swagger: "2.0"
schemes:
  - https
host: management.azure.com
info:
  description: API spec for Microsoft.SecurityInsights (Azure Security Insights) resource provider
  title: Security Insights
  version: 2020-01-01
  x-apisguru-categories:
    - cloud
  x-logo:
    url: https://api.apis.guru/v2/cache/logo/https_assets.onestore.ms_cdnfiles_onestorerolling-1606-01000_shell_v3_images_logo_microsoft.png
  x-origin:
    - format: swagger
      url: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/master/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2020-01-01/SecurityInsights.json
      version: "2.0"
  x-preferred: true
  x-providerName: azure.com
  x-serviceName: securityinsights-SecurityInsights
  x-tags:
    - Azure
    - Microsoft
consumes:
  - application/json
produces:
  - application/json
securityDefinitions:
  azure_auth:
    authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
    description: Azure Active Directory OAuth2 Flow
    flow: implicit
    scopes:
      user_impersonation: impersonate your user account
    type: oauth2
security:
  - azure_auth:
      - user_impersonation
parameters:
  Action:
    description: The action
    in: body
    name: action
    required: true
    schema:
      $ref: "#/definitions/ActionRequest"
    x-ms-parameter-location: method
  ActionId:
    description: Action ID
    in: path
    name: actionId
    required: true
    type: string
    x-ms-parameter-location: method
  AggregationsName:
    description: The aggregation name. Supports - Cases
    in: path
    name: aggregationsName
    required: true
    type: string
    x-ms-parameter-location: method
  AlertRule:
    description: The alert rule
    in: body
    name: alertRule
    required: true
    schema:
      $ref: "#/definitions/AlertRule"
    x-ms-parameter-location: method
  AlertRuleTemplateId:
    description: Alert rule template ID
    in: path
    name: alertRuleTemplateId
    required: true
    type: string
    x-ms-parameter-location: method
  ApiVersion:
    description: API version for the operation
    enum:
      - 2020-01-01
    in: query
    name: api-version
    required: true
    type: string
  ConsentId:
    description: consent ID
    in: path
    name: consentId
    required: true
    type: string
    x-ms-parameter-location: method
  DataConnector:
    description: The data connector
    in: body
    name: dataConnector
    required: true
    schema:
      $ref: "#/definitions/DataConnector"
    x-ms-parameter-location: method
  DataConnectorId:
    description: Connector ID
    in: path
    name: dataConnectorId
    required: true
    type: string
    x-ms-parameter-location: method
  EntityId:
    description: entity ID
    in: path
    name: entityId
    required: true
    type: string
    x-ms-parameter-location: method
  EntityQueryId:
    description: entity query ID
    in: path
    name: entityQueryId
    required: true
    type: string
    x-ms-parameter-location: method
  ODataFilter:
    description: Filters the results, based on a Boolean condition. Optional.
    in: query
    name: $filter
    required: false
    type: string
    x-ms-parameter-location: method
  ODataOrderBy:
    description: Sorts the results. Optional.
    in: query
    name: $orderby
    required: false
    type: string
    x-ms-parameter-location: method
  ODataSkipToken:
    description: Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional.
    in: query
    name: $skipToken
    required: false
    type: string
    x-ms-parameter-location: method
  ODataTop:
    description: Returns only the first n results. Optional.
    format: int32
    in: query
    name: $top
    required: false
    type: integer
    x-ms-parameter-location: method
  ResourceGroupName:
    description: The name of the resource group within the user's subscription. The name is case insensitive.
    in: path
    maxLength: 90
    minLength: 1
    name: resourceGroupName
    pattern: ^[-\w\._\(\)]+$
    required: true
    type: string
    x-ms-parameter-location: method
  RuleId:
    description: Alert rule ID
    in: path
    name: ruleId
    required: true
    type: string
    x-ms-parameter-location: method
  Settings:
    description: The setting
    in: body
    name: settings
    required: true
    schema:
      $ref: "#/definitions/Settings"
    x-ms-parameter-location: method
  SettingsName:
    description: The setting name. Supports- Fusion, UEBA
    in: path
    name: settingsName
    required: true
    type: string
    x-ms-parameter-location: method
  SubscriptionId:
    description: Azure subscription ID
    in: path
    name: subscriptionId
    pattern: ^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$
    required: true
    type: string
  WorkspaceName:
    description: The name of the workspace.
    in: path
    maxLength: 90
    minLength: 1
    name: workspaceName
    required: true
    type: string
    x-ms-parameter-location: method
paths:
  /providers/Microsoft.SecurityInsights/operations:
    get:
      description: Lists all operations available Azure Security Insights Resource Provider.
      operationId: Operations_List
      parameters:
        - $ref: "#/parameters/ApiVersion"
      responses:
        "200":
          description: OK. Successfully retrieved operations list.
          schema:
            $ref: "#/definitions/OperationsList"
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: "#/definitions/CloudError"
      x-ms-pageable:
        nextLinkName: nextLink
  "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules":
    get:
      description: Gets all alert rules.
      operationId: AlertRules_List
      parameters:
        - $ref: "#/parameters/ApiVersion"
        - $ref: "#/parameters/SubscriptionId"
        - $ref: "#/parameters/ResourceGroupName"
        - $ref: "#/parameters/WorkspaceName"
      responses:
        "200":
          description: OK
          schema:
            $ref: "#/definitions/AlertRulesList"
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: "#/definitions/CloudError"
      tags:
        - Alert Rules
      x-ms-examples:
        Get all alert rules.:
          parameters:
            api-version: 2020-01-01
            operationalInsightsResourceProvider: Microsoft.OperationalIinsights
            resourceGroupName: myRg
            subscriptionId: d0cfe6b2-9ac0-4464-9919-dccaee2e48c0
            workspaceName: myWorkspace
          responses:
            "200":
              body:
                value:
                  - etag: '"0300bf09-0000-0000-0000-5c37296e0000"'
                    id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5
                    kind: Scheduled
                    name: 73e01a99-5cd7-4139-a149-9f2736ff2ab5
                    properties:
                      alertRuleTemplateName: null
                      description: ""
                      displayName: Rule2
                      enabled: true
                      lastModifiedUtc: 2019-01-01T13:15:30Z
                      query: ProtectionStatus | extend HostCustomEntity = Computer | extend IPCustomEntity = ComputerIP_Hidden
                      queryFrequency: PT1H
                      queryPeriod: P2DT1H30M
                      severity: High
                      suppressionDuration: PT1H
                      suppressionEnabled: false
                      tactics:
                        - Persistence
                        - LateralMovement
                      triggerOperator: GreaterThan
                      triggerThreshold: 0
                    type: Microsoft.SecurityInsights/alertRules
                  - etag: '"260097e0-0000-0d00-0000-5d6fa88f0000"'
                    id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/microsoftSecurityIncidentCreationRuleExample
                    kind: MicrosoftSecurityIncidentCreation
                    name: microsoftSecurityIncidentCreationRuleExample
                    properties:
                      alertRuleTemplateName: null
                      description: null
                      displayName: testing displayname
                      displayNamesFilter: null
                      enabled: true
                      lastModifiedUtc: 2019-09-04T12:05:35.7296311Z
                      productFilter: Microsoft Cloud App Security
                      severitiesFilter: null
                    type: Microsoft.SecurityInsights/alertRules
                  - etag: '"25005c11-0000-0d00-0000-5d6cc0e20000"'
                    id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/myFirstFusionRule
                    kind: Fusion
                    name: myFirstFusionRule
                    properties:
                      alertRuleTemplateName: f71aba3d-28fb-450b-b192-4e76a83015c8
                      description: |-
                        In this mode, Sentinel combines low fidelity alerts, which themselves may not be actionable, and events across multiple products, into high fidelity security interesting incidents. The system looks at multiple products to produce actionable incidents. Custom tailored to each tenant, Fusion not only reduces false positive rates but also can detect attacks with limited or missing information. 
                        Incidents generated by Fusion system will encase two or more alerts. By design, Fusion incidents are low volume, high fidelity and will be high severity, which is why Fusion is turned ON by default in Azure Sentinel.

                        For Fusion to work, please configure the following data sources in Data Connectors tab:
                        Required - Azure Active Directory Identity Protection
                        Required - Microsoft Cloud App Security
                        If Available - Palo Alto Network

                        For full list of scenarios covered by Fusion, and detail instructions on how to configure the required data sources, go to aka.ms/SentinelFusion
                      displayName: Advanced Multi-Stage Attack Detection
                      enabled: false
                      lastModifiedUtc: 2019-09-02T07:12:34.9065092Z
                      severity: High
                      tactics:
                        - Persistence
                        - LateralMovement
                        - Exfiltration
                        - CommandAndControl
                    type: Microsoft.SecurityInsights/alertRules
      x-ms-pageable:
        nextLinkName: nextLink
  "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules/{ruleId}":
    delete:
      description: Delete the alert rule.
      operationId: AlertRules_Delete
      parameters:
        - $ref: "#/parameters/ApiVersion"
        - $ref: "#/parameters/SubscriptionId"
        - $ref: "#/parameters/ResourceGroupName"
        - $ref: "#/parameters/WorkspaceName"
        - $ref: "#/parameters/RuleId"
      responses:
        "200":
          description: OK
        "204":
          description: No Content
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: "#/definitions/CloudError"
      tags:
        - Alert Rules
      x-ms-examples:
        Delete an alert rule.:
          parameters:
            api-version: 2020-01-01
            operationalInsightsResourceProvider: Microsoft.OperationalIinsights
            resourceGroupName: myRg
            ruleId: 73e01a99-5cd7-4139-a149-9f2736ff2ab5
            subscriptionId: d0cfe6b2-9ac0-4464-9919-dccaee2e48c0
            workspaceName: myWorkspace
          responses:
            "200": {}
            "204": {}
    get:
      description: Gets the alert rule.
      operationId: AlertRules_Get
      parameters:
        - $ref: "#/parameters/ApiVersion"
        - $ref: "#/parameters/SubscriptionId"
        - $ref: "#/parameters/ResourceGroupName"
        - $ref: "#/parameters/WorkspaceName"
        - $ref: "#/parameters/RuleId"
      responses:
        "200":
          description: OK
          schema:
            $ref: "#/definitions/AlertRule"
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: "#/definitions/CloudError"
      tags:
        - Alert Rules
      x-ms-examples:
        Get a Fusion alert rule.:
          parameters:
            api-version: 2020-01-01
            operationalInsightsResourceProvider: Microsoft.OperationalIinsights
            resourceGroupName: myRg
            ruleId: myFirstFusionRule
            subscriptionId: d0cfe6b2-9ac0-4464-9919-dccaee2e48c0
            workspaceName: myWorkspace
          responses:
            "200":
              body:
                etag: '"260090e2-0000-0d00-0000-5d6fb8670000"'
                id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/myFirstFusionRule
                kind: Fusion
                name: myFirstFusionRule
                properties:
                  alertRuleTemplateName: f71aba3d-28fb-450b-b192-4e76a83015c8
                  description: |-
                    In this mode, Sentinel combines low fidelity alerts, which themselves may not be actionable, and events across multiple products, into high fidelity security interesting incidents. The system looks at multiple products to produce actionable incidents. Custom tailored to each tenant, Fusion not only reduces false positive rates but also can detect attacks with limited or missing information. 
                    Incidents generated by Fusion system will encase two or more alerts. By design, Fusion incidents are low volume, high fidelity and will be high severity, which is why Fusion is turned ON by default in Azure Sentinel.

                    For Fusion to work, please configure the following data sources in Data Connectors tab:
                    Required - Azure Active Directory Identity Protection
                    Required - Microsoft Cloud App Security
                    If Available - Palo Alto Network

                    For full list of scenarios covered by Fusion, and detail instructions on how to configure the required data sources, go to aka.ms/SentinelFusion
                  displayName: Advanced Multi-Stage Attack Detection
                  enabled: true
                  lastModifiedUtc: 2019-09-04T13:13:11.5340061Z
                  severity: High
                  tactics:
                    - Persistence
                    - LateralMovement
                    - Exfiltration
                    - CommandAndControl
                type: Microsoft.SecurityInsights/alertRules
        Get a MicrosoftSecurityIncidentCreation rule.:
          parameters:
            api-version: 2020-01-01
            operationalInsightsResourceProvider: Microsoft.OperationalIinsights
            resourceGroupName: myRg
            ruleId: microsoftSecurityIncidentCreationRuleExample
            subscriptionId: d0cfe6b2-9ac0-4464-9919-dccaee2e48c0
            workspaceName: myWorkspace
          responses:
            "200":
              body:
                etag: '"260097e0-0000-0d00-0000-5d6fa88f0000"'
                id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/microsoftSecurityIncidentCreationRuleExample
                kind: MicrosoftSecurityIncidentCreation
                name: microsoftSecurityIncidentCreationRuleExample
                properties:
                  alertRuleTemplateName: null
                  description: null
                  displayName: testing displayname
                  displayNamesFilter: null
                  enabled: true
                  lastModifiedUtc: 2019-09-04T12:05:35.7296311Z
                  productFilter: Microsoft Cloud App Security
                  severitiesFilter: null
                type: Microsoft.SecurityInsights/alertRules
        Get a Scheduled alert rule.:
          parameters:
            api-version: 2020-01-01
            operationalInsightsResourceProvider: Microsoft.OperationalIinsights
            resourceGroupName: myRg
            ruleId: 73e01a99-5cd7-4139-a149-9f2736ff2ab5
            subscriptionId: d0cfe6b2-9ac0-4464-9919-dccaee2e48c0
            workspaceName: myWorkspace
          responses:
            "200":
              body:
                etag: '"0300bf09-0000-0000-0000-5c37296e0000"'
                id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5
                kind: Scheduled
                name: 73e01a99-5cd7-4139-a149-9f2736ff2ab5
                properties:
                  alertRuleTemplateName: null
                  description: ""
                  displayName: Rule2
                  enabled: true
                  lastModifiedUtc: 2019-01-01T13:15:30Z
                  query: ProtectionStatus | extend HostCustomEntity = Computer | extend IPCustomEntity = ComputerIP_Hidden
                  queryFrequency: PT1H
                  queryPeriod: P2DT1H30M
                  severity: High
                  suppressionDuration: PT1H
                  suppressionEnabled: false
                  tactics:
                    - Persistence
                    - LateralMovement
                  triggerOperator: GreaterThan
                  triggerThreshold: 0
                type: Microsoft.SecurityInsights/alertRules
    put:
      description: Creates or updates the alert rule.
      operationId: AlertRules_CreateOrUpdate
      parameters:
        - $ref: "#/parameters/ApiVersion"
        - $ref: "#/parameters/SubscriptionId"
        - $ref: "#/parameters/ResourceGroupName"
        - $ref: "#/parameters/WorkspaceName"
        - $ref: "#/parameters/RuleId"
        - $ref: "#/parameters/AlertRule"
      responses:
        "200":
          description: OK
          schema:
            $ref: "#/definitions/AlertRule"
        "201":
          description: Created
          schema:
            $ref: "#/definitions/AlertRule"
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: "#/definitions/CloudError"
      tags:
        - Alert Rules
      x-ms-examples:
        Creates or updates a Fusion alert rule.:
          parameters:
            alertRule:
              etag: 3d00c3ca-0000-0100-0000-5d42d5010000
              kind: Fusion
              properties:
                alertRuleTemplateName: f71aba3d-28fb-450b-b192-4e76a83015c8
                enabled: "true"
            api-version: 2020-01-01
            operationalInsightsResourceProvider: Microsoft.OperationalInsights
            resourceGroupName: myRg
            ruleId: myFirstFusionRule
            subscriptionId: d0cfe6b2-9ac0-4464-9919-dccaee2e48c0
            workspaceName: myWorkspace
          responses:
            "200":
              body:
                etag: '"260090e2-0000-0d00-0000-5d6fb8670000"'
                id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/myFirstFusionRule
                kind: Fusion
                name: myFirstFusionRule
                properties:
                  alertRuleTemplateName: f71aba3d-28fb-450b-b192-4e76a83015c8
                  description: |-
                    In this mode, Sentinel combines low fidelity alerts, which themselves may not be actionable, and events across multiple products, into high fidelity security interesting incidents. The system looks at multiple products to produce actionable incidents. Custom tailored to each tenant, Fusion not only reduces false positive rates but also can detect attacks with limited or missing information. 
                    Incidents generated by Fusion system will encase two or more alerts. By design, Fusion incidents are low volume, high fidelity and will be high severity, which is why Fusion is turned ON by default in Azure Sentinel.

                    For Fusion to work, please configure the following data sources in Data Connectors tab:
                    Required - Azure Active Directory Identity Protection
                    Required - Microsoft Cloud App Security
                    If Available - Palo Alto Network

                    For full list of scenarios covered by Fusion, and detail instructions on how to configure the required data sources, go to aka.ms/SentinelFusion
                  displayName: Advanced Multi-Stage Attack Detection
                  enabled: true
                  lastModifiedUtc: 2019-09-04T13:13:11.5340061Z
                  severity: High
                  tactics:
                    - Persistence
                    - LateralMovement
                    - Exfiltration
                    - CommandAndControl
                type: Microsoft.SecurityInsights/alertRules
            "201":
              body:
                etag: '"260090e2-0000-0d00-0000-5d6fb8670000"'
                id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/myFirstFusionRule
                kind: Fusion
                name: myFirstFusionRule
                properties:
                  alertRuleTemplateName: f71aba3d-28fb-450b-b192-4e76a83015c8
                  description: |-
                    In this mode, Sentinel combines low fidelity alerts, which themselves may not be actionable, and events across multiple products, into high fidelity security interesting incidents. The system looks at multiple products to produce actionable incidents. Custom tailored to each tenant, Fusion not only reduces false positive rates but also can detect attacks with limited or missing information. 
                    Incidents generated by Fusion system will encase two or more alerts. By design, Fusion incidents are low volume, high fidelity and will be high severity, which is why Fusion is turned ON by default in Azure Sentinel.

                    For Fusion to work, please configure the following data sources in Data Connectors tab:
                    Required - Azure Active Directory Identity Protection
                    Required - Microsoft Cloud App Security
                    If Available - Palo Alto Network

                    For full list of scenarios covered by Fusion, and detail instructions on how to configure the required data sources, go to aka.ms/SentinelFusion
                  displayName: Advanced Multi-Stage Attack Detection
                  enabled: true
                  lastModifiedUtc: 2019-09-04T13:13:11.5340061Z
                  severity: High
                  tactics:
                    - Persistence
                    - LateralMovement
                    - Exfiltration
                    - CommandAndControl
                type: Microsoft.SecurityInsights/alertRules
        Creates or updates a MicrosoftSecurityIncidentCreation rule.:
          parameters:
            alertRule:
              etag: '"260097e0-0000-0d00-0000-5d6fa88f0000"'
              kind: MicrosoftSecurityIncidentCreation
              properties:
                displayName: testing displayname
                enabled: true
                productFilter: Microsoft Cloud App Security
            api-version: 2020-01-01
            operationalInsightsResourceProvider: Microsoft.OperationalInsights
            resourceGroupName: myRg
            ruleId: microsoftSecurityIncidentCreationRuleExample
            subscriptionId: d0cfe6b2-9ac0-4464-9919-dccaee2e48c0
            workspaceName: myWorkspace
          responses:
            "200":
              body:
                etag: '"260097e0-0000-0d00-0000-5d6fa88f0000"'
                id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/microsoftSecurityIncidentCreationRuleExample
                kind: MicrosoftSecurityIncidentCreation
                name: microsoftSecurityIncidentCreationRuleExample
                properties:
                  alertRuleTemplateName: null
                  description: null
                  displayName: testing displayname
                  displayNamesFilter: null
                  enabled: true
                  lastModifiedUtc: 2019-09-04T12:05:35.7296311Z
                  productFilter: Microsoft Cloud App Security
                  severitiesFilter: null
                type: Microsoft.SecurityInsights/alertRules
            "201":
              body:
                etag: '"260097e0-0000-0d00-0000-5d6fa88f0000"'
                id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/microsoftSecurityIncidentCreationRuleExample
                kind: MicrosoftSecurityIncidentCreation
                name: microsoftSecurityIncidentCreationRuleExample
                properties:
                  alertRuleTemplateName: null
                  description: null
                  displayName: testing displayname
                  displayNamesFilter: null
                  enabled: true
                  lastModifiedUtc: 2019-09-04T12:05:35.7296311Z
                  productFilter: Microsoft Cloud App Security
                  severitiesFilter: null
                type: Microsoft.SecurityInsights/alertRules
        Creates or updates a Scheduled alert rule.:
          parameters:
            alertRule:
              etag: '"0300bf09-0000-0000-0000-5c37296e0000"'
              kind: Scheduled
              properties:
                description: ""
                displayName: Rule2
                enabled: true
                query: ProtectionStatus | extend HostCustomEntity = Computer | extend IPCustomEntity = ComputerIP_Hidden
                queryFrequency: PT1H
                queryPeriod: P2DT1H30M
                severity: High
                suppressionDuration: PT1H
                suppressionEnabled: false
                tactics:
                  - Persistence
                  - LateralMovement
                triggerOperator: GreaterThan
                triggerThreshold: 0
            api-version: 2020-01-01
            operationalInsightsResourceProvider: Microsoft.OperationalInsights
            resourceGroupName: myRg
            ruleId: 73e01a99-5cd7-4139-a149-9f2736ff2ab5
            subscriptionId: d0cfe6b2-9ac0-4464-9919-dccaee2e48c0
            workspaceName: myWorkspace
          responses:
            "200":
              body:
                etag: '"0300bf09-0000-0000-0000-5c37296e0000"'
                id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5
                kind: Scheduled
                name: 73e01a99-5cd7-4139-a149-9f2736ff2ab5
                properties:
                  alertRuleTemplateName: null
                  description: ""
                  displayName: Rule2
                  enabled: true
                  lastModifiedUtc: 2019-01-01T13:15:30Z
                  query: ProtectionStatus | extend HostCustomEntity = Computer | extend IPCustomEntity = ComputerIP_Hidden
                  queryFrequency: PT1H
                  queryPeriod: P2DT1H30M
                  severity: High
                  suppressionDuration: PT1H
                  suppressionEnabled: false
                  tactics:
                    - Persistence
                    - LateralMovement
                  triggerOperator: GreaterThan
                  triggerThreshold: 0
                type: Microsoft.SecurityInsights/alertRules
            "201":
              body:
                etag: '"0300bf09-0000-0000-0000-5c37296e0000"'
                id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5
                kind: Scheduled
                name: 73e01a99-5cd7-4139-a149-9f2736ff2ab5
                properties:
                  alertRuleTemplateName: null
                  description: ""
                  displayName: Rule2
                  enabled: true
                  lastModifiedUtc: 2019-01-01T13:15:30Z
                  query: ProtectionStatus | extend HostCustomEntity = Computer | extend IPCustomEntity = ComputerIP_Hidden
                  queryFrequency: PT1H
                  queryPeriod: P2DT1H30M
                  severity: High
                  suppressionDuration: PT1H
                  suppressionEnabled: false
                  tactics:
                    - Persistence
                    - LateralMovement
                  triggerOperator: GreaterThan
                  triggerThreshold: 0
                type: Microsoft.SecurityInsights/alertRules
  "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules/{ruleId}/actions":
    get:
      description: Gets all actions of alert rule.
      operationId: Actions_ListByAlertRule
      parameters:
        - $ref: "#/parameters/ApiVersion"
        - $ref: "#/parameters/SubscriptionId"
        - $ref: "#/parameters/ResourceGroupName"
        - $ref: "#/parameters/WorkspaceName"
        - $ref: "#/parameters/RuleId"
      responses:
        "200":
          description: OK
          schema:
            $ref: "#/definitions/ActionsList"
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: "#/definitions/CloudError"
      tags:
        - Actions
      x-ms-examples:
        Get all actions of alert rule.:
          parameters:
            api-version: 2020-01-01
            operationalInsightsResourceProvider: Microsoft.OperationalIinsights
            resourceGroupName: myRg
            ruleId: 73e01a99-5cd7-4139-a149-9f2736ff2ab5
            subscriptionId: d0cfe6b2-9ac0-4464-9919-dccaee2e48c0
            workspaceName: myWorkspace
          responses:
            "200":
              body:
                value:
                  - etag: '"0300bf09-0000-0000-0000-5c37296e0000"'
                    id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5/actions/912bec42-cb66-4c03-ac63-1761b6898c3e
                    name: 912bec42-cb66-4c03-ac63-1761b6898c3e
                    properties:
                      logicAppResourceId: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.Logic/workflows/MyAlerts
                      workflowId: cd3765391efd48549fd7681ded1d48d7
                    type: Microsoft.SecurityInsights/alertRules/actions
      x-ms-pageable:
        nextLinkName: nextLink
  "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules/{ruleId}/actions/{actionId}":
    delete:
      description: Delete the action of alert rule.
      operationId: AlertRules_DeleteAction
      parameters:
        - $ref: "#/parameters/ApiVersion"
        - $ref: "#/parameters/SubscriptionId"
        - $ref: "#/parameters/ResourceGroupName"
        - $ref: "#/parameters/WorkspaceName"
        - $ref: "#/parameters/RuleId"
        - $ref: "#/parameters/ActionId"
      responses:
        "200":
          description: OK
        "204":
          description: No Content
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: "#/definitions/CloudError"
      tags:
        - Actions
      x-ms-examples:
        Delete an action of alert rule.:
          parameters:
            actionId: 912bec42-cb66-4c03-ac63-1761b6898c3e
            api-version: 2020-01-01
            operationalInsightsResourceProvider: Microsoft.OperationalIinsights
            resourceGroupName: myRg
            ruleId: 73e01a99-5cd7-4139-a149-9f2736ff2ab5
            subscriptionId: d0cfe6b2-9ac0-4464-9919-dccaee2e48c0
            workspaceName: myWorkspace
          responses:
            "200": {}
            "204": {}
    get:
      description: Gets the action of alert rule.
      operationId: AlertRules_GetAction
      parameters:
        - $ref: "#/parameters/ApiVersion"
        - $ref: "#/parameters/SubscriptionId"
        - $ref: "#/parameters/ResourceGroupName"
        - $ref: "#/parameters/WorkspaceName"
        - $ref: "#/parameters/RuleId"
        - $ref: "#/parameters/ActionId"
      responses:
        "200":
          description: OK
          schema:
            $ref: "#/definitions/ActionResponse"
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: "#/definitions/CloudError"
      tags:
        - Actions
      x-ms-examples:
        Get an action of alert rule.:
          parameters:
            actionId: 912bec42-cb66-4c03-ac63-1761b6898c3e
            api-version: 2020-01-01
            operationalInsightsResourceProvider: Microsoft.OperationalIinsights
            resourceGroupName: myRg
            ruleId: 73e01a99-5cd7-4139-a149-9f2736ff2ab5
            subscriptionId: d0cfe6b2-9ac0-4464-9919-dccaee2e48c0
            workspaceName: myWorkspace
          responses:
            "200":
              body:
                etag: '"0300bf09-0000-0000-0000-5c37296e0000"'
                id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5/actions/912bec42-cb66-4c03-ac63-1761b6898c3e
                name: 912bec42-cb66-4c03-ac63-1761b6898c3e
                properties:
                  logicAppResourceId: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.Logic/workflows/MyAlerts
                  workflowId: cd3765391efd48549fd7681ded1d48d7
                type: Microsoft.SecurityInsights/alertRules/actions
    put:
      description: Creates or updates the action of alert rule.
      operationId: AlertRules_CreateOrUpdateAction
      parameters:
        - $ref: "#/parameters/ApiVersion"
        - $ref: "#/parameters/SubscriptionId"
        - $ref: "#/parameters/ResourceGroupName"
        - $ref: "#/parameters/WorkspaceName"
        - $ref: "#/parameters/RuleId"
        - $ref: "#/parameters/ActionId"
        - $ref: "#/parameters/Action"
      responses:
        "200":
          description: OK
          schema:
            $ref: "#/definitions/ActionResponse"
        "201":
          description: Created
          schema:
            $ref: "#/definitions/ActionResponse"
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: "#/definitions/CloudError"
      tags:
        - Actions
      x-ms-examples:
        Creates or updates an action of alert rule.:
          parameters:
            action:
              etag: '"0300bf09-0000-0000-0000-5c37296e0000"'
              id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5/actions/912bec42-cb66-4c03-ac63-1761b6898c3e
              name: 912bec42-cb66-4c03-ac63-1761b6898c3e
              properties:
                logicAppResourceId: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.Logic/workflows/MyAlerts
                triggerUri: https://prod-31.northcentralus.logic.azure.com:443/workflows/cd3765391efd48549fd7681ded1d48d7/triggers/manual/paths/invoke?api-version=2016-10-01&sp=%2Ftriggers%2Fmanual%2Frun&sv=1.0&sig=signature
              type: Microsoft.SecurityInsights/alertRules/actions
            actionId: 912bec42-cb66-4c03-ac63-1761b6898c3e
            api-version: 2020-01-01
            operationalInsightsResourceProvider: Microsoft.OperationalInsights
            resourceGroupName: myRg
            ruleId: 73e01a99-5cd7-4139-a149-9f2736ff2ab5
            subscriptionId: d0cfe6b2-9ac0-4464-9919-dccaee2e48c0
            workspaceName: myWorkspace
          responses:
            "200":
              body:
                etag: '"0300bf09-0000-0000-0000-5c37296e0000"'
                id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5/actions/912bec42-cb66-4c03-ac63-1761b6898c3e
                name: 912bec42-cb66-4c03-ac63-1761b6898c3e
                properties:
                  logicAppResourceId: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.Logic/workflows/MyAlerts
                  workflowId: cd3765391efd48549fd7681ded1d48d7
                type: Microsoft.SecurityInsights/alertRules/actions
            "201":
              body:
                etag: '"0300bf09-0000-0000-0000-5c37296e0000"'
                id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5/actions/912bec42-cb66-4c03-ac63-1761b6898c3e
                name: 912bec42-cb66-4c03-ac63-1761b6898c3e
                properties:
                  logicAppResourceId: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.Logic/workflows/MyAlerts
                  workflowId: cd3765391efd48549fd7681ded1d48d7
                type: Microsoft.SecurityInsights/alertRules/actions
  "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors":
    get:
      description: Gets all data connectors.
      operationId: DataConnectors_List
      parameters:
        - $ref: "#/parameters/ApiVersion"
        - $ref: "#/parameters/SubscriptionId"
        - $ref: "#/parameters/ResourceGroupName"
        - $ref: "#/parameters/WorkspaceName"
      responses:
        "200":
          description: OK
          schema:
            $ref: "#/definitions/DataConnectorList"
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: "#/definitions/CloudError"
      tags:
        - Data Connectors
      x-ms-examples:
        Get all data connectors.:
          parameters:
            api-version: 2020-01-01
            operationalInsightsResourceProvider: Microsoft.OperationalInsights
            resourceGroupName: myRg
            subscriptionId: d0cfe6b2-9ac0-4464-9919-dccaee2e48c0
            workspaceName: myWorkspace
          responses:
            "200":
              body:
                value:
                  - etag: '"0300bf09-0000-0000-0000-5c37296e0000"'
                    id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/763f9fa1-c2d3-4fa2-93e9-bccd4899aa12
                    kind: AzureSecurityCenter
                    name: 763f9fa1-c2d3-4fa2-93e9-bccd4899aa12
                    properties:
                      dataTypes:
                        alerts:
                          state: Enabled
                      subscriptionId: d0cfe6b2-9ac0-4464-9919-dccaee2e48c0
                    type: Microsoft.SecurityInsights/dataConnectors
                  - etag: '"0300bf09-0000-0000-0000-5c37296e0000"'
                    id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/c345bf40-8509-4ed2-b947-50cb773aaf04
                    kind: ThreatIntelligence
                    name: c345bf40-8509-4ed2-b947-50cb773aaf04
                    properties:
                      dataTypes:
                        indicators:
                          state: Enabled
                      tenantId: 2070ecc9-b4d5-4ae4-adaa-936fa1954fa8
                    type: Microsoft.SecurityInsights/dataConnectors
                  - etag: '"0300bf09-0000-0000-0000-5c37296e0000"'
                    id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/f0cd27d2-5f03-4c06-ba31-d2dc82dcb51d
                    kind: AzureActiveDirectory
                    name: f0cd27d2-5f03-4c06-ba31-d2dc82dcb51d
                    properties:
                      dataTypes:
                        alerts:
                          state: Enabled
                      tenantId: 2070ecc9-b4d5-4ae4-adaa-936fa1954fa8
                    type: Microsoft.SecurityInsights/dataConnectors
                  - etag: '"0300bf09-0000-0000-0000-5c37296e0000"'
                    id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/73e01a99-5cd7-4139-a149-9f2736ff2ab5
                    kind: Office365
                    name: 73e01a99-5cd7-4139-a149-9f2736ff2ab5
                    properties:
                      dataTypes:
                        exchange:
                          state: Enabled
                        sharePoint:
                          state: Enabled
                      tenantId: 2070ecc9-b4d5-4ae4-adaa-936fa1954fa8
                    type: Microsoft.SecurityInsights/dataConnectors
                  - etag: '"0300bf09-0000-0000-0000-5c37296e0000"'
                    id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/b96d014d-b5c2-4a01-9aba-a8058f629d42
                    kind: MicrosoftCloudAppSecurity
                    name: b96d014d-b5c2-4a01-9aba-a8058f629d42
                    properties:
                      dataTypes:
                        alerts:
                          state: Enabled
                        discoveryLogs:
                          state: Enabled
                      tenantId: 2070ecc9-b4d5-4ae4-adaa-936fa1954fa8
                    type: Microsoft.SecurityInsights/dataConnectors
                  - etag: '"0300bf09-0000-0000-0000-5c37296e0000"'
                    id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/07e42cb3-e658-4e90-801c-efa0f29d3d44
                    kind: AzureAdvancedThreatProtection
                    name: 07e42cb3-e658-4e90-801c-efa0f29d3d44
                    properties:
                      dataTypes:
                        alerts:
                          state: Enabled
                      tenantId: 2070ecc9-b4d5-4ae4-adaa-936fa1954fa8
                    type: Microsoft.SecurityInsights/dataConnectors
                  - etag: '"0300bf09-0000-0000-0000-5c37296e0000"'
                    id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/c345bf40-8509-4ed2-b947-50cb773aaf04
                    kind: AmazonWebServicesCloudTrail
                    name: c345bf40-8509-4ed2-b947-50cb773aaf04
                    properties:
                      awsRoleArn: myAwsRoleArn
                      dataTypes:
                        logs:
                          state: Enabled
                    type: Microsoft.SecurityInsights/dataConnectors
                  - etag: '"0300bf09-0000-0000-0000-5c37296e0000"'
                    id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/06b3ccb8-1384-4bcc-aec7-852f6d57161b
                    kind: MicrosoftDefenderAdvancedThreatProtection
                    name: 06b3ccb8-1384-4bcc-aec7-852f6d57161b
                    properties:
                      dataTypes:
                        alerts:
                          state: Enabled
                      tenantId: 2070ecc9-b4d5-4ae4-adaa-936fa1954fa8
                    type: Microsoft.SecurityInsights/dataConnectors
      x-ms-pageable:
        nextLinkName: nextLink
  "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors/{dataConnectorId}":
    delete:
      description: Delete the data connector.
      operationId: DataConnectors_Delete
      parameters:
        - $ref: "#/parameters/ApiVersion"
        - $ref: "#/parameters/SubscriptionId"
        - $ref: "#/parameters/ResourceGroupName"
        - $ref: "#/parameters/WorkspaceName"
        - $ref: "#/parameters/DataConnectorId"
      responses:
        "200":
          description: OK
        "204":
          description: No Content
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: "#/definitions/CloudError"
      tags:
        - Data Connectors
      x-ms-examples:
        Delete an Office365 data connector.:
          parameters:
            api-version: 2020-01-01
            dataConnectorId: 73e01a99-5cd7-4139-a149-9f2736ff2ab5
            operationalInsightsResourceProvider: Microsoft.OperationalIinsights
            resourceGroupName: myRg
            subscriptionId: d0cfe6b2-9ac0-4464-9919-dccaee2e48c0
            workspaceName: myWorkspace
          responses:
            "200": {}
            "204": {}
    get:
      description: Gets a data connector.
      operationId: DataConnectors_Get
      parameters:
        - $ref: "#/parameters/ApiVersion"
        - $ref: "#/parameters/SubscriptionId"
        - $ref: "#/parameters/ResourceGroupName"
        - $ref: "#/parameters/WorkspaceName"
        - $ref: "#/parameters/DataConnectorId"
      responses:
        "200":
          description: OK
          schema:
            $ref: "#/definitions/DataConnector"
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: "#/definitions/CloudError"
      tags:
        - Data Connectors
      x-ms-examples:
        Get a ASC data connector.:
          parameters:
            api-version: 2020-01-01
            dataConnectorId: 763f9fa1-c2d3-4fa2-93e9-bccd4899aa12
            operationalInsightsResourceProvider: Microsoft.OperationalIinsights
            resourceGroupName: myRg
            subscriptionId: d0cfe6b2-9ac0-4464-9919-dccaee2e48c0
            workspaceName: myWorkspace
          responses:
            "200":
              body:
                etag: '"0300bf09-0000-0000-0000-5c37296e0000"'
                id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/763f9fa1-c2d3-4fa2-93e9-bccd4899aa12
                kind: AzureSecurityCenter
                name: 763f9fa1-c2d3-4fa2-93e9-bccd4899aa12
                properties:
                  dataTypes:
                    alerts:
                      state: Enabled
                  subscriptionId: c0688291-89d7-4bed-87a2-a7b1bff43f4c
                type: Microsoft.SecurityInsights/dataConnectors
        Get a MCAS data connector.:
          parameters:
            api-version: 2020-01-01
            dataConnectorId: b96d014d-b5c2-4a01-9aba-a8058f629d42
            operationalInsightsResourceProvider: Microsoft.OperationalInsights
            resourceGroupName: myRg
            subscriptionId: d0cfe6b2-9ac0-4464-9919-dccaee2e48c0
            workspaceName: myWorkspace
          responses:
            "200":
              body:
                etag: '"0300bf09-0000-0000-0000-5c37296e0000"'
                id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/b96d014d-b5c2-4a01-9aba-a8058f629d42
                kind: MicrosoftCloudAppSecurity
                name: b96d014d-b5c2-4a01-9aba-a8058f629d42
                properties:
                  dataTypes:
                    alerts:
                      state: Enabled
                    discoveryLogs:
                      state: Enabled
                  tenantId: 2070ecc9-b4d5-4ae4-adaa-936fa1954fa8
                type: Microsoft.SecurityInsights/dataConnectors
        Get a MDATP data connector:
          parameters:
            api-version: 2020-01-01
            dataConnectorId: 06b3ccb8-1384-4bcc-aec7-852f6d57161b
            operationalInsightsResourceProvider: Microsoft.OperationalInsights
            resourceGroupName: myRg
            subscriptionId: d0cfe6b2-9ac0-4464-9919-dccaee2e48c0
            workspaceName: myWorkspace
          responses:
            "200":
              body:
                etag: '"0300bf09-0000-0000-0000-5c37296e0000"'
                id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/06b3ccb8-1384-4bcc-aec7-852f6d57161b
                kind: MicrosoftDefenderAdvancedThreatProtection
                name: 06b3ccb8-1384-4bcc-aec7-852f6d57161b
                properties:
                  dataTypes:
                    alerts:
                      state: Enabled
                  tenantId: 2070ecc9-b4d5-4ae4-adaa-936fa1954fa8
                type: Microsoft.SecurityInsights/dataConnectors
        Get a TI data connector.:
          parameters:
            api-version: 2020-01-01
            dataConnectorId: c345bf40-8509-4ed2-b947-50cb773aaf04
            operationalInsightsResourceProvider: Microsoft.OperationalIinsights
            resourceGroupName: myRg
            subscriptionId: d0cfe6b2-9ac0-4464-9919-dccaee2e48c0
            workspaceName: myWorkspace
          responses:
            "200":
              body:
                etag: '"0300bf09-0000-0000-0000-5c37296e0000"'
                id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/c345bf40-8509-4ed2-b947-50cb773aaf04
                kind: ThreatIntelligence
                name: c345bf40-8509-4ed2-b947-50cb773aaf04
                properties:
                  dataTypes:
                    indicators:
                      state: Enabled
                  tenantId: 2070ecc9-b4d5-4ae4-adaa-936fa1954fa8
                type: Microsoft.SecurityInsights/dataConnectors
        Get an AAD data connector.:
          parameters:
            api-version: 2020-01-01
            dataConnectorId: f0cd27d2-5f03-4c06-ba31-d2dc82dcb51d
            operationalInsightsResourceProvider: Microsoft.OperationalIinsights
            resourceGroupName: myRg
            subscriptionId: d0cfe6b2-9ac0-4464-9919-dccaee2e48c0
            workspaceName: myWorkspace
          responses:
            "200":
              body:
                etag: '"0300bf09-0000-0000-0000-5c37296e0000"'
                id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/f0cd27d2-5f03-4c06-ba31-d2dc82dcb51d
                kind: AzureActiveDirectory
                name: f0cd27d2-5f03-4c06-ba31-d2dc82dcb51d
                properties:
                  dataTypes:
                    alerts:
                      state: Enabled
                  tenantId: 2070ecc9-b4d5-4ae4-adaa-936fa1954fa8
                type: Microsoft.SecurityInsights/dataConnectors
        Get an AATP data connector.:
          parameters:
            api-version: 2020-01-01
            dataConnectorId: 07e42cb3-e658-4e90-801c-efa0f29d3d44
            operationalInsightsResourceProvider: Microsoft.OperationalInsights
            resourceGroupName: myRg
            subscriptionId: d0cfe6b2-9ac0-4464-9919-dccaee2e48c0
            workspaceName: myWorkspace
          responses:
            "200":
              body:
                etag: '"0300bf09-0000-0000-0000-5c37296e0000"'
                id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/07e42cb3-e658-4e90-801c-efa0f29d3d44
                kind: AzureAdvancedThreatProtection
                name: 07e42cb3-e658-4e90-801c-efa0f29d3d44
                properties:
                  dataTypes:
                    alerts:
                      state: Enabled
                  tenantId: 2070ecc9-b4d5-4ae4-adaa-936fa1954fa8
                type: Microsoft.SecurityInsights/dataConnectors
        Get an AwsCloudTrail data connector.:
          parameters:
            api-version: 2020-01-01
            dataConnectorId: c345bf40-8509-4ed2-b947-50cb773aaf04
            operationalInsightsResourceProvider: Microsoft.OperationalInsights
            resourceGroupName: myRg
            subscriptionId: d0cfe6b2-9ac0-4464-9919-dccaee2e48c0
            workspaceName: myWorkspace
          responses:
            "200":
              body:
                etag: '"0300bf09-0000-0000-0000-5c37296e0000"'
                id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/c345bf40-8509-4ed2-b947-50cb773aaf04
                kind: AmazonWebServicesCloudTrail
                name: c345bf40-8509-4ed2-b947-50cb773aaf04
                properties:
                  awsRoleArn: myAwsRoleArn
                  dataTypes:
                    logs:
                      state: Enabled
                type: Microsoft.SecurityInsights/dataConnectors
        Get an Office365 data connector.:
          parameters:
            api-version: 2020-01-01
            dataConnectorId: 73e01a99-5cd7-4139-a149-9f2736ff2ab5
            operationalInsightsResourceProvider: Microsoft.OperationalIinsights
            resourceGroupName: myRg
            subscriptionId: d0cfe6b2-9ac0-4464-9919-dccaee2e48c0
            workspaceName: myWorkspace
          responses:
            "200":
              body:
                etag: '"0300bf09-0000-0000-0000-5c37296e0000"'
                id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/73e01a99-5cd7-4139-a149-9f2736ff2ab5
                kind: Office365
                name: 73e01a99-5cd7-4139-a149-9f2736ff2ab5
                properties:
                  dataTypes:
                    exchange:
                      state: Enabled
                    sharePoint:
                      state: Enabled
                  tenantId: 2070ecc9-b4d5-4ae4-adaa-936fa1954fa8
                type: Microsoft.SecurityInsights/dataConnectors
    put:
      description: Creates or updates the data connector.
      operationId: DataConnectors_CreateOrUpdate
      parameters:
        - $ref: "#/parameters/ApiVersion"
        - $ref: "#/parameters/SubscriptionId"
        - $ref: "#/parameters/ResourceGroupName"
        - $ref: "#/parameters/WorkspaceName"
        - $ref: "#/parameters/DataConnectorId"
        - $ref: "#/parameters/DataConnector"
      responses:
        "200":
          description: OK
          schema:
            $ref: "#/definitions/DataConnector"
        "201":
          description: Created
          schema:
            $ref: "#/definitions/DataConnector"
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: "#/definitions/CloudError"
      tags:
        - Data Connectors
      x-ms-examples:
        Creates or updates an Office365 data connector.:
          parameters:
            api-version: 2020-01-01
            dataConnector:
              etag: '"0300bf09-0000-0000-0000-5c37296e0000"'
              id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/73e01a99-5cd7-4139-a149-9f2736ff2ab5
              kind: Office365
              name: 73e01a99-5cd7-4139-a149-9f2736ff2ab5
              properties:
                dataTypes:
                  exchange:
                    state: Enabled
                  sharePoint:
                    state: Enabled
                tenantId: 2070ecc9-b4d5-4ae4-adaa-936fa1954fa8
              type: Microsoft.SecurityInsights/dataConnectors
            dataConnectorId: 73e01a99-5cd7-4139-a149-9f2736ff2ab5
            operationalInsightsResourceProvider: Microsoft.OperationalInsights
            resourceGroupName: myRg
            subscriptionId: d0cfe6b2-9ac0-4464-9919-dccaee2e48c0
            workspaceName: myWorkspace
          responses:
            "200":
              body:
                etag: '"0300bf09-0000-0000-0000-5c37296e0000"'
                id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/73e01a99-5cd7-4139-a149-9f2736ff2ab5
                kind: Office365
                name: 73e01a99-5cd7-4139-a149-9f2736ff2ab5
                properties:
                  dataTypes:
                    exchange:
                      state: Enabled
                    sharePoint:
                      state: Enabled
                  tenantId: 2070ecc9-b4d5-4ae4-adaa-936fa1954fa8
                type: Microsoft.SecurityInsights/dataConnectors
            "201":
              body:
                etag: '"0300bf09-0000-0000-0000-5c37296e0000"'
                id: /subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/73e01a99-5cd7-4139-a149-9f2736ff2ab5
                kind: Office365
                name: 73e01a99-5cd7-4139-a149-9f2736ff2ab5
                properties:
                  dataTypes:
                    exchange:
                      state: Enabled
                    sharePoint:
                      state: Enabled
                  tenantId: 2070ecc9-b4d5-4ae4-adaa-936fa1954fa8
                type: Microsoft.SecurityInsights/dataConnectors
definitions:
  AADDataConnector:
    allOf:
      - $ref: "#/definitions/DataConnector"
    description: Represents AAD (Azure Active Directory) data connector.
    properties:
      properties:
        $ref: "#/definitions/AADDataConnectorProperties"
        description: AAD (Azure Active Directory) data connector properties.
        x-ms-client-flatten: true
    type: object
    x-ms-discriminator-value: AzureActiveDirectory
  AADDataConnectorProperties:
    allOf:
      - $ref: "#/definitions/DataConnectorTenantId"
      - $ref: "#/definitions/DataConnectorWithAlertsProperties"
    description: AAD (Azure Active Directory) data connector properties.
    type: object
  AATPDataConnector:
    allOf:
      - $ref: "#/definitions/DataConnector"
    description: Represents AATP (Azure Advanced Threat Protection) data connector.
    properties:
      properties:
        $ref: "#/definitions/AATPDataConnectorProperties"
        description: AATP (Azure Advanced Threat Protection) data connector properties.
        x-ms-client-flatten: true
    type: object
    x-ms-discriminator-value: AzureAdvancedThreatProtection
  AATPDataConnectorProperties:
    allOf:
      - $ref: "#/definitions/DataConnectorTenantId"
      - $ref: "#/definitions/DataConnectorWithAlertsProperties"
    description: AATP (Azure Advanced Threat Protection) data connector properties.
    type: object
  ASCDataConnector:
    allOf:
      - $ref: "#/definitions/DataConnector"
    description: Represents ASC (Azure Security Center) data connector.
    properties:
      properties:
        $ref: "#/definitions/ASCDataConnectorProperties"
        description: ASC (Azure Security Center) data connector properties.
        x-ms-client-flatten: true
    type: object
    x-ms-discriminator-value: AzureSecurityCenter
  ASCDataConnectorProperties:
    allOf:
      - $ref: "#/definitions/DataConnectorWithAlertsProperties"
    description: ASC (Azure Security Center) data connector properties.
    properties:
      subscriptionId:
        description: The subscription id to connect to, and get the data from.
        type: string
    type: object
  ActionPropertiesBase:
    description: Action property bag base.
    properties:
      logicAppResourceId:
        description: Logic App Resource Id, providers/Microsoft.Logic/workflows/{WorkflowID}.
        type: string
    required:
      - logicAppResourceId
    type: object
  ActionRequest:
    allOf:
      - $ref: "#/definitions/ResourceWithEtag"
    description: Action for alert rule.
    properties:
      properties:
        $ref: "#/definitions/ActionRequestProperties"
        description: Action properties for put request
        x-ms-client-flatten: true
    type: object
  ActionRequestProperties:
    allOf:
      - $ref: "#/definitions/ActionPropertiesBase"
    description: Action property bag.
    properties:
      triggerUri:
        description: Logic App Callback URL for this specific workflow.
        type: string
    type: object
  ActionResponse:
    allOf:
      - $ref: "#/definitions/Resource"
    description: Action for alert rule.
    properties:
      etag:
        description: Etag of the action.
        type: string
      properties:
        $ref: "#/definitions/ActionResponseProperties"
        description: Action properties for get request
        x-ms-client-flatten: true
    type: object
  ActionResponseProperties:
    allOf:
      - $ref: "#/definitions/ActionPropertiesBase"
    description: Action property bag.
    properties:
      workflowId:
        description: The name of the logic app's workflow.
        type: string
    type: object
  ActionsList:
    description: List all the actions.
    properties:
      nextLink:
        description: URL to fetch the next set of actions.
        readOnly: true
        type: string
      value:
        description: Array of actions.
        items:
          $ref: "#/definitions/ActionResponse"
        type: array
    required:
      - value
  AlertRule:
    allOf:
      - $ref: "#/definitions/ResourceWithEtag"
      - $ref: "#/definitions/AlertRuleKind"
    description: Alert rule.
    discriminator: kind
    required:
      - kind
    type: object
  AlertRuleKind:
    description: Describes an Azure resource with kind.
    properties:
      kind:
        description: The kind of the alert rule
        enum:
          - Scheduled
          - MicrosoftSecurityIncidentCreation
          - Fusion
        type: string
        x-ms-enum:
          modelAsString: true
          name: AlertRuleKind
          values:
            - value: Scheduled
            - value: MicrosoftSecurityIncidentCreation
            - value: Fusion
    required:
      - kind
    type: object
  AlertRuleTemplate:
    allOf:
      - $ref: "#/definitions/Resource"
      - $ref: "#/definitions/AlertRuleKind"
    description: Alert rule template.
    discriminator: kind
    required:
      - kind
    type: object
  AlertRuleTemplateDataSource:
    description: alert rule template data sources
    properties:
      connectorId:
        description: The connector id that provides the following data types
        type: string
      dataTypes:
        description: The data types used by the alert rule template
        items:
          type: string
        type: array
    type: object
  AlertRuleTemplatePropertiesBase:
    description: Base alert rule template property bag.
    properties:
      alertRulesCreatedByTemplateCount:
        description: the number of alert rules that were created by this template
        type: integer
      createdDateUTC:
        description: The time that this alert rule template has been added.
        format: date-time
        readOnly: true
        type: string
      description:
        description: The description of the alert rule template.
        type: string
      displayName:
        description: The display name for alert rule template.
        type: string
      requiredDataConnectors:
        description: The required data connectors for this template
        items:
          $ref: "#/definitions/AlertRuleTemplateDataSource"
        type: array
      status:
        description: The alert rule template status.
        enum:
          - Installed
          - Available
          - NotAvailable
        type: string
        x-ms-enum:
          modelAsString: true
          name: TemplateStatus
          values:
            - description: Alert rule template installed. and can not use more then once
              value: Installed
            - description: Alert rule template is available.
              value: Available
            - description: Alert rule template is not available
              value: NotAvailable
    type: object
  AlertRuleTriggerOperator:
    description: The operation against the threshold that triggers alert rule.
    enum:
      - GreaterThan
      - LessThan
      - Equal
      - NotEqual
    type: string
    x-ms-enum:
      modelAsString: false
      name: TriggerOperator
  AlertRulesList:
    description: List all the alert rules.
    properties:
      nextLink:
        description: URL to fetch the next set of alert rules.
        readOnly: true
        type: string
      value:
        description: Array of alert rules.
        items:
          $ref: "#/definitions/AlertRule"
        type: array
    required:
      - value
  AlertSeverity:
    description: The severity of the alert
    enum:
      - High
      - Medium
      - Low
      - Informational
    type: string
    x-ms-enum:
      modelAsString: true
      name: AlertSeverity
      values:
        - description: High severity
          value: High
        - description: Medium severity
          value: Medium
        - description: Low severity
          value: Low
        - description: Informational severity
          value: Informational
  AlertsDataTypeOfDataConnector:
    description: Alerts data type for data connectors.
    properties:
      alerts:
        allOf:
          - $ref: "#/definitions/DataConnectorDataTypeCommon"
        description: Alerts data type connection.
        type: object
    type: object
  AttackTactic:
    description: The severity for alerts created by this alert rule.
    enum:
      - InitialAccess
      - Execution
      - Persistence
      - PrivilegeEscalation
      - DefenseEvasion
      - CredentialAccess
      - Discovery
      - LateralMovement
      - Collection
      - Exfiltration
      - CommandAndControl
      - Impact
    type: string
    x-ms-enum:
      modelAsString: true
      name: AttackTactic
  AwsCloudTrailDataConnector:
    allOf:
      - $ref: "#/definitions/DataConnector"
    description: Represents Amazon Web Services CloudTrail data connector.
    properties:
      properties:
        $ref: "#/definitions/AwsCloudTrailDataConnectorProperties"
        description: Amazon Web Services CloudTrail data connector properties.
        x-ms-client-flatten: true
    type: object
    x-ms-discriminator-value: AmazonWebServicesCloudTrail
  AwsCloudTrailDataConnectorDataTypes:
    description: The available data types for Amazon Web Services CloudTrail data connector.
    properties:
      logs:
        allOf:
          - $ref: "#/definitions/DataConnectorDataTypeCommon"
        description: Logs data type.
        type: object
    type: object
  AwsCloudTrailDataConnectorProperties:
    description: Amazon Web Services CloudTrail data connector properties.
    properties:
      awsRoleArn:
        description: The Aws Role Arn (with CloudTrailReadOnly policy) that is used to access the Aws account.
        type: string
      dataTypes:
        $ref: "#/definitions/AwsCloudTrailDataConnectorDataTypes"
        description: The available data types for the connector.
    type: object
  CloudError:
    description: Error response structure.
    properties:
      error:
        $ref: "#/definitions/CloudErrorBody"
        description: Error data
        x-ms-client-flatten: true
    type: object
    x-ms-external: true
  CloudErrorBody:
    description: Error details.
    properties:
      code:
        description: An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
        readOnly: true
        type: string
      message:
        description: A message describing the error, intended to be suitable for display in a user interface.
        readOnly: true
        type: string
    type: object
    x-ms-external: true
  DataConnector:
    allOf:
      - $ref: "#/definitions/ResourceWithEtag"
      - $ref: "#/definitions/DataConnectorKind"
    description: Data connector.
    discriminator: kind
    required:
      - kind
    type: object
  DataConnectorDataTypeCommon:
    description: Common field for data type in data connectors.
    properties:
      state:
        description: Describe whether this data type connection is enabled or not.
        enum:
          - Enabled
          - Disabled
        type: string
        x-ms-enum:
          modelAsString: true
          name: DataTypeState
    type: object
  DataConnectorKind:
    description: Describes an Azure resource with kind.
    properties:
      kind:
        description: The kind of the data connector
        enum:
          - AzureActiveDirectory
          - AzureSecurityCenter
          - MicrosoftCloudAppSecurity
          - ThreatIntelligence
          - Office365
          - AmazonWebServicesCloudTrail
          - AzureAdvancedThreatProtection
          - MicrosoftDefenderAdvancedThreatProtection
        type: string
        x-ms-enum:
          modelAsString: true
          name: DataConnectorKind
          values:
            - value: AzureActiveDirectory
            - value: AzureSecurityCenter
            - value: MicrosoftCloudAppSecurity
            - value: ThreatIntelligence
            - value: Office365
            - value: AmazonWebServicesCloudTrail
            - value: AzureAdvancedThreatProtection
            - value: MicrosoftDefenderAdvancedThreatProtection
    type: object
  DataConnectorList:
    description: List all the data connectors.
    properties:
      nextLink:
        description: URL to fetch the next set of data connectors.
        readOnly: true
        type: string
      value:
        description: Array of data connectors.
        items:
          $ref: "#/definitions/DataConnector"
        type: array
    required:
      - value
  DataConnectorTenantId:
    description: Properties data connector on tenant level.
    properties:
      tenantId:
        description: The tenant id to connect to, and get the data from.
        type: string
    type: object
  DataConnectorWithAlertsProperties:
    description: Data connector properties.
    properties:
      dataTypes:
        $ref: "#/definitions/AlertsDataTypeOfDataConnector"
        description: The available data types for the connector.
    type: object
  FusionAlertRule:
    allOf:
      - $ref: "#/definitions/AlertRule"
    description: Represents Fusion alert rule.
    properties:
      properties:
        $ref: "#/definitions/FusionAlertRuleProperties"
        description: Fusion alert rule properties
        x-ms-client-flatten: true
    type: object
    x-ms-discriminator-value: Fusion
  FusionAlertRuleProperties:
    description: Fusion alert rule base property bag.
    properties:
      alertRuleTemplateName:
        description: The Name of the alert rule template used to create this rule.
        type: string
      description:
        description: The description of the alert rule.
        readOnly: true
        type: string
      displayName:
        description: The display name for alerts created by this alert rule.
        readOnly: true
        type: string
      enabled:
        description: Determines whether this alert rule is enabled or disabled.
        type: boolean
      lastModifiedUtc:
        description: The last time that this alert has been modified.
        format: date-time
        readOnly: true
        type: string
      severity:
        $ref: "#/definitions/AlertSeverity"
        description: The severity for alerts created by this alert rule.
        readOnly: true
      tactics:
        description: The tactics of the alert rule
        items:
          $ref: "#/definitions/AttackTactic"
        readOnly: true
        type: array
    required:
      - alertRuleTemplateName
      - enabled
    type: object
  FusionAlertRuleTemplate:
    allOf:
      - $ref: "#/definitions/AlertRuleTemplate"
    description: Represents Fusion alert rule template.
    properties:
      properties:
        allOf:
          - $ref: "#/definitions/AlertRuleTemplatePropertiesBase"
        description: Fusion alert rule template properties
        properties:
          severity:
            $ref: "#/definitions/AlertSeverity"
            description: The severity for alerts created by this alert rule.
          tactics:
            description: The tactics of the alert rule template
            items:
              $ref: "#/definitions/AttackTactic"
            type: array
        required:
          - displayName
          - description
          - status
          - severity
          - alertRulesCreatedByTemplateCount
        x-ms-client-flatten: true
    type: object
    x-ms-discriminator-value: Fusion
  IncidentInfo:
    description: Describes related incident information for the bookmark
    properties:
      incidentId:
        description: Incident Id
        type: string
      relationName:
        description: Relation Name
        type: string
      severity:
        description: The severity of the incident
        enum:
          - Critical
          - High
          - Medium
          - Low
          - Informational
        type: string
        x-ms-enum:
          modelAsString: true
          name: IncidentSeverity
          values:
            - description: Critical severity
              value: Critical
            - description: High severity
              value: High
            - description: Medium severity
              value: Medium
            - description: Low severity
              value: Low
            - description: Informational severity
              value: Informational
      title:
        description: The title of the incident
        type: string
    required:
      - incidentId
      - severity
      - title
      - relationName
    type: object
  Label:
    description: Label that will be used to tag and filter on.
    type: string
  MCASDataConnector:
    allOf:
      - $ref: "#/definitions/DataConnector"
    description: Represents MCAS (Microsoft Cloud App Security) data connector.
    properties:
      properties:
        $ref: "#/definitions/MCASDataConnectorProperties"
        description: MCAS (Microsoft Cloud App Security) data connector properties.
        x-ms-client-flatten: true
    type: object
    x-ms-discriminator-value: MicrosoftCloudAppSecurity
  MCASDataConnectorDataTypes:
    allOf:
      - $ref: "#/definitions/AlertsDataTypeOfDataConnector"
    description: The available data types for MCAS (Microsoft Cloud App Security) data connector.
    properties:
      discoveryLogs:
        allOf:
          - $ref: "#/definitions/DataConnectorDataTypeCommon"
        description: Discovery log data type connection.
        type: object
    type: object
  MCASDataConnectorProperties:
    allOf:
      - $ref: "#/definitions/DataConnectorTenantId"
    description: MCAS (Microsoft Cloud App Security) data connector properties.
    properties:
      dataTypes:
        $ref: "#/definitions/MCASDataConnectorDataTypes"
        description: The available data types for the connector.
    type: object
  MDATPDataConnector:
    allOf:
      - $ref: "#/definitions/DataConnector"
    description: Represents MDATP (Microsoft Defender Advanced Threat Protection) data connector.
    properties:
      properties:
        $ref: "#/definitions/MDATPDataConnectorProperties"
        description: MDATP (Microsoft Defender Advanced Threat Protection) data connector properties.
        x-ms-client-flatten: true
    type: object
    x-ms-discriminator-value: MicrosoftDefenderAdvancedThreatProtection
  MDATPDataConnectorProperties:
    allOf:
      - $ref: "#/definitions/DataConnectorTenantId"
      - $ref: "#/definitions/DataConnectorWithAlertsProperties"
    description: MDATP (Microsoft Defender Advanced Threat Protection) data connector properties.
    type: object
  MicrosoftSecurityIncidentCreationAlertRule:
    allOf:
      - $ref: "#/definitions/AlertRule"
    description: Represents MicrosoftSecurityIncidentCreation rule.
    properties:
      properties:
        $ref: "#/definitions/MicrosoftSecurityIncidentCreationAlertRuleProperties"
        description: MicrosoftSecurityIncidentCreation rule properties
        x-ms-client-flatten: true
    type: object
    x-ms-discriminator-value: MicrosoftSecurityIncidentCreation
  MicrosoftSecurityIncidentCreationAlertRuleCommonProperties:
    description: MicrosoftSecurityIncidentCreation rule common property bag.
    properties:
      displayNamesFilter:
        description: the alerts' displayNames on which the cases will be generated
        items:
          type: string
        type: array
      productFilter:
        description: The alerts' productName on which the cases will be generated
        enum:
          - Microsoft Cloud App Security
          - Azure Security Center
          - Azure Advanced Threat Protection
          - Azure Active Directory Identity Protection
          - Azure Security Center for IoT
        type: string
        x-ms-enum:
          modelAsString: true
          name: MicrosoftSecurityProductName
      severitiesFilter:
        description: the alerts' severities on which the cases will be generated
        items:
          $ref: "#/definitions/AlertSeverity"
        type: array
    required:
      - productFilter
    type: object
  MicrosoftSecurityIncidentCreationAlertRuleProperties:
    allOf:
      - $ref: "#/definitions/MicrosoftSecurityIncidentCreationAlertRuleCommonProperties"
    description: MicrosoftSecurityIncidentCreation rule property bag.
    properties:
      alertRuleTemplateName:
        description: The Name of the alert rule template used to create this rule.
        type: string
      description:
        description: The description of the alert rule.
        type: string
      displayName:
        description: The display name for alerts created by this alert rule.
        type: string
      enabled:
        description: Determines whether this alert rule is enabled or disabled.
        type: boolean
      lastModifiedUtc:
        description: The last time that this alert has been modified.
        format: date-time
        readOnly: true
        type: string
    required:
      - displayName
      - enabled
      - productFilter
    type: object
  MicrosoftSecurityIncidentCreationAlertRuleTemplate:
    allOf:
      - $ref: "#/definitions/AlertRuleTemplate"
    description: Represents MicrosoftSecurityIncidentCreation rule template.
    properties:
      properties:
        allOf:
          - $ref: "#/definitions/AlertRuleTemplatePropertiesBase"
          - $ref: "#/definitions/MicrosoftSecurityIncidentCreationAlertRuleCommonProperties"
        description: MicrosoftSecurityIncidentCreation rule template properties
        required:
          - displayName
          - description
          - createdDateUTC
          - status
          - alertRulesCreatedByTemplateCount
          - productFilter
        x-ms-client-flatten: true
    type: object
    x-ms-discriminator-value: MicrosoftSecurityIncidentCreation
  OfficeConsent:
    allOf:
      - $ref: "#/definitions/Resource"
    description: Consent for Office365 tenant that already made.
    properties:
      properties:
        $ref: "#/definitions/OfficeConsentProperties"
        description: Office consent properties
        x-ms-client-flatten: true
    type: object
  OfficeConsentList:
    description: List of all the office365 consents.
    properties:
      nextLink:
        description: URL to fetch the next set of office consents.
        readOnly: true
        type: string
      value:
        description: Array of the consents.
        items:
          $ref: "#/definitions/OfficeConsent"
        type: array
    required:
      - value
  OfficeConsentProperties:
    description: Consent property bag.
    properties:
      tenantId:
        description: The tenantId of the Office365 with the consent.
        type: string
      tenantName:
        description: The tenant name of the Office365 with the consent.
        readOnly: true
        type: string
    type: object
  OfficeDataConnector:
    allOf:
      - $ref: "#/definitions/DataConnector"
    description: Represents office data connector.
    properties:
      properties:
        $ref: "#/definitions/OfficeDataConnectorProperties"
        description: Office data connector properties.
        x-ms-client-flatten: true
    type: object
    x-ms-discriminator-value: Office365
  OfficeDataConnectorDataTypes:
    description: The available data types for office data connector.
    properties:
      exchange:
        allOf:
          - $ref: "#/definitions/DataConnectorDataTypeCommon"
        description: Exchange data type connection.
        type: object
      sharePoint:
        allOf:
          - $ref: "#/definitions/DataConnectorDataTypeCommon"
        description: SharePoint data type connection.
        type: object
    type: object
  OfficeDataConnectorProperties:
    allOf:
      - $ref: "#/definitions/DataConnectorTenantId"
    description: Office data connector properties.
    properties:
      dataTypes:
        $ref: "#/definitions/OfficeDataConnectorDataTypes"
        description: The available data types for the connector.
    type: object
  Operation:
    description: Operation provided by provider
    properties:
      display:
        description: Properties of the operation
        properties:
          description:
            description: Description of the operation
            type: string
          operation:
            description: Operation name
            type: string
          provider:
            description: Provider name
            type: string
          resource:
            description: Resource name
            type: string
        type: object
      name:
        description: Name of the operation
        type: string
  OperationsList:
    description: Lists the operations available in the SecurityInsights RP.
    properties:
      nextLink:
        description: URL to fetch the next set of operations.
        type: string
      value:
        description: Array of operations
        items:
          $ref: "#/definitions/Operation"
        type: array
    required:
      - value
  Resource:
    description: An azure resource object
    properties:
      id:
        description: Azure resource Id
        readOnly: true
        type: string
      name:
        description: Azure resource name
        readOnly: true
        type: string
      type:
        description: Azure resource type
        readOnly: true
        type: string
    x-ms-azure-resource: true
  ResourceWithEtag:
    description: An azure resource object with an Etag property
    properties:
      etag:
        description: Etag of the azure resource
        type: string
      id:
        description: Azure resource Id
        readOnly: true
        type: string
      name:
        description: Azure resource name
        readOnly: true
        type: string
      type:
        description: Azure resource type
        readOnly: true
        type: string
    x-ms-azure-resource: true
  ScheduledAlertRule:
    allOf:
      - $ref: "#/definitions/AlertRule"
    description: Represents scheduled alert rule.
    properties:
      properties:
        $ref: "#/definitions/ScheduledAlertRuleProperties"
        description: Scheduled alert rule properties
        x-ms-client-flatten: true
    type: object
    x-ms-discriminator-value: Scheduled
  ScheduledAlertRuleCommonProperties:
    description: Schedule alert rule template property bag.
    properties:
      query:
        description: The query that creates alerts for this rule.
        type: string
      queryFrequency:
        description: The frequency (in ISO 8601 duration format) for this alert rule to run.
        format: duration
        type: string
      queryPeriod:
        description: The period (in ISO 8601 duration format) that this alert rule looks at.
        format: duration
        type: string
      severity:
        $ref: "#/definitions/AlertSeverity"
        description: The severity for alerts created by this alert rule.
      triggerOperator:
        $ref: "#/definitions/AlertRuleTriggerOperator"
        description: The operation against the threshold that triggers alert rule.
      triggerThreshold:
        description: The threshold triggers this alert rule.
        type: integer
    type: object
  ScheduledAlertRuleProperties:
    allOf:
      - $ref: "#/definitions/ScheduledAlertRuleCommonProperties"
    description: Scheduled alert rule base property bag.
    properties:
      alertRuleTemplateName:
        description: The Name of the alert rule template used to create this rule.
        type: string
      description:
        description: The description of the alert rule.
        type: string
      displayName:
        description: The display name for alerts created by this alert rule.
        type: string
      enabled:
        description: Determines whether this alert rule is enabled or disabled.
        type: boolean
      lastModifiedUtc:
        description: The last time that this alert rule has been modified.
        format: date-time
        readOnly: true
        type: string
      suppressionDuration:
        description: The suppression (in ISO 8601 duration format) to wait since last time this alert rule been triggered.
        format: duration
        type: string
      suppressionEnabled:
        description: Determines whether the suppression for this alert rule is enabled or disabled.
        type: boolean
      tactics:
        description: The tactics of the alert rule
        items:
          $ref: "#/definitions/AttackTactic"
        type: array
    required:
      - displayName
      - enabled
      - severity
      - query
      - queryFrequency
      - queryPeriod
      - triggerOperator
      - triggerThreshold
      - suppressionEnabled
      - suppressionDuration
    type: object
  ScheduledAlertRuleTemplate:
    allOf:
      - $ref: "#/definitions/AlertRuleTemplate"
    description: Represents scheduled alert rule template.
    properties:
      properties:
        allOf:
          - $ref: "#/definitions/AlertRuleTemplatePropertiesBase"
          - $ref: "#/definitions/ScheduledAlertRuleCommonProperties"
        description: Scheduled alert rule template properties
        properties:
          tactics:
            description: The tactics of the alert rule template
            items:
              $ref: "#/definitions/AttackTactic"
            type: array
        required:
          - displayName
          - description
          - status
          - alertRulesCreatedByTemplateCount
          - severity
          - query
          - queryFrequency
          - queryPeriod
          - triggerOperator
          - triggerThreshold
        x-ms-client-flatten: true
    type: object
    x-ms-discriminator-value: Scheduled
  Settings:
    allOf:
      - $ref: "#/definitions/ResourceWithEtag"
      - $ref: "#/definitions/SettingsKind"
    description: The Setting.
    discriminator: kind
    required:
      - kind
    type: object
  SettingsKind:
    description: Describes an Azure resource with kind.
    properties:
      kind:
        description: The kind of the setting
        enum:
          - UebaSettings
          - ToggleSettings
        type: string
        x-ms-enum:
          modelAsString: true
          name: SettingKind
    type: object
  TIDataConnector:
    allOf:
      - $ref: "#/definitions/DataConnector"
    description: Represents threat intelligence data connector.
    properties:
      properties:
        $ref: "#/definitions/TIDataConnectorProperties"
        description: TI (Threat Intelligence) data connector properties.
        x-ms-client-flatten: true
    type: object
    x-ms-discriminator-value: ThreatIntelligence
  TIDataConnectorDataTypes:
    description: The available data types for TI (Threat Intelligence) data connector.
    properties:
      indicators:
        allOf:
          - $ref: "#/definitions/DataConnectorDataTypeCommon"
        description: Data type for indicators connection.
        type: object
    type: object
  TIDataConnectorProperties:
    allOf:
      - $ref: "#/definitions/DataConnectorTenantId"
    description: TI (Threat Intelligence) data connector properties.
    properties:
      dataTypes:
        $ref: "#/definitions/TIDataConnectorDataTypes"
        description: The available data types for the connector.
    type: object
  ThreatIntelligence:
    description: ThreatIntelligence property bag.
    properties:
      confidence:
        description: Confidence (must be between 0 and 1)
        format: double
        readOnly: true
        type: number
      providerName:
        description: Name of the provider from whom this Threat Intelligence information was received
        readOnly: true
        type: string
      reportLink:
        description: Report link
        readOnly: true
        type: string
      threatDescription:
        description: Threat description (free text)
        readOnly: true
        type: string
      threatName:
        description: Threat name (e.g. "Jedobot malware")
        readOnly: true
        type: string
      threatType:
        description: Threat type (e.g. "Botnet")
        readOnly: true
        type: string
    type: object
  ToggleSettings:
    allOf:
      - $ref: "#/definitions/Settings"
    description: Settings with single toggle.
    properties:
      properties:
        $ref: "#/definitions/ToggleSettingsProperties"
        description: toggle properties
        x-ms-client-flatten: true
    type: object
    x-ms-discriminator-value: ToggleSettings
  ToggleSettingsProperties:
    description: toggle property bag.
    properties:
      isEnabled:
        description: Determines whether the setting is enable or disabled.
        type: boolean
    type: object
  UebaSettings:
    allOf:
      - $ref: "#/definitions/Settings"
    description: Represents settings for User and Entity Behavior Analytics enablement.
    properties:
      properties:
        $ref: "#/definitions/UebaSettingsProperties"
        description: User and Entity Behavior Analytics settings properties
        x-ms-client-flatten: true
    type: object
    x-ms-discriminator-value: UebaSettings
  UebaSettingsProperties:
    description: User and Entity Behavior Analytics settings property bag.
    properties:
      atpLicenseStatus:
        description: Determines whether the tenant has ATP (Advanced Threat Protection) license.
        enum:
          - Enabled
          - Disabled
        readOnly: true
        type: string
        x-ms-enum:
          modelAsString: true
          name: LicenseStatus
      isEnabled:
        description: Determines whether User and Entity Behavior Analytics is enabled for this workspace.
        type: boolean
      statusInMcas:
        description: Determines whether User and Entity Behavior Analytics is enabled from MCAS (Microsoft Cloud App Security).
        enum:
          - Enabled
          - Disabled
        readOnly: true
        type: string
        x-ms-enum:
          modelAsString: true
          name: StatusInMcas
    type: object
  UserInfo:
    description: User information that made some action
    properties:
      email:
        description: The email of the user.
        readOnly: true
        type: string
      name:
        description: The name of the user.
        readOnly: true
        type: string
      objectId:
        description: The object id of the user.
        format: uuid
        type: string
        x-nullable: true
    required:
      - objectId
    type: object
