
          "Get all office consents.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "value": [
                    {
                      "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/officeConsents/04e5fd05-ff86-4b97-b8d2-1c20933cb46c",
                      "name": "04e5fd05-ff86-4b97-b8d2-1c20933cb46c",
                      "properties": {
                        "tenantId": "5460b3d2-1e7b-4757-ad54-c858c7e3f252",
                        "tenantName": "Contoso"
                      },
                      "type": "Microsoft.SecurityInsights/officeConsents"
                    }
                  ]
                }
              }
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/officeConsents/{consentId}": {
      "delete": {
        "description": "Delete the office365 consent.",
        "operationId": "OfficeConsents_Delete",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/ConsentId"
          }
        ],
        "responses": {
          "200": {
            "description": "OK"
          },
          "204": {
            "description": "No Content"
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "Office Consents"
        ],
        "x-ms-examples": {
          "Delete an office consent.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "consentId": "04e5fd05-ff86-4b97-b8d2-1c20933cb46c",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {},
              "204": {}
            }
          }
        }
      },
      "get": {
        "description": "Gets an office365 consent.",
        "operationId": "OfficeConsents_Get",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/ConsentId"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/OfficeConsent"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "Office Consents"
        ],
        "x-ms-examples": {
          "Get an office consent.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "consentId": "04e5fd05-ff86-4b97-b8d2-1c20933cb46c",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/officeConsents/04e5fd05-ff86-4b97-b8d2-1c20933cb46c",
                  "name": "04e5fd05-ff86-4b97-b8d2-1c20933cb46c",
                  "properties": {
                    "tenantId": "5460b3d2-1e7b-4757-ad54-c858c7e3f252",
                    "tenantName": "Contoso"
                  },
                  "type": "Microsoft.SecurityInsights/officeConsents"
                }
              }
            }
          }
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/settings/{settingsName}": {
      "get": {
        "description": "Gets a setting.",
        "operationId": "ProductSettings_Get",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/SettingsName"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/Settings"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "Settings"
        ],
        "x-ms-examples": {
          "Get Fusion settings.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "settingsName": "Fusion",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/settings/Fusion",
                  "kind": "ToggleSettings",
                  "name": "Fusion",
                  "properties": {
                    "isEnabled": true
                  },
                  "type": "Microsoft.SecurityInsights/settings"
                }
              }
            }
          },
          "Get UEBA settings.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
              "resourceGroupName": "myRg",
              "settingsName": "UEBA",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/settings/UEBA",
                  "kind": "UebaSettings",
                  "name": "UEBA",
                  "properties": {
                    "atpLicenseStatus": "Enabled",
                    "isEnabled": true,
                    "statusInMcas": "Enabled"
                  },
                  "type": "Microsoft.SecurityInsights/settings"
                }
              }
            }
          }
        }
      },
      "put": {
        "description": "Updates the setting.",
        "operationId": "ProductSettings_Update",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/OperationalInsightsResourceProvider"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/SettingsName"
          },
          {
            "$ref": "#/parameters/Settings"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/Settings"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "Settings"
        ],
        "x-ms-examples": {
          "Update UEBA settings.": {
            "parameters": {
              "api-version": "2019-01-01-preview",
              "operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
              "resourceGroupName": "myRg",
              "settings": {
                "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/settings/UEBA",
                "kind": "UebaSettings",
                "name": "UEBA",
                "properties": {
                  "atpLicenseStatus": "Enabled",
                  "isEnabled": true,
                  "statusInMcas": "Enabled"
                },
                "type": "Microsoft.SecurityInsights/settings"
              },
              "settingsName": "UEBA",
              "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
              "workspaceName": "myWorkspace"
            },
            "responses": {
              "200": {
                "body": {
                  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
                  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/settings/UEBA",
                  "kind": "UebaSettings",
                  "name": "UEBA",
                  "properties": {
                    "atpLicenseStatus": "Enabled",
                    "isEnabled": true,
                    "statusInMcas": "Enabled"
                  },
                  "type": "Microsoft.SecurityInsights/settings"
                }
              }
            }
          }
        }
      }
    }
  },
  "definitions": {
    "AADDataConnector": {
      "allOf": [
        {
          "$ref": "#/definitions/DataConnector"
        }
      ],
      "description": "Represents AAD (Azure Active Directory) data connector.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/AADDataConnectorProperties",
          "description": "AAD (Azure Active Directory) data connector properties.",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "AzureActiveDirectory"
    },
    "AADDataConnectorProperties": {
      "allOf": [
        {
          "$ref": "#/definitions/DataConnectorTenantId"
        },
        {
          "$ref": "#/definitions/DataConnectorWithAlertsProperties"
        }
      ],
      "description": "AAD (Azure Active Directory) data connector properties.",
      "type": "object"
    },
    "AATPDataConnector": {
      "allOf": [
        {
          "$ref": "#/definitions/DataConnector"
        }
      ],
      "description": "Represents AATP (Azure Advanced Threat Protection) data connector.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/AATPDataConnectorProperties",
          "description": "AATP (Azure Advanced Threat Protection) data connector properties.",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "AzureAdvancedThreatProtection"
    },
    "AATPDataConnectorProperties": {
      "allOf": [
        {
          "$ref": "#/definitions/DataConnectorTenantId"
        },
        {
          "$ref": "#/definitions/DataConnectorWithAlertsProperties"
        }
      ],
      "description": "AATP (Azure Advanced Threat Protection) data connector properties.",
      "type": "object"
    },
    "ASCDataConnector": {
      "allOf": [
        {
          "$ref": "#/definitions/DataConnector"
        }
      ],
      "description": "Represents ASC (Azure Security Center) data connector.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/ASCDataConnectorProperties",
          "description": "ASC (Azure Security Center) data connector properties.",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "AzureSecurityCenter"
    },
    "ASCDataConnectorProperties": {
      "allOf": [
        {
          "$ref": "#/definitions/DataConnectorWithAlertsProperties"
        }
      ],
      "description": "ASC (Azure Security Center) data connector properties.",
      "properties": {
        "subscriptionId": {
          "description": "The subscription id to connect to, and get the data from.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "AccountEntity": {
      "allOf": [
        {
          "$ref": "#/definitions/Entity"
        }
      ],
      "description": "Represents an account entity.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/AccountEntityProperties",
          "description": "Account entity properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "Account"
    },
    "AccountEntityProperties": {
      "allOf": [
        {
          "$ref": "#/definitions/EntityCommonProperties"
        }
      ],
      "description": "Account entity property bag.",
      "properties": {
        "aadTenantId": {
          "description": "The Azure Active Directory tenant id.",
          "readOnly": true,
          "type": "string"
        },
        "aadUserId": {
          "description": "The Azure Active Directory user id.",
          "readOnly": true,
          "type": "string"
        },
        "accountName": {
          "description": "The name of the account. This field should hold only the name without any domain added to it, i.e. administrator.",
          "readOnly": true,
          "type": "string"
        },
        "displayName": {
          "description": "The display name of the account.",
          "readOnly": true,
          "type": "string"
        },
        "hostEntityId": {
          "description": "The Host entity id that contains the account in case it is a local account (not domain joined)",
          "readOnly": true,
          "type": "string"
        },
        "isDomainJoined": {
          "description": "Determines whether this is a domain account.",
          "readOnly": true,
          "type": "boolean"
        },
        "ntDomain": {
          "description": "The NetBIOS domain name as it appears in the alert format – domain\\username. Examples: NT AUTHORITY.",
          "readOnly": true,
          "type": "string"
        },
        "objectGuid": {
          "description": "The objectGUID attribute is a single-value attribute that is the unique identifier for the object, assigned by active directory.",
          "format": "uuid",
          "readOnly": true,
          "type": "string"
        },
        "puid": {
          "description": "The Azure Active Directory Passport User ID.",
          "readOnly": true,
          "type": "string"
        },
        "sid": {
          "description": "The account security identifier, e.g. S-1-5-18.",
          "readOnly": true,
          "type": "string"
        },
        "upnSuffix": {
          "description": "The user principal name suffix for the account, in some cases it is also the domain name. Examples: contoso.com.",
          "readOnly": true,
          "type": "string"
        }
      },
      "type": "object"
    },
    "ActionRequest": {
      "allOf": [
        {
          "$ref": "#/definitions/ResourceWithEtag"
        }
      ],
      "description": "Action for alert rule.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/ActionRequestProperties",
          "description": "Action properties for put request",
          "x-ms-client-flatten": true
        }
      },
      "type": "object"
    },
    "ActionRequestProperties": {
      "description": "Action property bag.",
      "properties": {
        "triggerUri": {
          "description": "Logic App Callback URL for this specific workflow.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "ActionResponse": {
      "allOf": [
        {
          "$ref": "#/definitions/Resource"
        }
      ],
      "description": "Action for alert rule.",
      "properties": {
        "etag": {
          "description": "Etag of the action.",
          "type": "string"
        },
        "properties": {
          "$ref": "#/definitions/ActionResponseProperties",
          "description": "Action properties for get request",
          "x-ms-client-flatten": true
        }
      },
      "type": "object"
    },
    "ActionResponseProperties": {
      "description": "Action property bag.",
      "properties": {
        "workflowId": {
          "description": "The name of the logic app's workflow.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "ActionsList": {
      "description": "List all the actions.",
      "properties": {
        "nextLink": {
          "description": "URL to fetch the next set of actions.",
          "readOnly": true,
          "type": "string"
        },
        "value": {
          "description": "Array of actions.",
          "items": {
            "$ref": "#/definitions/ActionResponse"
          },
          "type": "array"
        }
      },
      "required": [
        "value"
      ]
    },
    "Aggregations": {
      "allOf": [
        {
          "$ref": "#/definitions/Resource"
        },
        {
          "$ref": "#/definitions/AggregationsKind"
        }
      ],
      "description": "The aggregation.",
      "discriminator": "kind",
      "type": "object"
    },
    "AggregationsKind": {
      "description": "Describes an Azure resource with kind.",
      "properties": {
        "kind": {
          "description": "The kind of the setting",
          "enum": [
            "CasesAggregation"
          ],
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "AggregationsKind"
          }
        }
      },
      "required": [
        "kind"
      ],
      "type": "object"
    },
    "AlertRule": {
      "allOf": [
        {
          "$ref": "#/definitions/ResourceWithEtag"
        },
        {
          "$ref": "#/definitions/AlertRuleKind"
        }
      ],
      "description": "Alert rule.",
      "discriminator": "kind",
      "type": "object"
    },
    "AlertRuleKind": {
      "description": "Describes an Azure resource with kind.",
      "properties": {
        "kind": {
          "description": "The kind of the alert rule",
          "enum": [
            "Scheduled",
            "MicrosoftSecurityIncidentCreation",
            "Fusion"
          ],
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "AlertRuleKind",
            "values": [
              {
                "value": "Scheduled"
              },
              {
                "value": "MicrosoftSecurityIncidentCreation"
              },
              {
                "value": "Fusion"
              }
            ]
          }
        }
      },
      "required": [
        "kind"
      ],
      "type": "object"
    },
    "AlertRuleTemplate": {
      "allOf": [
        {
          "$ref": "#/definitions/Resource"
        },
        {
          "$ref": "#/definitions/AlertRuleKind"
        }
      ],
      "description": "Alert rule template.",
      "discriminator": "kind",
      "type": "object"
    },
    "AlertRuleTemplatePropertiesBase": {
      "description": "Base alert rule template property bag.",
      "properties": {
        "alertRulesCreatedByTemplateCount": {
          "description": "the number of alert rules that were created by this template",
          "type": "integer"
        },
        "createdDateUTC": {
          "description": "The time that this alert rule template has been added.",
          "format": "date-time",
          "readOnly": true,
          "type": "string"
        },
        "description": {
          "description": "The description of the alert rule template.",
          "type": "string"
        },
        "displayName": {
          "description": "The display name for alert rule template.",
          "type": "string"
        },
        "requiredDataConnectors": {
          "description": "The required data connectors for this template",
          "items": {
            "$ref": "#/definitions/DataConnectorStatus"
          },
          "type": "array"
        },
        "status": {
          "description": "The alert rule template status.",
          "enum": [
            "Installed",
            "Available",
            "NotAvailable"
          ],
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "TemplateStatus",
            "values": [
              {
                "description": "Alert rule template installed. and can not use more then once",
                "value": "Installed"
              },
              {
                "description": "Alert rule template is available.",
                "value": "Available"
              },
              {
                "description": "Alert rule template is not available",
                "value": "NotAvailable"
              }
            ]
          }
        },
        "tactics": {
          "description": "The tactics of the alert rule template",
          "items": {
            "$ref": "#/definitions/AttackTactic"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "AlertRuleTemplatesList": {
      "description": "List all the alert rule templates.",
      "properties": {
        "nextLink": {
          "description": "URL to fetch the next set of alert rule templates.",
          "readOnly": true,
          "type": "string"
        },
        "value": {
          "description": "Array of alert rule templates.",
          "items": {
            "$ref": "#/definitions/AlertRuleTemplate"
          },
          "type": "array"
        }
      },
      "required": [
        "value"
      ]
    },
    "AlertRuleTriggerOperator": {
      "description": "The operation against the threshold that triggers alert rule.",
      "enum": [
        "GreaterThan",
        "LessThan",
        "Equal",
        "NotEqual"
      ],
      "type": "string",
      "x-ms-enum": {
        "modelAsString": false,
        "name": "TriggerOperator"
      }
    },
    "AlertRulesList": {
      "description": "List all the alert rules.",
      "properties": {
        "nextLink": {
          "description": "URL to fetch the next set of alert rules.",
          "readOnly": true,
          "type": "string"
        },
        "value": {
          "description": "Array of alert rules.",
          "items": {
            "$ref": "#/definitions/AlertRule"
          },
          "type": "array"
        }
      },
      "required": [
        "value"
      ]
    },
    "AlertSeverity": {
      "description": "The severity of the alert",
      "enum": [
        "High",
        "Medium",
        "Low",
        "Informational"
      ],
      "type": "string",
      "x-ms-enum": {
        "modelAsString": true,
        "name": "AlertSeverity",
        "values": [
          {
            "description": "High severity",
            "value": "High"
          },
          {
            "description": "Medium severity",
            "value": "Medium"
          },
          {
            "description": "Low severity",
            "value": "Low"
          },
          {
            "description": "Informational severity",
            "value": "Informational"
          }
        ]
      }
    },
    "AlertsDataTypeOfDataConnector": {
      "description": "Alerts data type for data connectors.",
      "properties": {
        "alerts": {
          "allOf": [
            {
              "$ref": "#/definitions/DataConnectorDataTypeCommon"
            }
          ],
          "description": "Alerts data type connection.",
          "type": "object"
        }
      },
      "type": "object"
    },
    "AttackTactic": {
      "description": "The severity for alerts created by this alert rule.",
      "enum": [
        "InitialAccess",
        "Execution",
        "Persistence",
        "PrivilegeEscalation",
        "DefenseEvasion",
        "CredentialAccess",
        "Discovery",
        "LateralMovement",
        "Collection",
        "Exfiltration",
        "CommandAndControl",
        "Impact"
      ],
      "type": "string",
      "x-ms-enum": {
        "modelAsString": true,
        "name": "AttackTactic"
      }
    },
    "AwsCloudTrailDataConnector": {
      "allOf": [
        {
          "$ref": "#/definitions/DataConnector"
        }
      ],
      "description": "Represents Amazon Web Services CloudTrail data connector.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/AwsCloudTrailDataConnectorProperties",
          "description": "Amazon Web Services CloudTrail data connector properties.",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "AmazonWebServicesCloudTrail"
    },
    "AwsCloudTrailDataConnectorDataTypes": {
      "description": "The available data types for Amazon Web Services CloudTrail data connector.",
      "properties": {
        "logs": {
          "allOf": [
            {
              "$ref": "#/definitions/DataConnectorDataTypeCommon"
            }
          ],
          "description": "Logs data type.",
          "type": "object"
        }
      },
      "type": "object"
    },
    "AwsCloudTrailDataConnectorProperties": {
      "description": "Amazon Web Services CloudTrail data connector properties.",
      "properties": {
        "awsRoleArn": {
          "description": "The Aws Role Arn (with CloudTrailReadOnly policy) that is used to access the Aws account.",
          "type": "string"
        },
        "dataTypes": {
          "$ref": "#/definitions/AwsCloudTrailDataConnectorDataTypes",
          "description": "The available data types for the connector."
        }
      },
      "type": "object"
    },
    "AzureResourceEntity": {
      "allOf": [
        {
          "$ref": "#/definitions/Entity"
        }
      ],
      "description": "Represents an azure resource entity.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/AzureResourceEntityProperties",
          "description": "AzureResource entity properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "AzureResource"
    },
    "AzureResourceEntityProperties": {
      "allOf": [
        {
          "$ref": "#/definitions/EntityCommonProperties"
        }
      ],
      "description": "AzureResource entity property bag.",
      "properties": {
        "resourceId": {
          "description": "The azure resource id of the resource",
          "readOnly": true,
          "type": "string"
        }
      },
      "type": "object"
    },
    "Bookmark": {
      "allOf": [
        {
          "$ref": "#/definitions/ResourceWithEtag"
        }
      ],
      "description": "Represents a bookmark in Azure Security Insights.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/BookmarkProperties",
          "description": "Bookmark properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object"
    },
    "BookmarkList": {
      "description": "List all the bookmarks.",
      "properties": {
        "nextLink": {
          "description": "URL to fetch the next set of cases.",
          "readOnly": true,
          "type": "string"
        },
        "value": {
          "description": "Array of bookmarks.",
          "items": {
            "$ref": "#/definitions/Bookmark"
          },
          "type": "array"
        }
      },
      "required": [
        "value"
      ]
    },
    "BookmarkProperties": {
      "description": "Describes bookmark properties",
      "properties": {
        "created": {
          "description": "The time the bookmark was created",
          "format": "date-time",
          "type": "string"
        },
        "createdBy": {
          "$ref": "#/definitions/UserInfo",
          "description": "Describes a user that created the bookmark",
          "type": "object"
        },
        "displayName": {
          "description": "The display name of the bookmark",
          "type": "string"
        },
        "incidentInfo": {
          "$ref": "#/definitions/IncidentInfo",
          "description": "Describes an incident that relates to bookmark",
          "type": "object"
        },
        "labels": {
          "description": "List of labels relevant to this bookmark",
          "items": {
            "$ref": "#/definitions/Label"
          },
          "type": "array"
        },
        "notes": {
          "description": "The notes of the bookmark",
          "type": "string"
        },
        "query": {
          "description": "The query of the bookmark.",
          "type": "string"
        },
        "queryResult": {
          "description": "The query result of the bookmark.",
          "type": "string"
        },
        "updated": {
          "description": "The last time the bookmark was updated",
          "format": "date-time",
          "type": "string"
        },
        "updatedBy": {
          "$ref": "#/definitions/UserInfo",
          "description": "Describes a user that updated the bookmark",
          "type": "object"
        }
      },
      "required": [
        "displayName",
        "query"
      ],
      "type": "object"
    },
    "BookmarkRelation": {
      "allOf": [
        {
          "$ref": "#/definitions/RelationBase"
        }
      ],
      "description": "Represents a bookmark relation",
      "properties": {
        "properties": {
          "$ref": "#/definitions/BookmarkRelationProperties",
          "description": "Bookmark relation properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object"
    },
    "BookmarkRelationList": {
      "description": "List of bookmark relations.",
      "properties": {
        "nextLink": {
          "description": "URL to fetch the next set of relations.",
          "readOnly": true,
          "type": "string"
        },
        "value": {
          "description": "Array of relations.",
          "items": {
            "$ref": "#/definitions/BookmarkRelation"
          },
          "type": "array"
        }
      },
      "required": [
        "value"
      ]
    },
    "BookmarkRelationProperties": {
      "description": "Bookmark relation properties",
      "properties": {
        "bookmarkId": {
          "description": "The case related bookmark id",
          "type": "string"
        },
        "caseIdentifier": {
          "description": "The case identifier",
          "type": "string"
        },
        "caseSeverity": {
          "description": "The case severity",
          "type": "string"
        },
        "caseTitle": {
          "description": "The case title",
          "type": "string"
        },
        "relationName": {
          "description": "Name of relation",
          "type": "string"
        }
      },
      "required": [
        "relationName",
        "caseIdentifier",
        "bookmarkId"
      ],
      "type": "object"
    },
    "Case": {
      "allOf": [
        {
          "$ref": "#/definitions/ResourceWithEtag"
        }
      ],
      "description": "Represents a case in Azure Security Insights.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/CaseProperties",
          "description": "Case properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object"
    },
    "CaseComment": {
      "allOf": [
        {
          "$ref": "#/definitions/Resource"
        }
      ],
      "description": "Represents a case comment",
      "properties": {
        "properties": {
          "$ref": "#/definitions/CaseCommentProperties",
          "description": "Case comment properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object"
    },
    "CaseCommentList": {
      "description": "List of case comments.",
      "properties": {
        "nextLink": {
          "description": "URL to fetch the next set of comments.",
          "readOnly": true,
          "type": "string"
        },
        "value": {
          "description": "Array of comments.",
          "items": {
            "$ref": "#/definitions/CaseComment"
          },
          "type": "array"
        }
      },
      "required": [
        "value"
      ]
    },
    "CaseCommentProperties": {
      "description": "Case comment property bag.",
      "properties": {
        "createdTimeUtc": {
          "description": "The time the comment was created",
          "format": "date-time",
          "readOnly": true,
          "type": "string"
        },
        "message": {
          "description": "The comment message",
          "type": "string"
        },
        "userInfo": {
          "$ref": "#/definitions/UserInfo",
          "description": "Describes the user that created the comment",
          "readOnly": true,
          "type": "object"
        }
      },
      "required": [
        "message"
      ],
      "type": "object"
    },
    "CaseList": {
      "description": "List all the cases.",
      "properties": {
        "nextLink": {
          "description": "URL to fetch the next set of cases.",
          "readOnly": true,
          "type": "string"
        },
        "value": {
          "description": "Array of cases.",
          "items": {
            "$ref": "#/definitions/Case"
          },
          "type": "array"
        }
      },
      "required": [
        "value"
      ]
    },
    "CaseProperties": {
      "description": "Describes case properties",
      "properties": {
        "caseNumber": {
          "description": "a sequential number",
          "readOnly": true,
          "type": "integer"
        },
        "closeReason": {
          "description": "The reason the case was closed",
          "enum": [
            "Resolved",
            "Dismissed",
            "TruePositive",
            "FalsePositive",
            "Other"
          ],
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "CloseReason",
            "values": [
              {
                "description": "Case was resolved",
                "value": "Resolved"
              },
              {
                "description": "Case was dismissed",
                "value": "Dismissed"
              },
              {
                "description": "Case was true positive",
                "value": "TruePositive"
              },
              {
                "description": "Case was false positive",
                "value": "FalsePositive"
              },
              {
                "description": "Case was closed for another reason",
                "value": "Other"
              }
            ]
          }
        },
        "closedReasonText": {
          "description": "the case close reason details",
          "type": "string"
        },
        "createdTimeUtc": {
          "description": "The time the case was created",
          "format": "date-time",
          "readOnly": true,
          "type": "string"
        },
        "description": {
          "description": "The description of the case",
          "type": "string"
        },
        "endTimeUtc": {
          "description": "The end time of the case",
          "format": "date-time",
          "type": "string"
        },
        "labels": {
          "description": "List of labels relevant to this case",
          "items": {
            "$ref": "#/definitions/Label"
          },
          "type": "array"
        },
        "lastComment": {
          "description": "the last comment in the case",
          "readOnly": true,
          "type": "string"
        },
        "lastUpdatedTimeUtc": {
          "description": "The last time the case was updated",
          "format": "date-time",
          "readOnly": true,
          "type": "string"
        },
        "owner": {
          "$ref": "#/definitions/UserInfo",
          "description": "Describes a user that the case is assigned to",
          "type": "object"
        },
        "relatedAlertIds": {
          "description": "List of related alert identifiers",
          "items": {
            "description": "related alert id",
            "type": "string"
          },
          "readOnly": true,
          "type": "array"
        },
        "severity": {
          "description": "The severity of the case",
          "enum": [
            "Critical",
            "High",
            "Medium",
            "Low",
            "Informational"
          ],
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "CaseSeverity",
            "values": [
              {
                "description": "Critical severity",
                "value": "Critical"
              },
              {
                "description": "High severity",
                "value": "High"
              },
              {
                "description": "Medium severity",
                "value": "Medium"
              },
              {
                "description": "Low severity",
                "value": "Low"
              },
              {
                "description": "Informational severity",
                "value": "Informational"
              }
            ]
          }
        },
        "startTimeUtc": {
          "description": "The start time of the case",
          "format": "date-time",
          "type": "string"
        },
        "status": {
          "description": "The status of the case",
          "enum": [
            "Draft",
            "New",
            "InProgress",
            "Closed"
          ],
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "CaseStatus",
            "values": [
              {
                "description": "Case that wasn't promoted yet to active",
                "value": "Draft"
              },
              {
                "description": "An active case which isn't handled currently",
                "value": "New"
              },
              {
                "description": "An active case which is handled",
                "value": "InProgress"
              },
              {
                "description": "A non active case",
                "value": "Closed"
              }
            ]
          }
        },
        "title": {
          "description": "The title of the case",
          "type": "string"
        },
        "totalComments": {
          "description": "the number of total comments in the case",
          "readOnly": true,
          "type": "integer"
        }
      },
      "required": [
        "title",
        "severity",
        "status",
        "startTimeUtc"
      ],
      "type": "object"
    },
    "CaseRelation": {
      "allOf": [
        {
          "$ref": "#/definitions/RelationBase"
        }
      ],
      "description": "Represents a case relation",
      "properties": {
        "properties": {
          "$ref": "#/definitions/CaseRelationProperties",
          "description": "Case relation properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object"
    },
    "CaseRelationList": {
      "description": "List of case relations.",
      "properties": {
        "nextLink": {
          "description": "URL to fetch the next set of relations.",
          "readOnly": true,
          "type": "string"
        },
        "value": {
          "description": "Array of relations.",
          "items": {
            "$ref": "#/definitions/CaseRelation"
          },
          "type": "array"
        }
      },
      "required": [
        "value"
      ]
    },
    "CaseRelationProperties": {
      "description": "Case relation properties",
      "properties": {
        "bookmarkId": {
          "description": "The case related bookmark id",
          "type": "string"
        },
        "bookmarkName": {
          "description": "The case related bookmark name",
          "type": "string"
        },
        "caseIdentifier": {
          "description": "The case identifier",
          "type": "string"
        },
        "relationName": {
          "description": "Name of relation",
          "type": "string"
        }
      },
      "required": [
        "relationName",
        "caseIdentifier",
        "bookmarkId"
      ],
      "type": "object"
    },
    "CasesAggregation": {
      "allOf": [
        {
          "$ref": "#/definitions/Aggregations"
        }
      ],
      "description": "Represents aggregations results for cases.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/CasesAggregationProperties",
          "description": "Properties of aggregations results of cases.",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "CasesAggregation"
    },
    "CasesAggregationBySeverityProperties": {
      "description": "Aggregative results of cases by severity property bag.",
      "properties": {
        "totalCriticalSeverity": {
          "description": "Total amount of open cases with severity Critical",
          "readOnly": true,
          "type": "integer"
        },
        "totalHighSeverity": {
          "description": "Total amount of open cases with severity High",
          "readOnly": true,
          "type": "integer"
        },
        "totalInformationalSeverity": {
          "description": "Total amount of open cases with severity Informational",
          "readOnly": true,
          "type": "integer"
        },
        "totalLowSeverity": {
          "description": "Total amount of open cases with severity Low",
          "readOnly": true,
          "type": "integer"
        },
        "totalMediumSeverity": {
          "description": "Total amount of open cases with severity medium",
          "readOnly": true,
          "type": "integer"
        }
      },
      "type": "object"
    },
    "CasesAggregationByStatusProperties": {
      "description": "Aggregative results of cases by status property bag.",
      "properties": {
        "totalDismissedStatus": {
          "description": "Total amount of open cases with status Dismissed",
          "readOnly": true,
          "type": "integer"
        },
        "totalInProgressStatus": {
          "description": "Total amount of open cases with status InProgress",
          "readOnly": true,
          "type": "integer"
        },
        "totalNewStatus": {
          "description": "Total amount of open cases with status New",
          "readOnly": true,
          "type": "integer"
        },
        "totalResolvedStatus": {
          "description": "Total amount of open cases with status Resolved",
          "readOnly": true,
          "type": "integer"
        }
      },
      "type": "object"
    },
    "CasesAggregationProperties": {
      "description": "Aggregative results of cases property bag.",
      "properties": {
        "aggregationBySeverity": {
          "$ref": "#/definitions/CasesAggregationBySeverityProperties",
          "description": "Aggregations results by case severity."
        },
        "aggregationByStatus": {
          "$ref": "#/definitions/CasesAggregationByStatusProperties",
          "description": "Aggregations results by case status."
        }
      },
      "type": "object"
    },
    "CloudApplicationEntity": {
      "allOf": [
        {
          "$ref": "#/definitions/Entity"
        }
      ],
      "description": "Represents a cloud application entity.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/CloudApplicationEntityProperties",
          "description": "CloudApplication entity properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "CloudApplication"
    },
    "CloudApplicationEntityProperties": {
      "allOf": [
        {
          "$ref": "#/definitions/EntityCommonProperties"
        }
      ],
      "description": "CloudApplication entity property bag.",
      "properties": {
        "appId": {
          "description": "The technical identifier of the application.",
          "readOnly": true,
          "type": "integer"
        },
        "appName": {
          "description": "The name of the related cloud application.",
          "readOnly": true,
          "type": "string"
        },
        "instanceName": {
          "description": "The user defined instance name of the cloud application. It is often used to distinguish between several applications of the same type that a customer has.",
          "readOnly": true,
          "type": "string"
        }
      },
      "type": "object"
    },
    "CloudError": {
      "description": "Error response structure.",
      "properties": {
        "error": {
          "$ref": "#/definitions/CloudErrorBody",
          "description": "Error data",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-external": true
    },
    "CloudErrorBody": {
      "description": "Error details.",
      "properties": {
        "code": {
          "description": "An identifier for the error. Codes are invariant and are intended to be consumed programmatically.",
          "readOnly": true,
          "type": "string"
        },
        "message": {
          "description": "A message describing the error, intended to be suitable for display in a user interface.",
          "readOnly": true,
          "type": "string"
        }
      },
      "type": "object",
      "x-ms-external": true
    },
    "DataConnector": {
      "allOf": [
        {
          "$ref": "#/definitions/ResourceWithEtag"
        },
        {
          "$ref": "#/definitions/DataConnectorKind"
        }
      ],
      "description": "Data connector.",
      "discriminator": "kind",
      "type": "object"
    },
    "DataConnectorDataTypeCommon": {
      "description": "Common field for data type in data connectors.",
      "properties": {
        "state": {
          "description": "Describe whether this data type connection is enabled or not.",
          "enum": [
            "Enabled",
            "Disabled"
          ],
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "DataTypeState"
          }
        }
      },
      "type": "object"
    },
    "DataConnectorKind": {
      "description": "Describes an Azure resource with kind.",
      "properties": {
        "kind": {
          "description": "The kind of the data connector",
          "enum": [
            "AzureActiveDirectory",
            "AzureSecurityCenter",
            "MicrosoftCloudAppSecurity",
            "ThreatIntelligence",
            "Office365",
            "AmazonWebServicesCloudTrail",
            "AzureAdvancedThreatProtection",
            "MicrosoftDefenderAdvancedThreatProtection"
          ],
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "DataConnectorKind",
            "values": [
              {
                "value": "AzureActiveDirectory"
              },
              {
                "value": "AzureSecurityCenter"
              },
              {
                "value": "MicrosoftCloudAppSecurity"
              },
              {
                "value": "ThreatIntelligence"
              },
              {
                "value": "Office365"
              },
              {
                "value": "AmazonWebServicesCloudTrail"
              },
              {
                "value": "AzureAdvancedThreatProtection"
              },
              {
                "value": "MicrosoftDefenderAdvancedThreatProtection"
              }
            ]
          }
        }
      },
      "required": [
        "kind"
      ],
      "type": "object"
    },
    "DataConnectorList": {
      "description": "List all the data connectors.",
      "properties": {
        "nextLink": {
          "description": "URL to fetch the next set of data connectors.",
          "readOnly": true,
          "type": "string"
        },
        "value": {
          "description": "Array of data connectors.",
          "items": {
            "$ref": "#/definitions/DataConnector"
          },
          "type": "array"
        }
      },
      "required": [
        "value"
      ]
    },
    "DataConnectorStatus": {
      "description": "alert rule template data connector status",
      "properties": {
        "connectorId": {
          "description": "the connector id",
          "type": "string"
        },
        "dataTypes": {
          "additionalProperties": {
            "enum": [
              "Exist",
              "NotExist"
            ],
            "type": "string",
            "x-ms-enum": {
              "modelAsString": true,
              "name": "DataTypeStatus"
            }
          },
          "description": "The data types availability map",
          "type": "object"
        }
      },
      "type": "object"
    },
    "DataConnectorTenantId": {
      "description": "Properties data connector on tenant level.",
      "properties": {
        "tenantId": {
          "description": "The tenant id to connect to, and get the data from.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "DataConnectorWithAlertsProperties": {
      "description": "Data connector properties.",
      "properties": {
        "dataTypes": {
          "$ref": "#/definitions/AlertsDataTypeOfDataConnector",
          "description": "The available data types for the connector."
        }
      },
      "type": "object"
    },
    "DnsEntity": {
      "allOf": [
        {
          "$ref": "#/definitions/Entity"
        }
      ],
      "description": "Represents a dns entity.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/DnsEntityProperties",
          "description": "Dns entity properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "DnsResolution"
    },
    "DnsEntityProperties": {
      "allOf": [
        {
          "$ref": "#/definitions/EntityCommonProperties"
        }
      ],
      "description": "Dns entity property bag.",
      "properties": {
        "dnsServerIpEntityId": {
          "description": "An ip entity id for the dns server resolving the request",
          "readOnly": true,
          "type": "string"
        },
        "domainName": {
          "description": "The name of the dns record associated with the alert",
          "readOnly": true,
          "type": "string"
        },
        "hostIpAddressEntityId": {
          "description": "An ip entity id for the dns request client",
          "readOnly": true,
          "type": "string"
        },
        "ipAddressEntityIds": {
          "description": "Ip entity identifiers for the resolved ip address.",
          "items": {
            "description": "Ip entity id",
            "type": "string"
          },
          "readOnly": true,
          "type": "array"
        }
      },
      "type": "object"
    },
    "Entity": {
      "allOf": [
        {
          "$ref": "#/definitions/Resource"
        },
        {
          "$ref": "#/definitions/EntityKind"
        }
      ],
      "description": "Specific entity.",
      "discriminator": "kind",
      "type": "object"
    },
    "EntityCommonProperties": {
      "description": "Entity common property bag.",
      "properties": {
        "additionalData": {
          "additionalProperties": {
            "type": "object"
          },
          "description": "A bag of custom fields that should be part of the entity and will be presented to the user.",
          "readOnly": true,
          "type": "object"
        },
        "friendlyName": {
          "description": "The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated.",
          "readOnly": true,
          "type": "string"
        }
      },
      "type": "object"
    },
    "EntityExpandParameters": {
      "description": "The parameters required to execute an expand operation on the given entity.",
      "properties": {
        "endTime": {
          "description": "The end date filter, so the only expansion results returned are before this date.",
          "format": "date-time",
          "type": "string"
        },
        "expansionId": {
          "description": "The Id of the expansion to perform.",
          "format": "uuid",
          "type": "string"
        },
        "startTime": {
          "description": "The start date filter, so the only expansion results returned are after this date.",
          "format": "date-time",
          "type": "string"
        }
      }
    },
    "EntityExpandResponse": {
      "description": "The entity expansion result operation response.",
      "properties": {
        "metaData": {
          "$ref": "#/definitions/ExpansionResultsMetadata",
          "description": "The metadata from the expansion operation results."
        },
        "value": {
          "description": "The expansion result values.",
          "properties": {
            "entities": {
              "description": "Array of the expansion result entities.",
              "items": {
                "$ref": "#/definitions/Entity"
              },
              "type": "array"
            }
          },
          "type": "object"
        }
      }
    },
    "EntityInnerKind": {
      "description": "The kind of the entity",
      "enum": [
        "Account",
        "Host",
        "File",
        "AzureResource",
        "CloudApplication",
        "DnsResolution",
        "FileHash",
        "Ip",
        "Malware",
        "Process",
        "RegistryKey",
        "RegistryValue",
        "SecurityGroup",
        "Url",
        "IoTDevice",
        "SecurityAlert",
        "Bookmark"
      ],
      "type": "string",
      "x-ms-enum": {
        "modelAsString": true,
        "name": "EntityKind",
        "values": [
          {
            "description": "Entity represents account in the system.",
            "value": "Account"
          },
          {
            "description": "Entity represents host in the system.",
            "value": "Host"
          },
          {
            "description": "Entity represents file in the system.",
            "value": "File"
          },
          {
            "description": "Entity represents azure resource in the system.",
            "value": "AzureResource"
          },
          {
            "description": "Entity represents cloud application in the system.",
            "value": "CloudApplication"
          },
          {
            "description": "Entity represents dns resolution in the system.",
            "value": "DnsResolution"
          },
          {
            "description": "Entity represents file hash in the system.",
            "value": "FileHash"
          },
          {
            "description": "Entity represents ip in the system.",
            "value": "Ip"
          },
          {
            "description": "Entity represents malware in the system.",
            "value": "Malware"
          },
          {
            "description": "Entity represents process in the system.",
            "value": "Process"
          },
          {
            "description": "Entity represents registry key in the system.",
            "value": "RegistryKey"
          },
          {
            "description": "Entity represents registry value in the system.",
            "value": "RegistryValue"
          },
          {
            "description": "Entity represents security group in the system.",
            "value": "SecurityGroup"
          },
          {
            "description": "Entity represents url in the system.",
            "value": "Url"
          },
          {
            "description": "Entity represents IoT device in the system.",
            "value": "IoTDevice"
          },
          {
            "description": "Entity represents security alert in the system.",
            "value": "SecurityAlert"
          },
          {
            "description": "Entity represents bookmark in the system.",
            "value": "Bookmark"
          }
        ]
      }
    },
    "EntityInnerType": {
      "description": "The type of the entity",
      "enum": [
        "Account",
        "Host",
        "File",
        "AzureResource",
        "CloudApplication",
        "DNS",
        "FileHash",
        "IP",
        "Malware",
        "Process",
        "RegistryKey",
        "RegistryValue",
        "SecurityGroup",
        "URL",
        "IoTDevice",
        "SecurityAlert",
        "HuntingBookmark"
      ],
      "type": "string",
      "x-ms-enum": {
        "modelAsString": true,
        "name": "EntityType",
        "values": [
          {
            "description": "Entity represents account in the system.",
            "value": "Account"
          },
          {
            "description": "Entity represents host in the system.",
            "value": "Host"
          },
          {
            "description": "Entity represents file in the system.",
            "value": "File"
          },
          {
            "description": "Entity represents azure resource in the system.",
            "value": "AzureResource"
          },
          {
            "description": "Entity represents cloud application in the system.",
            "value": "CloudApplication"
          },
          {
            "description": "Entity represents dns in the system.",
            "value": "DNS"
          },
          {
            "description": "Entity represents file hash in the system.",
            "value": "FileHash"
          },
          {
            "description": "Entity represents ip in the system.",
            "value": "IP"
          },
          {
            "description": "Entity represents malware in the system.",
            "value": "Malware"
          },
          {
            "description": "Entity represents process in the system.",
            "value": "Process"
          },
          {
            "description": "Entity represents registry key in the system.",
            "value": "RegistryKey"
          },
          {
            "description": "Entity represents registry value in the system.",
            "value": "RegistryValue"
          },
          {
            "description": "Entity represents security group in the system.",
            "value": "SecurityGroup"
          },
          {
            "description": "Entity represents url in the system.",
            "value": "URL"
          },
          {
            "description": "Entity represents IoT device in the system.",
            "value": "IoTDevice"
          },
          {
            "description": "Entity represents security alert in the system.",
            "value": "SecurityAlert"
          },
          {
            "description": "Entity represents HuntingBookmark in the system.",
            "value": "HuntingBookmark"
          }
        ]
      }
    },
    "EntityKind": {
      "description": "Describes an entity with kind.",
      "properties": {
        "kind": {
          "$ref": "#/definitions/EntityInnerKind",
          "description": "The kind of the entity."
        }
      },
      "required": [
        "kind"
      ],
      "type": "object"
    },
    "EntityList": {
      "description": "List of all the entities.",
      "properties": {
        "nextLink": {
          "description": "URL to fetch the next set of entities.",
          "readOnly": true,
          "type": "string"
        },
        "value": {
          "description": "Array of entities.",
          "items": {
            "$ref": "#/definitions/Entity"
          },
          "type": "array"
        }
      },
      "required": [
        "value"
      ]
    },
    "EntityQuery": {
      "allOf": [
        {
          "$ref": "#/definitions/Resource"
        }
      ],
      "description": "Specific entity query.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/EntityQueryProperties",
          "description": "Entity query properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object"
    },
    "EntityQueryList": {
      "description": "List of all the entity queries.",
      "properties": {
        "nextLink": {
          "description": "URL to fetch the next set of entity queries.",
          "readOnly": true,
          "type": "string"
        },
        "value": {
          "description": "Array of entity queries.",
          "items": {
            "$ref": "#/definitions/EntityQuery"
          },
          "type": "array"
        }
      },
      "required": [
        "value"
      ]
    },
    "EntityQueryProperties": {
      "description": "Describes entity query properties",
      "properties": {
        "dataSources": {
          "description": "List of the data sources that are required to run the query",
          "items": {
            "description": "data source",
            "type": "string"
          },
          "type": "array"
        },
        "displayName": {
          "description": "The query display name",
          "type": "string"
        },
        "inputEntityType": {
          "$ref": "#/definitions/EntityInnerType",
          "description": "The type of the query's source entity"
        },
        "inputFields": {
          "description": "List of the fields of the source entity that are required to run the query",
          "items": {
            "description": "input field",
            "type": "string"
          },
          "type": "array"
        },
        "outputEntityTypes": {
          "description": "List of the desired output types to be constructed from the result",
          "items": {
            "$ref": "#/definitions/EntityInnerType",
            "description": "output entity type"
          },
          "type": "array"
        },
        "queryTemplate": {
          "description": "The template query string to be parsed and formatted",
          "type": "string"
        }
      },
      "type": "object"
    },
    "ExpansionResultAggregation": {
      "description": "Information of a specific aggregation in the expansion result.",
      "properties": {
        "aggregationType": {
          "description": "The common type of the aggregation. (for e.g. entity field name)",
          "type": "string"
        },
        "count": {
          "description": "Total number of aggregations of the given kind (and aggregationType if given) in the expansion result.",
          "type": "integer"
        },
        "displayName": {
          "description": "The display name of the aggregation by type.",
          "type": "string"
        },
        "entityKind": {
          "$ref": "#/definitions/EntityInnerKind",
          "description": "The kind of the aggregated entity."
        }
      },
      "required": [
        "entityKind",
        "count"
      ],
      "type": "object"
    },
    "ExpansionResultsMetadata": {
      "description": "Expansion result metadata.",
      "properties": {
        "aggregations": {
          "description": "Information of the aggregated nodes in the expansion result.",
          "items": {
            "$ref": "#/definitions/ExpansionResultAggregation"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "FileEntity": {
      "allOf": [
        {
          "$ref": "#/definitions/Entity"
        }
      ],
      "description": "Represents a file entity.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/FileEntityProperties",
          "description": "File entity properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "File"
    },
    "FileEntityProperties": {
      "allOf": [
        {
          "$ref": "#/definitions/EntityCommonProperties"
        }
      ],
      "description": "File entity property bag.",
      "properties": {
        "directory": {
          "description": "The full path to the file.",
          "readOnly": true,
          "type": "string"
        },
        "fileHashEntityIds": {
          "description": "The file hash entity identifiers associated with this file",
          "items": {
            "description": "file hash id",
            "type": "string"
          },
          "readOnly": true,
          "type": "array"
        },
        "fileName": {
          "description": "The file name without path (some alerts might not include path).",
          "readOnly": true,
          "type": "string"
        },
        "hostEntityId": {
          "description": "The Host entity id which the file belongs to",
          "readOnly": true,
          "type": "string"
        }
      },
      "type": "object"
    },
    "FileHashEntity": {
      "allOf": [
        {
          "$ref": "#/definitions/Entity"
        }
      ],
      "description": "Represents a file hash entity.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/FileHashEntityProperties",
          "description": "FileHash entity properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "FileHash"
    },
    "FileHashEntityProperties": {
      "allOf": [
        {
          "$ref": "#/definitions/EntityCommonProperties"
        }
      ],
      "description": "FileHash entity property bag.",
      "properties": {
        "algorithm": {
          "description": "The hash algorithm type.",
          "enum": [
            "Unknown",
            "MD5",
            "SHA1",
            "SHA256",
            "SHA256AC"
          ],
          "readOnly": true,
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "FileHashAlgorithm",
            "values": [
              {
                "description": "Unknown hash algorithm",
                "value": "Unknown"
              },
              {
                "description": "MD5 hash type",
                "value": "MD5"
              },
              {
                "description": "SHA1 hash type",
                "value": "SHA1"
              },
              {
                "description": "SHA256 hash type",
                "value": "SHA256"
              },
              {
                "description": "SHA256 Authenticode hash type",
                "value": "SHA256AC"
              }
            ]
          }
        },
        "hashValue": {
          "description": "The file hash value.",
          "readOnly": true,
          "type": "string"
        }
      },
      "type": "object"
    },
    "FusionAlertRule": {
      "allOf": [
        {
          "$ref": "#/definitions/AlertRule"
        }
      ],
      "description": "Represents Fusion alert rule.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/FusionAlertRuleProperties",
          "description": "Fusion alert rule properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "Fusion"
    },
    "FusionAlertRuleProperties": {
      "description": "Fusion alert rule base property bag.",
      "properties": {
        "alertRuleTemplateName": {
          "description": "The Name of the alert rule template used to create this rule.",
          "type": "string"
        },
        "description": {
          "description": "The description of the alert rule.",
          "readOnly": true,
          "type": "string"
        },
        "displayName": {
          "description": "The display name for alerts created by this alert rule.",
          "readOnly": true,
          "type": "string"
        },
        "enabled": {
          "description": "Determines whether this alert rule is enabled or disabled.",
          "type": "boolean"
        },
        "lastModifiedUtc": {
          "description": "The last time that this alert has been modified.",
          "format": "date-time",
          "readOnly": true,
          "type": "string"
        },
        "severity": {
          "$ref": "#/definitions/AlertSeverity",
          "description": "The severity for alerts created by this alert rule.",
          "readOnly": true
        },
        "tactics": {
          "description": "The tactics of the alert rule",
          "items": {
            "$ref": "#/definitions/AttackTactic"
          },
          "readOnly": true,
          "type": "array"
        }
      },
      "required": [
        "alertRuleTemplateName",
        "enabled"
      ],
      "type": "object"
    },
    "FusionAlertRuleTemplate": {
      "allOf": [
        {
          "$ref": "#/definitions/AlertRuleTemplate"
        }
      ],
      "description": "Represents Fusion alert rule template.",
      "properties": {
        "properties": {
          "allOf": [
            {
              "$ref": "#/definitions/AlertRuleTemplatePropertiesBase"
            }
          ],
          "description": "Fusion alert rule template properties",
          "properties": {
            "severity": {
              "$ref": "#/definitions/AlertSeverity",
              "description": "The severity for alerts created by this alert rule."
            }
          },
          "required": [
            "displayName",
            "description",
            "status",
            "severity",
            "alertRulesCreatedByTemplateCount"
          ],
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "Fusion"
    },
    "GeoLocation": {
      "description": "The geo-location context attached to the ip entity",
      "properties": {
        "asn": {
          "description": "Autonomous System Number",
          "readOnly": true,
          "type": "integer"
        },
        "city": {
          "description": "City name",
          "readOnly": true,
          "type": "string"
        },
        "countryCode": {
          "description": "The country code according to ISO 3166 format",
          "readOnly": true,
          "type": "string"
        },
        "countryName": {
          "description": "Country name according to ISO 3166 Alpha 2: the lowercase of the English Short Name",
          "readOnly": true,
          "type": "string"
        },
        "latitude": {
          "description": "The longitude of the identified location, expressed as a floating point number with range of -180 to 180, with positive numbers representing East and negative numbers representing West. Latitude and longitude are derived from the city or postal code.",
          "format": "double",
          "readOnly": true,
          "type": "number"
        },
        "longitude": {
          "description": "The latitude of the identified location, expressed as a floating point number with range of - 90 to 90, with positive numbers representing North and negative numbers representing South. Latitude and longitude are derived from the city or postal code.",
          "format": "double",
          "readOnly": true,
          "type": "number"
        },
        "state": {
          "description": "State name",
          "readOnly": true,
          "type": "string"
        }
      },
      "readOnly": true,
      "type": "object"
    },
    "HostEntity": {
      "allOf": [
        {
          "$ref": "#/definitions/Entity"
        }
      ],
      "description": "Represents a host entity.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/HostEntityProperties",
          "description": "Host entity properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "Host"
    },
    "HostEntityProperties": {
      "allOf": [
        {
          "$ref": "#/definitions/EntityCommonProperties"
        }
      ],
      "description": "Host entity property bag.",
      "properties": {
        "azureID": {
          "description": "The azure resource id of the VM.",
          "readOnly": true,
          "type": "string"
        },
        "dnsDomain": {
          "description": "The DNS domain that this host belongs to. Should contain the compete DNS suffix for the domain",
          "readOnly": true,
          "type": "string"
        },
        "hostName": {
          "description": "The hostname without the domain suffix.",
          "readOnly": true,
          "type": "string"
        },
        "isDomainJoined": {
          "description": "Determines whether this host belongs to a domain.",
          "readOnly": true,
          "type": "boolean"
        },
        "netBiosName": {
          "description": "The host name (pre-windows2000).",
          "readOnly": true,
          "type": "string"
        },
        "ntDomain": {
          "description": "The NT domain that this host belongs to.",
          "readOnly": true,
          "type": "string"
        },
        "omsAgentID": {
          "description": "The OMS agent id, if the host has OMS agent installed.",
          "readOnly": true,
          "type": "string"
        },
        "osFamily": {
          "description": "The operating system type.",
          "enum": [
            "Linux",
            "Windows",
            "Android",
            "IOS"
          ],
          "type": "string",
          "x-ms-enum": {
            "modelAsString": false,
            "name": "OSFamily",
            "values": [
              {
                "description": "Host with Linux operating system.",
                "value": "Linux"
              },
              {
                "description": "Host with Windows operating system.",
                "value": "Windows"
              },
              {
                "description": "Host with Android operating system.",
                "value": "Android"
              },
              {
                "description": "Host with IOS operating system.",
                "value": "IOS"
              }
            ]
          }
        },
        "osVersion": {
          "description": "A free text representation of the operating system. This field is meant to hold specific versions the are more fine grained than OSFamily or future values not supported by OSFamily enumeration",
          "readOnly": true,
          "type": "string"
        }
      },
      "type": "object"
    },
    "IncidentInfo": {
      "description": "Describes related incident information for the bookmark",
      "properties": {
        "incidentId": {
          "description": "Incident Id",
          "type": "string"
        },
        "relationName": {
          "description": "Relation Name",
          "type": "string"
        },
        "severity": {
          "description": "The severity of the incident",
          "enum": [
            "Critical",
            "High",
            "Medium",
            "Low",
            "Informational"
          ],
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "IncidentSeverity",
            "values": [
              {
                "description": "Critical severity",
                "value": "Critical"
              },
              {
                "description": "High severity",
                "value": "High"
              },
              {
                "description": "Medium severity",
                "value": "Medium"
              },
              {
                "description": "Low severity",
                "value": "Low"
              },
              {
                "description": "Informational severity",
                "value": "Informational"
              }
            ]
          }
        },
        "title": {
          "description": "The title of the incident",
          "type": "string"
        }
      },
      "required": [
        "incidentId",
        "severity",
        "title",
        "relationName"
      ],
      "type": "object"
    },
    "IoTDeviceEntity": {
      "allOf": [
        {
          "$ref": "#/definitions/Entity"
        }
      ],
      "description": "Represents an IoT device entity.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/IoTDeviceEntityProperties",
          "description": "IoTDevice entity properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "IoTDevice"
    },
    "IoTDeviceEntityProperties": {
      "allOf": [
        {
          "$ref": "#/definitions/EntityCommonProperties"
        }
      ],
      "description": "IoTDevice entity property bag.",
      "properties": {
        "deviceId": {
          "description": "The ID of the IoT Device in the IoT Hub",
          "readOnly": true,
          "type": "string"
        },
        "deviceType": {
          "description": "The type of the device",
          "readOnly": true,
          "type": "string"
        },
        "edgeId": {
          "description": "The ID of the edge device",
          "readOnly": true,
          "type": "string"
        },
        "hostEntityId": {
          "description": "The Host entity id of this device",
          "readOnly": true,
          "type": "string"
        },
        "iotHubEntityId": {
          "description": "The AzureResource entity id of the IoT Hub",
          "readOnly": true,
          "type": "string"
        },
        "iotSecurityAgentId": {
          "description": "The ID of the security agent running on the device",
          "format": "uuid",
          "readOnly": true,
          "type": "string"
        },
        "threatIntelligence": {
          "description": "A list of TI contexts attached to the IoTDevice entity.",
          "items": {
            "$ref": "#/definitions/ThreatIntelligence"
          },
          "readOnly": true,
          "type": "array"
        },
        "vendor": {
          "description": "The vendor of the device",
          "readOnly": true,
          "type": "string"
        }
      },
      "type": "object"
    },
    "IpEntity": {
      "allOf": [
        {
          "$ref": "#/definitions/Entity"
        }
      ],
      "description": "Represents an ip entity.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/IpEntityProperties",
          "description": "Ip entity properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "Ip"
    },
    "IpEntityProperties": {
      "allOf": [
        {
          "$ref": "#/definitions/EntityCommonProperties"
        }
      ],
      "description": "Ip entity property bag.",
      "properties": {
        "address": {
          "description": "The IP address as string, e.g. 127.0.0.1 (either in Ipv4 or Ipv6)",
          "readOnly": true,
          "type": "string"
        },
        "location": {
          "$ref": "#/definitions/GeoLocation",
          "description": "The geo-location context attached to the ip entity"
        },
        "threatIntelligence": {
          "description": "A list of TI contexts attached to the ip entity.",
          "items": {
            "$ref": "#/definitions/ThreatIntelligence"
          },
          "readOnly": true,
          "type": "array"
        }
      },
      "type": "object"
    },
    "Label": {
      "description": "Label that will be used to tag and filter on.",
      "type": "string"
    },
    "MCASDataConnector": {
      "allOf": [
        {
          "$ref": "#/definitions/DataConnector"
        }
      ],
      "description": "Represents MCAS (Microsoft Cloud App Security) data connector.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/MCASDataConnectorProperties",
          "description": "MCAS (Microsoft Cloud App Security) data connector properties.",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "MicrosoftCloudAppSecurity"
    },
    "MCASDataConnectorDataTypes": {
      "allOf": [
        {
          "$ref": "#/definitions/AlertsDataTypeOfDataConnector"
        }
      ],
      "description": "The available data types for MCAS (Microsoft Cloud App Security) data connector.",
      "properties": {
        "discoveryLogs": {
          "allOf": [
            {
              "$ref": "#/definitions/DataConnectorDataTypeCommon"
            }
          ],
          "description": "Discovery log data type connection.",
          "type": "object"
        }
      },
      "type": "object"
    },
    "MCASDataConnectorProperties": {
      "allOf": [
        {
          "$ref": "#/definitions/DataConnectorTenantId"
        }
      ],
      "description": "MCAS (Microsoft Cloud App Security) data connector properties.",
      "properties": {
        "dataTypes": {
          "$ref": "#/definitions/MCASDataConnectorDataTypes",
          "description": "The available data types for the connector."
        }
      },
      "type": "object"
    },
    "MDATPDataConnector": {
      "allOf": [
        {
          "$ref": "#/definitions/DataConnector"
        }
      ],
      "description": "Represents MDATP (Microsoft Defender Advanced Threat Protection) data connector.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/MDATPDataConnectorProperties",
          "description": "MDATP (Microsoft Defender Advanced Threat Protection) data connector properties.",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "MicrosoftDefenderAdvancedThreatProtection"
    },
    "MDATPDataConnectorProperties": {
      "allOf": [
        {
          "$ref": "#/definitions/DataConnectorTenantId"
        },
        {
          "$ref": "#/definitions/DataConnectorWithAlertsProperties"
        }
      ],
      "description": "MDATP (Microsoft Defender Advanced Threat Protection) data connector properties.",
      "type": "object"
    },
    "MalwareEntity": {
      "allOf": [
        {
          "$ref": "#/definitions/Entity"
        }
      ],
      "description": "Represents a malware entity.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/MalwareEntityProperties",
          "description": "File entity properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "Malware"
    },
    "MalwareEntityProperties": {
      "allOf": [
        {
          "$ref": "#/definitions/EntityCommonProperties"
        }
      ],
      "description": "Malware entity property bag.",
      "properties": {
        "category": {
          "description": "The malware category by the vendor, e.g. Trojan",
          "readOnly": true,
          "type": "string"
        },
        "fileEntityIds": {
          "description": "List of linked file entity identifiers on which the malware was found",
          "items": {
            "description": "file entity id",
            "type": "string"
          },
          "readOnly": true,
          "type": "array"
        },
        "malwareName": {
          "description": "The malware name by the vendor, e.g. Win32/Toga!rfn",
          "readOnly": true,
          "type": "string"
        },
        "processEntityIds": {
          "description": "List of linked process entity identifiers on which the malware was found.",
          "items": {
            "description": "process entity id",
            "type": "string"
          },
          "readOnly": true,
          "type": "array"
        }
      },
      "type": "object"
    },
    "MicrosoftSecurityIncidentCreationAlertRule": {
      "allOf": [
        {
          "$ref": "#/definitions/AlertRule"
        }
      ],
      "description": "Represents MicrosoftSecurityIncidentCreation rule.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/MicrosoftSecurityIncidentCreationAlertRuleProperties",
          "description": "MicrosoftSecurityIncidentCreation rule properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "MicrosoftSecurityIncidentCreation"
    },
    "MicrosoftSecurityIncidentCreationAlertRuleCommonProperties": {
      "description": "MicrosoftSecurityIncidentCreation rule common property bag.",
      "properties": {
        "displayNamesFilter": {
          "description": "the alerts' displayNames on which the cases will be generated",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "productFilter": {
          "description": "The alerts' productName on which the cases will be generated",
          "enum": [
            "Microsoft Cloud App Security",
            "Azure Security Center",
            "Azure Advanced Threat Protection",
            "Azure Active Directory Identity Protection",
            "Azure Security Center for IoT"
          ],
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "MicrosoftSecurityProductName"
          }
        },
        "severitiesFilter": {
          "description": "the alerts' severities on which the cases will be generated",
          "items": {
            "$ref": "#/definitions/AlertSeverity"
          },
          "type": "array"
        }
      },
      "required": [
        "productFilter"
      ],
      "type": "object"
    },
    "MicrosoftSecurityIncidentCreationAlertRuleProperties": {
      "allOf": [
        {
          "$ref": "#/definitions/MicrosoftSecurityIncidentCreationAlertRuleCommonProperties"
        }
      ],
      "description": "MicrosoftSecurityIncidentCreation rule property bag.",
      "properties": {
        "alertRuleTemplateName": {
          "description": "The Name of the alert rule template used to create this rule.",
          "type": "string"
        },
        "description": {
          "description": "The description of the alert rule.",
          "type": "string"
        },
        "displayName": {
          "description": "The display name for alerts created by this alert rule.",
          "type": "string"
        },
        "enabled": {
          "description": "Determines whether this alert rule is enabled or disabled.",
          "type": "boolean"
        },
        "lastModifiedUtc": {
          "description": "The last time that this alert has been modified.",
          "format": "date-time",
          "readOnly": true,
          "type": "string"
        },
        "tactics": {
          "description": "The tactics of the alert rule",
          "items": {
            "$ref": "#/definitions/AttackTactic"
          },
          "type": "array"
        }
      },
      "required": [
        "displayName",
        "enabled",
        "productFilter"
      ],
      "type": "object"
    },
    "MicrosoftSecurityIncidentCreationAlertRuleTemplate": {
      "allOf": [
        {
          "$ref": "#/definitions/AlertRuleTemplate"
        }
      ],
      "description": "Represents MicrosoftSecurityIncidentCreation rule template.",
      "properties": {
        "properties": {
          "allOf": [
            {
              "$ref": "#/definitions/AlertRuleTemplatePropertiesBase"
            },
            {
              "$ref": "#/definitions/MicrosoftSecurityIncidentCreationAlertRuleCommonProperties"
            }
          ],
          "description": "MicrosoftSecurityIncidentCreation rule template properties",
          "required": [
            "displayName",
            "description",
            "createdDateUTC",
            "status",
            "alertRulesCreatedByTemplateCount",
            "productFilter"
          ],
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "MicrosoftSecurityIncidentCreation"
    },
    "OfficeConsent": {
      "allOf": [
        {
          "$ref": "#/definitions/Resource"
        }
      ],
      "description": "Consent for Office365 tenant that already made.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/OfficeConsentProperties",
          "description": "Office consent properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object"
    },
    "OfficeConsentList": {
      "description": "List of all the office365 consents.",
      "properties": {
        "nextLink": {
          "description": "URL to fetch the next set of office consents.",
          "readOnly": true,
          "type": "string"
        },
        "value": {
          "description": "Array of the consents.",
          "items": {
            "$ref": "#/definitions/OfficeConsent"
          },
          "type": "array"
        }
      },
      "required": [
        "value"
      ]
    },
    "OfficeConsentProperties": {
      "description": "Consent property bag.",
      "properties": {
        "tenantId": {
          "description": "The tenantId of the Office365 with the consent.",
          "type": "string"
        },
        "tenantName": {
          "description": "The tenant name of the Office365 with the consent.",
          "readOnly": true,
          "type": "string"
        }
      },
      "type": "object"
    },
    "OfficeDataConnector": {
      "allOf": [
        {
          "$ref": "#/definitions/DataConnector"
        }
      ],
      "description": "Represents office data connector.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/OfficeDataConnectorProperties",
          "description": "Office data connector properties.",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "Office365"
    },
    "OfficeDataConnectorDataTypes": {
      "description": "The available data types for office data connector.",
      "properties": {
        "exchange": {
          "allOf": [
            {
              "$ref": "#/definitions/DataConnectorDataTypeCommon"
            }
          ],
          "description": "Exchange data type connection.",
          "type": "object"
        },
        "sharePoint": {
          "allOf": [
            {
              "$ref": "#/definitions/DataConnectorDataTypeCommon"
            }
          ],
          "description": "SharePoint data type connection.",
          "type": "object"
        }
      },
      "type": "object"
    },
    "OfficeDataConnectorProperties": {
      "allOf": [
        {
          "$ref": "#/definitions/DataConnectorTenantId"
        }
      ],
      "description": "Office data connector properties.",
      "properties": {
        "dataTypes": {
          "$ref": "#/definitions/OfficeDataConnectorDataTypes",
          "description": "The available data types for the connector."
        }
      },
      "type": "object"
    },
    "Operation": {
      "description": "Operation provided by provider",
      "properties": {
        "display": {
          "description": "Properties of the operation",
          "properties": {
            "description": {
              "description": "Description of the operation",
              "type": "string"
            },
            "operation": {
              "description": "Operation name",
              "type": "string"
            },
            "provider": {
              "description": "Provider name",
              "type": "string"
            },
            "resource": {
              "description": "Resource name",
              "type": "string"
            }
          },
          "type": "object"
        },
        "name": {
          "description": "Name of the operation",
          "type": "string"
        }
      }
    },
    "OperationsList": {
      "description": "Lists the operations available in the SecurityInsights RP.",
      "properties": {
        "nextLink": {
          "description": "URL to fetch the next set of operations.",
          "type": "string"
        },
        "value": {
          "description": "Array of operations",
          "items": {
            "$ref": "#/definitions/Operation"
          },
          "type": "array"
        }
      },
      "required": [
        "value"
      ]
    },
    "ProcessEntity": {
      "allOf": [
        {
          "$ref": "#/definitions/Entity"
        }
      ],
      "description": "Represents a process entity.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/ProcessEntityProperties",
          "description": "Process entity properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "Process"
    },
    "ProcessEntityProperties": {
      "allOf": [
        {
          "$ref": "#/definitions/EntityCommonProperties"
        }
      ],
      "description": "Process entity property bag.",
      "properties": {
        "accountEntityId": {
          "description": "The account entity id running the processes.",
          "readOnly": true,
          "type": "string"
        },
        "commandLine": {
          "description": "The command line used to create the process",
          "readOnly": true,
          "type": "string"
        },
        "creationTimeUtc": {
          "description": "The time when the process started to run",
          "format": "date-time",
          "readOnly": true,
          "type": "string"
        },
        "elevationToken": {
          "description": "The elevation token associated with the process.",
          "enum": [
            "Default",
            "Full",
            "Limited"
          ],
          "type": "string",
          "x-ms-enum": {
            "modelAsString": false,
            "name": "ElevationToken",
            "values": [
              {
                "description": "Default elevation token",
                "value": "Default"
              },
              {
                "description": "Full elevation token",
                "value": "Full"
              },
              {
                "description": "Limited elevation token",
                "value": "Limited"
              }
            ]
          }
        },
        "hostEntityId": {
          "description": "The host entity id on which the process was running",
          "readOnly": true,
          "type": "string"
        },
        "hostLogonSessionEntityId": {
          "description": "The session entity id in which the process was running",
          "readOnly": true,
          "type": "string"
        },
        "imageFileEntityId": {
          "description": "Image file entity id",
          "readOnly": true,
          "type": "string"
        },
        "parentProcessEntityId": {
          "description": "The parent process entity id.",
          "readOnly": true,
          "type": "string"
        },
        "processId": {
          "description": "The process ID",
          "readOnly": true,
          "type": "string"
        }
      },
      "type": "object"
    },
    "RegistryKeyEntity": {
      "allOf": [
        {
          "$ref": "#/definitions/Entity"
        }
      ],
      "description": "Represents a registry key entity.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/RegistryKeyEntityProperties",
          "description": "RegistryKey entity properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "RegistryKey"
    },
    "RegistryKeyEntityProperties": {
      "allOf": [
        {
          "$ref": "#/definitions/EntityCommonProperties"
        }
      ],
      "description": "RegistryKey entity property bag.",
      "properties": {
        "hive": {
          "description": "the hive that holds the registry key.",
          "enum": [
            "HKEY_LOCAL_MACHINE",
            "HKEY_CLASSES_ROOT",
            "HKEY_CURRENT_CONFIG",
            "HKEY_USERS",
            "HKEY_CURRENT_USER_LOCAL_SETTINGS",
            "HKEY_PERFORMANCE_DATA",
            "HKEY_PERFORMANCE_NLSTEXT",
            "HKEY_PERFORMANCE_TEXT",
            "HKEY_A",
            "HKEY_CURRENT_USER"
          ],
          "readOnly": true,
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "RegistryHive",
            "values": [
              {
                "description": "HKEY_LOCAL_MACHINE",
                "value": "HKEY_LOCAL_MACHINE"
              },
              {
                "description": "HKEY_CLASSES_ROOT",
                "value": "HKEY_CLASSES_ROOT"
              },
              {
                "description": "HKEY_CURRENT_CONFIG",
                "value": "HKEY_CURRENT_CONFIG"
              },
              {
                "description": "HKEY_USERS",
                "value": "HKEY_USERS"
              },
              {
                "description": "HKEY_CURRENT_USER_LOCAL_SETTINGS",
                "value": "HKEY_CURRENT_USER_LOCAL_SETTINGS"
              },
              {
                "description": "HKEY_PERFORMANCE_DATA",
                "value": "HKEY_PERFORMANCE_DATA"
              },
              {
                "description": "HKEY_PERFORMANCE_NLSTEXT",
                "value": "HKEY_PERFORMANCE_NLSTEXT"
              },
              {
                "description": "HKEY_PERFORMANCE_TEXT",
                "value": "HKEY_PERFORMANCE_TEXT"
              },
              {
                "description": "HKEY_A",
                "value": "HKEY_A"
              },
              {
                "description": "HKEY_CURRENT_USER",
                "value": "HKEY_CURRENT_USER"
              }
            ]
          }
        },
        "key": {
          "description": "The registry key path.",
          "readOnly": true,
          "type": "string"
        }
      },
      "type": "object"
    },
    "RegistryValueEntity": {
      "allOf": [
        {
          "$ref": "#/definitions/Entity"
        }
      ],
      "description": "Represents a registry value entity.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/RegistryValueEntityProperties",
          "description": "RegistryKey entity properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "RegistryValue"
    },
    "RegistryValueEntityProperties": {
      "allOf": [
        {
          "$ref": "#/definitions/EntityCommonProperties"
        }
      ],
      "description": "RegistryValue entity property bag.",
      "properties": {
        "keyEntityId": {
          "description": "The registry key entity id.",
          "readOnly": true,
          "type": "string"
        },
        "valueData": {
          "description": "String formatted representation of the value data.",
          "readOnly": true,
          "type": "string"
        },
        "valueName": {
          "description": "The registry value name.",
          "readOnly": true,
          "type": "string"
        },
        "valueType": {
          "description": "Specifies the data types to use when storing values in the registry, or identifies the data type of a value in the registry.",
          "enum": [
            "None",
            "Unknown",
            "String",
            "ExpandString",
            "Binary",
            "DWord",
            "MultiString",
            "QWord"
          ],
          "readOnly": true,
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "RegistryValueKind",
            "values": [
              {
                "description": "None",
                "value": "None"
              },
              {
                "description": "Unknown value type",
                "value": "Unknown"
              },
              {
                "description": "String value type",
                "value": "String"
              },
              {
                "description": "ExpandString value type",
                "value": "ExpandString"
              },
              {
                "description": "Binary value type",
                "value": "Binary"
              },
              {
                "description": "DWord value type",
                "value": "DWord"
              },
              {
                "description": "MultiString value type",
                "value": "MultiString"
              },
              {
                "description": "QWord value type",
                "value": "QWord"
              }
            ]
          }
        }
      },
      "type": "object"
    },
    "RelationBase": {
      "allOf": [
        {
          "$ref": "#/definitions/Resource"
        },
        {
          "properties": {
            "etag": {
              "description": "ETag for relation",
              "type": "string"
            },
            "kind": {
              "description": "The type of relation node",
              "enum": [
                "CasesToBookmarks"
              ],
              "readOnly": true,
              "type": "string",
              "x-ms-enum": {
                "modelAsString": true,
                "name": "RelationTypes",
                "values": [
                  {
                    "description": "Relations between cases and bookmarks",
                    "value": "CasesToBookmarks"
                  }
                ]
              }
            }
          },
          "type": "object"
        }
      ],
      "description": "Represents a relation",
      "type": "object"
    },
    "RelationNode": {
      "description": "Relation node",
      "properties": {
        "etag": {
          "description": "Etag for relation node",
          "type": "string"
        },
        "relationAdditionalProperties": {
          "additionalProperties": {
            "type": "string"
          },
          "description": "Additional set of properties",
          "type": "object"
        },
        "relationNodeId": {
          "description": "Relation Node Id",
          "type": "string"
        },
        "relationNodeKind": {
          "description": "The type of relation node",
          "enum": [
            "Case",
            "Bookmark"
          ],
          "readOnly": true,
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "RelationNodeKind",
            "values": [
              {
                "description": "Case node part of the relation",
                "value": "Case"
              },
              {
                "description": "Bookmark node part of the relation",
                "value": "Bookmark"
              }
            ]
          }
        }
      },
      "type": "object"
    },
    "RelationsModelInput": {
      "allOf": [
        {
          "$ref": "#/definitions/RelationBase"
        }
      ],
      "description": "Relation input model",
      "properties": {
        "properties": {
          "$ref": "#/definitions/RelationsModelInputProperties",
          "description": "Relation input properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object"
    },
    "RelationsModelInputProperties": {
      "description": "Relation input properties",
      "properties": {
        "relationName": {
          "description": "Name of relation",
          "type": "string"
        },
        "sourceRelationNode": {
          "$ref": "#/definitions/RelationNode",
          "description": "Relation source node",
          "type": "object"
        },
        "targetRelationNode": {
          "$ref": "#/definitions/RelationNode",
          "description": "Relation target node",
          "type": "object"
        }
      },
      "type": "object"
    },
    "Resource": {
      "description": "An azure resource object",
      "properties": {
        "id": {
          "description": "Azure resource Id",
          "readOnly": true,
          "type": "string"
        },
        "name": {
          "description": "Azure resource name",
          "readOnly": true,
          "type": "string"
        },
        "type": {
          "description": "Azure resource type",
          "readOnly": true,
          "type": "string"
        }
      },
      "x-ms-azure-resource": true
    },
    "ResourceWithEtag": {
      "description": "An azure resource object with an Etag property",
      "properties": {
        "etag": {
          "description": "Etag of the azure resource",
          "type": "string"
        },
        "id": {
          "description": "Azure resource Id",
          "readOnly": true,
          "type": "string"
        },
        "name": {
          "description": "Azure resource name",
          "readOnly": true,
          "type": "string"
        },
        "type": {
          "description": "Azure resource type",
          "readOnly": true,
          "type": "string"
        }
      },
      "x-ms-azure-resource": true
    },
    "ScheduledAlertRule": {
      "allOf": [
        {
          "$ref": "#/definitions/AlertRule"
        }
      ],
      "description": "Represents scheduled alert rule.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/ScheduledAlertRuleProperties",
          "description": "Scheduled alert rule properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "Scheduled"
    },
    "ScheduledAlertRuleCommonProperties": {
      "description": "Schedule alert rule template property bag.",
      "properties": {
        "query": {
          "description": "The query that creates alerts for this rule.",
          "type": "string"
        },
        "queryFrequency": {
          "description": "The frequency (in ISO 8601 duration format) for this alert rule to run.",
          "format": "duration",
          "type": "string"
        },
        "queryPeriod": {
          "description": "The period (in ISO 8601 duration format) that this alert rule looks at.",
          "format": "duration",
          "type": "string"
        },
        "severity": {
          "$ref": "#/definitions/AlertSeverity",
          "description": "The severity for alerts created by this alert rule."
        },
        "triggerOperator": {
          "$ref": "#/definitions/AlertRuleTriggerOperator",
          "description": "The operation against the threshold that triggers alert rule."
        },
        "triggerThreshold": {
          "description": "The threshold triggers this alert rule.",
          "type": "integer"
        }
      },
      "type": "object"
    },
    "ScheduledAlertRuleProperties": {
      "allOf": [
        {
          "$ref": "#/definitions/ScheduledAlertRuleCommonProperties"
        }
      ],
      "description": "Scheduled alert rule base property bag.",
      "properties": {
        "alertRuleTemplateName": {
          "description": "The Name of the alert rule template used to create this rule.",
          "type": "string"
        },
        "description": {
          "description": "The description of the alert rule.",
          "type": "string"
        },
        "displayName": {
          "description": "The display name for alerts created by this alert rule.",
          "type": "string"
        },
        "enabled": {
          "description": "Determines whether this alert rule is enabled or disabled.",
          "type": "boolean"
        },
        "lastModifiedUtc": {
          "description": "The last time that this alert rule has been modified.",
          "format": "date-time",
          "readOnly": true,
          "type": "string"
        },
        "suppressionDuration": {
          "description": "The suppression (in ISO 8601 duration format) to wait since last time this alert rule been triggered.",
          "format": "duration",
          "type": "string"
        },
        "suppressionEnabled": {
          "description": "Determines whether the suppression for this alert rule is enabled or disabled.",
          "type": "boolean"
        },
        "tactics": {
          "description": "The tactics of the alert rule",
          "items": {
            "$ref": "#/definitions/AttackTactic"
          },
          "type": "array"
        }
      },
      "required": [
        "displayName",
        "enabled",
        "severity",
        "query",
        "queryFrequency",
        "queryPeriod",
        "triggerOperator",
        "triggerThreshold",
        "suppressionEnabled",
        "suppressionDuration"
      ],
      "type": "object"
    },
    "ScheduledAlertRuleTemplate": {
      "allOf": [
        {
          "$ref": "#/definitions/AlertRuleTemplate"
        }
      ],
      "description": "Represents scheduled alert rule template.",
      "properties": {
        "properties": {
          "allOf": [
            {
              "$ref": "#/definitions/AlertRuleTemplatePropertiesBase"
            },
            {
              "$ref": "#/definitions/ScheduledAlertRuleCommonProperties"
            }
          ],
          "description": "Scheduled alert rule template properties",
          "required": [
            "displayName",
            "description",
            "status",
            "alertRulesCreatedByTemplateCount",
            "severity",
            "query",
            "queryFrequency",
            "queryPeriod",
            "triggerOperator",
            "triggerThreshold"
          ],
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "Scheduled"
    },
    "SecurityAlert": {
      "allOf": [
        {
          "$ref": "#/definitions/Entity"
        }
      ],
      "description": "Represents a security alert entity.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/SecurityAlertProperties",
          "description": "SecurityAlert entity properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "SecurityAlert"
    },
    "SecurityAlertProperties": {
      "allOf": [
        {
          "$ref": "#/definitions/EntityCommonProperties"
        }
      ],
      "description": "SecurityAlert entity property bag.",
      "properties": {
        "alertDisplayName": {
          "description": "The display name of the alert.",
          "readOnly": true,
          "type": "string"
        },
        "alertType": {
          "description": "The type name of the alert.",
          "readOnly": true,
          "type": "string"
        },
        "compromisedEntity": {
          "description": "Display name of the main entity being reported on.",
          "readOnly": true,
          "type": "string"
        },
        "confidenceLevel": {
          "description": "The confidence level of this alert.",
          "enum": [
            "Unknown",
            "Low",
            "High"
          ],
          "readOnly": true,
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "ConfidenceLevel",
            "values": [
              {
                "description": "Unknown confidence, the is the default value",
                "value": "Unknown"
              },
              {
                "description": "Low confidence, meaning we have some doubts this is indeed malicious or part of an attack",
                "value": "Low"
              },
              {
                "description": "High confidence that the alert is true positive malicious",
                "value": "High"
              }
            ]
          }
        },
        "confidenceReasons": {
          "description": "The confidence reasons",
          "items": {
            "description": "confidence reason item",
            "properties": {
              "reason": {
                "description": "The reason's description",
                "readOnly": true,
                "type": "string"
              },
              "reasonType": {
                "description": "The type (category) of the reason",
                "readOnly": true,
                "type": "string"
              }
            },
            "type": "object"
          },
          "readOnly": true,
          "type": "array"
        },
        "confidenceScore": {
          "description": "The confidence score of the alert.",
          "format": "double",
          "readOnly": true,
          "type": "number"
        },
        "confidenceScoreStatus": {
          "description": "The confidence score calculation status, i.e. indicating if score calculation is pending for this alert, not applicable or final.",
          "enum": [
            "NotApplicable",
            "InProcess",
            "NotFinal",
            "Final"
          ],
          "readOnly": true,
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "ConfidenceScoreStatus",
            "values": [
              {
                "description": "Score will not be calculated for this alert as it is not supported by virtual analyst",
                "value": "NotApplicable"
              },
              {
                "description": "No score was set yet and calculation is in progress",
                "value": "InProcess"
              },
              {
                "description": "Score is calculated and shown as part of the alert, but may be updated again at a later time following the processing of additional data",
                "value": "NotFinal"
              },
              {
                "description": "Final score was calculated and available",
                "value": "Final"
              }
            ]
          }
        },
        "description": {
          "description": "Alert description.",
          "readOnly": true,
          "type": "string"
        },
        "endTimeUtc": {
          "description": "The impact end time of the alert (the time of the last event contributing to the alert).",
          "format": "date-time",
          "readOnly": true,
          "type": "string"
        },
        "intent": {
          "description": "Holds the alert intent stage(s) mapping for this alert.",
          "enum": [
            "Unknown",
            "Probing",
            "Exploitation",
            "Persistence",
            "PrivilegeEscalation",
            "DefenseEvasion",
            "CredentialAccess",
            "Discovery",
            "LateralMovement",
            "Execution",
            "Collection",
            "Exfiltration",
            "CommandAndControl",
            "Impact"
          ],
          "readOnly": true,
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "KillChainIntent",
            "values": [
              {
                "description": "The default value.",
                "value": "Unknown"
              },
              {
                "description": "Probing could be an attempt to access a certain resource regardless of a malicious intent or a failed attempt to gain access to a target system to gather information prior to exploitation. This step is usually detected as an attempt originating from outside the network in attempt to scan the target system and find a way in.",
                "value": "Probing"
              },
              {
                "description": "Exploitation is the stage where an attacker manage to get foothold on the attacked resource. This stage is applicable not only for compute hosts, but also for resources such as user accounts, certificates etc. Adversaries will often be able to control the resource after this stage.",
                "value": "Exploitation"
              },
              {
                "description": "Persistence is any access, action, or configuration change to a system that gives an adversary a persistent presence on that system. Adversaries will often need to maintain access to systems through interruptions such as system restarts, loss of credentials, or other failures that would require a remote access tool to restart or alternate backdoor for them to regain access.",
                "value": "Persistence"
              },
              {
                "description": "Privilege escalation is the result of actions that allow an adversary to obtain a higher level of permissions on a system or network. Certain tools or actions require a higher level of privilege to work and are likely necessary at many points throughout an operation. User accounts with permissions to access specific systems or perform specific functions necessary for adversaries to achieve their objective may also be considered an escalation of privilege.",
                "value": "PrivilegeEscalation"
              },
              {
                "description": "Defense evasion consists of techniques an adversary may use to evade detection or avoid other defenses. Sometimes these actions are the same as or variations of techniques in other categories that have the added benefit of subverting a particular defense or mitigation. ",
                "value": "DefenseEvasion"
              },
              {
                "description": "Credential access represents techniques resulting in access to or control over system, domain, or service credentials that are used within an enterprise environment. Adversaries will likely attempt to obtain legitimate credentials from users or administrator accounts (local system administrator or domain users with administrator access) to use within the network. With sufficient access within a network, an adversary can create accounts for later use within the environment.",
                "value": "CredentialAccess"
              },
              {
                "description": "Discovery consists of techniques that allow the adversary to gain knowledge about the system and internal network. When adversaries gain access to a new system, they must orient themselves to what they now have control of and what benefits operating from that system give to their current objective or overall goals during the intrusion. The operating system provides many native tools that aid in this post-compromise information-gathering phase.",
                "value": "Discovery"
              },
              {
                "description": "Lateral movement consists of techniques that enable an adversary to access and control remote systems on a network and could, but does not necessarily, include execution of tools on remote systems. The lateral movement techniques could allow an adversary to gather information from a system without needing additional tools, such as a remote access tool. An adversary can use lateral movement for many purposes, including remote Execution of tools, pivoting to additional systems, access to specific information or files, access to additional credentials, or to cause an effect.",
                "value": "LateralMovement"
              },
              {
                "description": "The execution tactic represents techniques that result in execution of adversary-controlled code on a local or remote system. This tactic is often used in conjunction with lateral movement to expand access to remote systems on a network.",
                "value": "Execution"
              },
              {
                "description": "Collection consists of techniques used to identify and gather information, such as sensitive files, from a target network prior to exfiltration. This category also covers locations on a system or network where the adversary may look for information to exfiltrate.",
                "value": "Collection"
              },
              {
                "description": "Exfiltration refers to techniques and attributes that result or aid in the adversary removing files and information from a target network. This category also covers locations on a system or network where the adversary may look for information to exfiltrate.",
                "value": "Exfiltration"
              },
              {
                "description": "The command and control tactic represents how adversaries communicate with systems under their control within a target network.",
                "value": "CommandAndControl"
              },
              {
                "description": "The impact intent primary objective is to directly reduce the availability or integrity of a system, service, or network; including manipulation of data to impact a business or operational process. This would often refer to techniques such as ransom-ware, defacement, data manipulation and others.",
                "value": "Impact"
              }
            ]
          }
        },
        "processingEndTime": {
          "description": "The time the alert was made available for consumption.",
          "format": "date-time",
          "readOnly": true,
          "type": "string"
        },
        "productComponentName": {
          "description": "The name of a component inside the product which generated the alert.",
          "readOnly": true,
          "type": "string"
        },
        "productName": {
          "description": "The name of the product which published this alert.",
          "readOnly": true,
          "type": "string"
        },
        "productVersion": {
          "description": "The version of the product generating the alert.",
          "readOnly": true,
          "type": "string"
        },
        "remediationSteps": {
          "description": "Manual action items to take to remediate the alert.",
          "items": {
            "type": "string"
          },
          "readOnly": true,
          "type": "array"
        },
        "severity": {
          "$ref": "#/definitions/AlertSeverity",
          "description": "The severity of the alert"
        },
        "startTimeUtc": {
          "description": "The impact start time of the alert (the time of the first event contributing to the alert).",
          "format": "date-time",
          "readOnly": true,
          "type": "string"
        },
        "status": {
          "description": "The lifecycle status of the alert.",
          "enum": [
            "Unknown",
            "New",
            "Resolved",
            "Dismissed",
            "InProgress"
          ],
          "readOnly": true,
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "AlertStatus",
            "values": [
              {
                "description": "Unknown value",
                "value": "Unknown"
              },
              {
                "description": "New alert",
                "value": "New"
              },
              {
                "description": "Alert closed after handling",
                "value": "Resolved"
              },
              {
                "description": "Alert dismissed as false positive",
                "value": "Dismissed"
              },
              {
                "description": "Alert is being handled",
                "value": "InProgress"
              }
            ]
          }
        },
        "systemAlertId": {
          "description": "Holds the product identifier of the alert for the product.",
          "readOnly": true,
          "type": "string"
        },
        "timeGenerated": {
          "description": "The time the alert was generated.",
          "format": "date-time",
          "readOnly": true,
          "type": "string"
        },
        "vendorName": {
          "description": "The name of the vendor that raise the alert.",
          "readOnly": true,
          "type": "string"
        }
      },
      "type": "object"
    },
    "SecurityGroupEntity": {
      "allOf": [
        {
          "$ref": "#/definitions/Entity"
        }
      ],
      "description": "Represents a security group entity.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/SecurityGroupEntityProperties",
          "description": "SecurityGroup entity properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "SecurityGroup"
    },
    "SecurityGroupEntityProperties": {
      "allOf": [
        {
          "$ref": "#/definitions/EntityCommonProperties"
        }
      ],
      "description": "SecurityGroup entity property bag.",
      "properties": {
        "distinguishedName": {
          "description": "The group distinguished name",
          "readOnly": true,
          "type": "string"
        },
        "objectGuid": {
          "description": "A single-value attribute that is the unique identifier for the object, assigned by active directory.",
          "format": "uuid",
          "readOnly": true,
          "type": "string"
        },
        "sid": {
          "description": "The SID attribute is a single-value attribute that specifies the security identifier (SID) of the group",
          "readOnly": true,
          "type": "string"
        }
      },
      "type": "object"
    },
    "Settings": {
      "allOf": [
        {
          "$ref": "#/definitions/ResourceWithEtag"
        },
        {
          "$ref": "#/definitions/SettingsKind"
        }
      ],
      "description": "The Setting.",
      "discriminator": "kind",
      "type": "object"
    },
    "SettingsKind": {
      "description": "Describes an Azure resource with kind.",
      "properties": {
        "kind": {
          "description": "The kind of the setting",
          "enum": [
            "UebaSettings",
            "ToggleSettings"
          ],
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "SettingKind"
          }
        }
      },
      "required": [
        "kind"
      ],
      "type": "object"
    },
    "TIDataConnector": {
      "allOf": [
        {
          "$ref": "#/definitions/DataConnector"
        }
      ],
      "description": "Represents threat intelligence data connector.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/TIDataConnectorProperties",
          "description": "TI (Threat Intelligence) data connector properties.",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "ThreatIntelligence"
    },
    "TIDataConnectorDataTypes": {
      "description": "The available data types for TI (Threat Intelligence) data connector.",
      "properties": {
        "indicators": {
          "allOf": [
            {
              "$ref": "#/definitions/DataConnectorDataTypeCommon"
            }
          ],
          "description": "Data type for indicators connection.",
          "type": "object"
        }
      },
      "type": "object"
    },
    "TIDataConnectorProperties": {
      "allOf": [
        {
          "$ref": "#/definitions/DataConnectorTenantId"
        }
      ],
      "description": "TI (Threat Intelligence) data connector properties.",
      "properties": {
        "dataTypes": {
          "$ref": "#/definitions/TIDataConnectorDataTypes",
          "description": "The available data types for the connector."
        }
      },
      "type": "object"
    },
    "ThreatIntelligence": {
      "description": "ThreatIntelligence property bag.",
      "properties": {
        "confidence": {
          "description": "Confidence (must be between 0 and 1)",
          "format": "double",
          "readOnly": true,
          "type": "number"
        },
        "providerName": {
          "description": "Name of the provider from whom this Threat Intelligence information was received",
          "readOnly": true,
          "type": "string"
        },
        "reportLink": {
          "description": "Report link",
          "readOnly": true,
          "type": "string"
        },
        "threatDescription": {
          "description": "Threat description (free text)",
          "readOnly": true,
          "type": "string"
        },
        "threatName": {
          "description": "Threat name (e.g. \"Jedobot malware\")",
          "readOnly": true,
          "type": "string"
        },
        "threatType": {
          "description": "Threat type (e.g. \"Botnet\")",
          "readOnly": true,
          "type": "string"
        }
      },
      "type": "object"
    },
    "ToggleSettings": {
      "allOf": [
        {
          "$ref": "#/definitions/Settings"
        }
      ],
      "description": "Settings with single toggle.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/ToggleSettingsProperties",
          "description": "toggle properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "ToggleSettings"
    },
    "ToggleSettingsProperties": {
      "description": "toggle property bag.",
      "properties": {
        "isEnabled": {
          "description": "Determines whether the setting is enable or disabled.",
          "type": "boolean"
        }
      },
      "type": "object"
    },
    "UebaSettings": {
      "allOf": [
        {
          "$ref": "#/definitions/Settings"
        }
      ],
      "description": "Represents settings for User and Entity Behavior Analytics enablement.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/UebaSettingsProperties",
          "description": "User and Entity Behavior Analytics settings properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "UebaSettings"
    },
    "UebaSettingsProperties": {
      "description": "User and Entity Behavior Analytics settings property bag.",
      "properties": {
        "atpLicenseStatus": {
          "description": "Determines whether the tenant has ATP (Advanced Threat Protection) license.",
          "enum": [
            "Enabled",
            "Disabled"
          ],
          "readOnly": true,
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "LicenseStatus"
          }
        },
        "isEnabled": {
          "description": "Determines whether User and Entity Behavior Analytics is enabled for this workspace.",
          "type": "boolean"
        },
        "statusInMcas": {
          "description": "Determines whether User and Entity Behavior Analytics is enabled from MCAS (Microsoft Cloud App Security).",
          "enum": [
            "Enabled",
            "Disabled"
          ],
          "readOnly": true,
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "StatusInMcas"
          }
        }
      },
      "type": "object"
    },
    "UrlEntity": {
      "allOf": [
        {
          "$ref": "#/definitions/Entity"
        }
      ],
      "description": "Represents a url entity.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/UrlEntityProperties",
          "description": "Url entity properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "Url"
    },
    "UrlEntityProperties": {
      "allOf": [
        {
          "$ref": "#/definitions/EntityCommonProperties"
        }
      ],
      "description": "Url entity property bag.",
      "properties": {
        "url": {
          "description": "A full URL the entity points to",
          "readOnly": true,
          "type": "string"
        }
      },
      "type": "object"
    },
    "UserInfo": {
      "description": "User information that made some action",
      "properties": {
        "email": {
          "description": "The email of the user.",
          "readOnly": true,
          "type": "string"
        },
        "name": {
          "description": "The name of the user.",
          "readOnly": true,
          "type": "string"
        },
        "objectId": {
          "description": "The object id of the user.",
          "format": "uuid",
          "type": "string",
          "x-nullable": true
        }
      },
      "required": [
        "objectId"
      ],
      "type": "object"
    }
  }
}