Skip to content

Commit 027b259

Browse files
anat-gilensonanat-gilenson
committed
New version for incidents and updated examples - team colaboration
1 parent bb04b4b commit 027b259

File tree

5 files changed

+216
-21
lines changed

5 files changed

+216
-21
lines changed

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/Incidents.json‎

Lines changed: 185 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -243,6 +243,57 @@
243243
}
244244
}
245245
},
246+
"/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/createTeam": {
247+
"post": {
248+
"x-ms-examples": {
249+
"Creates incident teams group.": {
250+
"$ref": "./examples/incidents/CreateTeam.json"
251+
}
252+
},
253+
"tags": [
254+
"IncidentTeam"
255+
],
256+
"description": "Creates a Microsoft team to investigate the incident by sharing information and insights between participants.",
257+
"operationId": "Incidents_CreateTeam",
258+
"parameters": [
259+
{
260+
"$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
261+
},
262+
{
263+
"$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/SubscriptionIdParameter"
264+
},
265+
{
266+
"$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ResourceGroupNameParameter"
267+
},
268+
{
269+
"$ref": "../../../common/1.0/types.json#/parameters/OperationalInsightsResourceProvider"
270+
},
271+
{
272+
"$ref": "../../../common/1.0/types.json#/parameters/WorkspaceName"
273+
},
274+
{
275+
"$ref": "#/parameters/IncidentId"
276+
},
277+
{
278+
"$ref": "#/parameters/TeamProperties"
279+
}
280+
],
281+
"responses": {
282+
"200": {
283+
"description": "OK",
284+
"schema": {
285+
"$ref": "#/definitions/TeamInformation"
286+
}
287+
},
288+
"default": {
289+
"description": "Error response describing why the operation failed.",
290+
"schema": {
291+
"$ref": "../../../common/1.0/types.json#/definitions/CloudError"
292+
}
293+
}
294+
}
295+
}
296+
},
246297
"/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/alerts": {
247298
"post": {
248299
"x-ms-examples": {
@@ -254,7 +305,7 @@
254305
"IncidentAlerts"
255306
],
256307
"description": "Gets all incident alerts.",
257-
"operationId": "Incidents_ListOfAlerts",
308+
"operationId": "Incidents_ListAlerts",
258309
"parameters": [
259310
{
260311
"$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
@@ -302,7 +353,7 @@
302353
"IncidentBookmarks"
303354
],
304355
"description": "Gets all incident bookmarks.",
305-
"operationId": "Incidents_ListOfBookmarks",
356+
"operationId": "Incidents_ListBookmarks",
306357
"parameters": [
307358
{
308359
"$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
@@ -350,7 +401,7 @@
350401
"IncidentComments"
351402
],
352403
"description": "Gets all incident comments.",
353-
"operationId": "IncidentComments_ListByIncident",
404+
"operationId": "IncidentComments_List",
354405
"parameters": [
355406
{
356407
"$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
@@ -414,7 +465,7 @@
414465
"IncidentComments"
415466
],
416467
"description": "Gets an incident comment.",
417-
"operationId": "IncidentComments_GetComment",
468+
"operationId": "IncidentComments_Get",
418469
"parameters": [
419470
{
420471
"$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
@@ -463,7 +514,7 @@
463514
"IncidentComments"
464515
],
465516
"description": "Creates or updates the incident comment.",
466-
"operationId": "IncidentComments_CreateComment",
517+
"operationId": "IncidentComments_CreateOrUpdate",
467518
"parameters": [
468519
{
469520
"$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
@@ -521,7 +572,7 @@
521572
"IncidentComments"
522573
],
523574
"description": "Delete the incident comment.",
524-
"operationId": "IncidentComments_DeleteComment",
575+
"operationId": "IncidentComments_Delete",
525576
"parameters": [
526577
{
527578
"$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
@@ -572,7 +623,7 @@
572623
"IncidentEntities"
573624
],
574625
"description": "Gets all incident related entities.",
575-
"operationId": "Incidents_ListOfEntities",
626+
"operationId": "Incidents_ListEntities",
576627
"parameters": [
577628
{
578629
"$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
@@ -684,7 +735,7 @@
684735
"IncidentRelations"
685736
],
686737
"description": "Gets an incident relation.",
687-
"operationId": "IncidentRelations_GetRelation",
738+
"operationId": "IncidentRelations_Get",
688739
"parameters": [
689740
{
690741
"$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
@@ -733,7 +784,7 @@
733784
"IncidentRelations"
734785
],
735786
"description": "Creates or updates the incident relation.",
736-
"operationId": "IncidentRelations_CreateOrUpdateRelation",
787+
"operationId": "IncidentRelations_CreateOrUpdate",
737788
"parameters": [
738789
{
739790
"$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
@@ -791,7 +842,7 @@
791842
"IncidentRelations"
792843
],
793844
"description": "Delete the incident relation.",
794-
"operationId": "IncidentRelations_DeleteRelation",
845+
"operationId": "IncidentRelations_Delete",
795846
"parameters": [
796847
{
797848
"$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
@@ -889,7 +940,7 @@
889940
"type": "boolean"
890941
},
891942
"ntDomain": {
892-
"description": "The NetBIOS domain name as it appears in the alert format – domain\\username. Examples: NT AUTHORITY.",
943+
"description": "The NetBIOS domain name as it appears in the alert format domain\\username. Examples: NT AUTHORITY.",
893944
"readOnly": true,
894945
"type": "string"
895946
},
@@ -1244,7 +1295,7 @@
12441295
"Entity": {
12451296
"allOf": [
12461297
{
1247-
"$ref": "../../../../../common-types/resource-management/v2/types.json#/definitions/Resource"
1298+
"$ref": "../../../common/1.0/types.json#/definitions/Resource"
12481299
}
12491300
],
12501301
"properties": {
@@ -1865,7 +1916,8 @@
18651916
},
18661917
"required": [
18671918
"value"
1868-
]
1919+
],
1920+
"type": "object"
18691921
},
18701922
"IncidentBookmarkList": {
18711923
"description": "List of incident bookmarks.",
@@ -1880,7 +1932,8 @@
18801932
},
18811933
"required": [
18821934
"value"
1883-
]
1935+
],
1936+
"type": "object"
18841937
},
18851938
"IncidentComment": {
18861939
"allOf": [
@@ -1916,7 +1969,8 @@
19161969
},
19171970
"required": [
19181971
"value"
1919-
]
1972+
],
1973+
"type": "object"
19201974
},
19211975
"IncidentCommentProperties": {
19221976
"description": "Incident comment property bag.",
@@ -1966,7 +2020,8 @@
19662020
"$ref": "#/definitions/IncidentEntitiesResultsMetadata"
19672021
}
19682022
}
1969-
}
2023+
},
2024+
"type": "object"
19702025
},
19712026
"IncidentEntitiesResultsMetadata": {
19722027
"description": "Information of a specific aggregation in the incident related entities result.",
@@ -2031,6 +2086,11 @@
20312086
]
20322087
}
20332088
},
2089+
"teamInformation": {
2090+
"$ref": "#/definitions/TeamInformation",
2091+
"description": "Describes a team for the incident",
2092+
"type": "object"
2093+
},
20342094
"title": {
20352095
"description": "The title of the incident",
20362096
"type": "string"
@@ -2096,7 +2156,8 @@
20962156
},
20972157
"required": [
20982158
"value"
2099-
]
2159+
],
2160+
"type": "object"
21002161
},
21012162
"IncidentOwnerInfo": {
21022163
"description": "Information on the user an incident is assigned to",
@@ -2117,6 +2178,34 @@
21172178
"userPrincipalName": {
21182179
"description": "The user principal name of the user the incident is assigned to.",
21192180
"type": "string"
2181+
},
2182+
"ownerType": {
2183+
"readOnly": true,
2184+
"description": "The type of the owner the incident is assigned to.",
2185+
"type": "string",
2186+
"enum": [
2187+
"Unknown",
2188+
"User",
2189+
"Group"
2190+
],
2191+
"x-ms-enum": {
2192+
"modelAsString": true,
2193+
"name": "OwnerType",
2194+
"values": [
2195+
{
2196+
"description": "The incident owner type is unknown",
2197+
"value": "Unknown"
2198+
},
2199+
{
2200+
"description": "The incident owner type is an AAD user",
2201+
"value": "User"
2202+
},
2203+
{
2204+
"description": "The incident owner type is an AAD group",
2205+
"value": "Group"
2206+
}
2207+
]
2208+
}
21202209
}
21212210
},
21222211
"type": "object"
@@ -3327,7 +3416,8 @@
33273416
},
33283417
"required": [
33293418
"value"
3330-
]
3419+
],
3420+
"type": "object"
33313421
},
33323422
"RelationProperties": {
33333423
"description": "Relation property bag.",
@@ -3887,6 +3977,73 @@
38873977
},
38883978
"type": "object"
38893979
},
3980+
"TeamInformation": {
3981+
"description": "Describes team information",
3982+
"properties": {
3983+
"teamId": {
3984+
"description": "Team ID",
3985+
"readOnly": true,
3986+
"type": "string"
3987+
},
3988+
"primaryChannelUrl": {
3989+
"description": "The primary channel URL of the team",
3990+
"readOnly": true,
3991+
"type": "string"
3992+
},
3993+
"teamCreationTimeUtc": {
3994+
"description": "The time the team was created",
3995+
"format": "date-time",
3996+
"readOnly": true,
3997+
"type": "string"
3998+
},
3999+
"name": {
4000+
"description": "The name of the team",
4001+
"readOnly": true,
4002+
"type": "string"
4003+
},
4004+
"description": {
4005+
"description": "The description of the team",
4006+
"readOnly": true,
4007+
"type": "string"
4008+
}
4009+
},
4010+
"type": "object"
4011+
},
4012+
"TeamProperties": {
4013+
"description": "Describes team properties",
4014+
"properties": {
4015+
"teamName": {
4016+
"description": "The name of the team",
4017+
"type": "string"
4018+
},
4019+
"teamDescription": {
4020+
"description": "The description of the team",
4021+
"type": "string"
4022+
},
4023+
"memberIds": {
4024+
"description": "List of member IDs to add to the team",
4025+
"items": {
4026+
"description": "A single-value attribute that is the unique identifier for the user, assigned by active directory.",
4027+
"format": "uuid",
4028+
"type": "string"
4029+
},
4030+
"type": "array"
4031+
},
4032+
"groupIds": {
4033+
"description": "List of group IDs to add their members to the team",
4034+
"items": {
4035+
"description": "A single-value attribute that is the unique identifier for the group, assigned by active directory.",
4036+
"format": "uuid",
4037+
"type": "string"
4038+
},
4039+
"type": "array"
4040+
}
4041+
},
4042+
"required": [
4043+
"teamName"
4044+
],
4045+
"type": "object"
4046+
},
38904047
"ThreatIntelligence": {
38914048
"description": "ThreatIntelligence property bag.",
38924049
"properties": {
@@ -4067,6 +4224,16 @@
40674224
"type": "string",
40684225
"description": "Relation Name",
40694226
"x-ms-parameter-location": "method"
4227+
},
4228+
"TeamProperties": {
4229+
"description": "Team properties",
4230+
"in": "body",
4231+
"name": "teamProperties",
4232+
"required": true,
4233+
"schema": {
4234+
"$ref": "#/definitions/TeamProperties"
4235+
},
4236+
"x-ms-parameter-location": "method"
40704237
}
40714238
}
40724239
}

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/incidents/CreateIncident.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,8 @@
4242
"objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
4343
"email": "john.doe@contoso.com",
4444
"userPrincipalName": "john@contoso.com",
45-
"assignedTo": "john doe"
45+
"assignedTo": "john doe",
46+
"ownerType": "User"
4647
},
4748
"severity": "High",
4849
"classification": "FalsePositive",

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/incidents/CreateTeam.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"parameters": {
3+
"api-version": "2021-03-01-preview",
4+
"subscriptionId": "9023f5b5-df22-4313-8fbf-b4b75af8a6d9",
5+
"resourceGroupName": "ambawolvese5resourcegroup",
6+
"workspaceName": "AmbaE5WestCentralUS",
7+
"operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
8+
"incidentId": "69a30280-6a4c-4aa7-9af0-5d63f335d600",
9+
"teamProperties": {
10+
"teamName": "Team name",
11+
"teamDescription": "Team description"
12+
}
13+
},
14+
"responses": {
15+
"200": {
16+
"body": {
17+
"teamId": "99978838-9bda-4ad4-8f93-4cf7ebc50ca5",
18+
"primaryChannelUrl": "https://teams.microsoft.com/l/team/19:80bf3b25485b4067b7d2dc4eec9e1578%40thread.tacv2/conversations?groupId=99978838-9bda-4ad4-8f93-4cf7ebc50ca5&tenantId=5b5a146c-eba8-46af-96f8-e31b50d15a3f",
19+
"teamCreationTimeUtc": "2021-03-15T17:08:21.9954238+02:00",
20+
"name": "Team name",
21+
"description": "Team description"
22+
}
23+
}
24+
}
25+
}

0 commit comments

Comments
 (0)