Skip to content

Commit 2e84463

Browse files
Anat Gilensonanat-gilenson
Anat Gilenson
authored and
anat-gilenson
committed
Extract alertRules and alertRuleTemplates endpoints and their related parameters and definition from 2019-01-01-preview/SecurityInsights.json
1 parent 027b259 commit 2e84463

15 files changed

+2568
-0
lines changed

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/AlertRules.json‎

Lines changed: 1830 additions & 0 deletions
Large diffs are not rendered by default.

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/actions/CreateActionOfAlertRule.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"parameters": {
3+
"api-version": "2019-01-01-preview",
4+
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
5+
"resourceGroupName": "myRg",
6+
"workspaceName": "myWorkspace",
7+
"operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
8+
"ruleId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
9+
"actionId": "912bec42-cb66-4c03-ac63-1761b6898c3e",
10+
"action": {
11+
"etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
12+
"properties": {
13+
"triggerUri": "https://prod-31.northcentralus.logic.azure.com:443/workflows/cd3765391efd48549fd7681ded1d48d7/triggers/manual/paths/invoke?api-version=2016-10-01&sp=%2Ftriggers%2Fmanual%2Frun&sv=1.0&sig=signature",
14+
"logicAppResourceId": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.Logic/workflows/MyAlerts"
15+
}
16+
}
17+
},
18+
"responses": {
19+
"200": {
20+
"body": {
21+
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5/actions/912bec42-cb66-4c03-ac63-1761b6898c3e",
22+
"name": "912bec42-cb66-4c03-ac63-1761b6898c3e",
23+
"type": "Microsoft.SecurityInsights/alertRules/actions",
24+
"etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
25+
"properties": {
26+
"workflowId": "cd3765391efd48549fd7681ded1d48d7",
27+
"logicAppResourceId": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.Logic/workflows/MyAlerts"
28+
}
29+
}
30+
},
31+
"201": {
32+
"body": {
33+
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5/actions/912bec42-cb66-4c03-ac63-1761b6898c3e",
34+
"name": "912bec42-cb66-4c03-ac63-1761b6898c3e",
35+
"type": "Microsoft.SecurityInsights/alertRules/actions",
36+
"etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
37+
"properties": {
38+
"workflowId": "cd3765391efd48549fd7681ded1d48d7",
39+
"logicAppResourceId": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.Logic/workflows/MyAlerts"
40+
}
41+
}
42+
}
43+
}
44+
}

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/actions/DeleteActionOfAlertRule.json‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{
2+
"parameters": {
3+
"api-version": "2019-01-01-preview",
4+
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
5+
"resourceGroupName": "myRg",
6+
"workspaceName": "myWorkspace",
7+
"operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
8+
"ruleId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
9+
"actionId": "912bec42-cb66-4c03-ac63-1761b6898c3e"
10+
},
11+
"responses": {
12+
"200": {},
13+
"204": {}
14+
}
15+
}

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/actions/GetActionOfAlertRuleById.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"parameters": {
3+
"api-version": "2019-01-01-preview",
4+
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
5+
"resourceGroupName": "myRg",
6+
"workspaceName": "myWorkspace",
7+
"operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
8+
"ruleId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
9+
"actionId": "912bec42-cb66-4c03-ac63-1761b6898c3e"
10+
},
11+
"responses": {
12+
"200": {
13+
"body": {
14+
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5/actions/912bec42-cb66-4c03-ac63-1761b6898c3e",
15+
"name": "912bec42-cb66-4c03-ac63-1761b6898c3e",
16+
"type": "Microsoft.SecurityInsights/alertRules/actions",
17+
"etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
18+
"properties": {
19+
"workflowId": "cd3765391efd48549fd7681ded1d48d7",
20+
"logicAppResourceId": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.Logic/workflows/MyAlerts"
21+
}
22+
}
23+
}
24+
}
25+
}

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/actions/GetAllActionsByAlertRule.json‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
{
2+
"parameters": {
3+
"api-version": "2019-01-01-preview",
4+
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
5+
"resourceGroupName": "myRg",
6+
"workspaceName": "myWorkspace",
7+
"operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
8+
"ruleId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5"
9+
},
10+
"responses": {
11+
"200": {
12+
"body": {
13+
"value": [
14+
{
15+
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5/actions/912bec42-cb66-4c03-ac63-1761b6898c3e",
16+
"name": "912bec42-cb66-4c03-ac63-1761b6898c3e",
17+
"type": "Microsoft.SecurityInsights/alertRules/actions",
18+
"etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
19+
"properties": {
20+
"workflowId": "cd3765391efd48549fd7681ded1d48d7",
21+
"logicAppResourceId": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.Logic/workflows/MyAlerts"
22+
}
23+
}
24+
]
25+
}
26+
}
27+
}
28+
}

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/alertRuleTemplates/GetAlertRuleTemplateById.json‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
{
2+
"parameters": {
3+
"api-version": "2019-01-01-preview",
4+
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
5+
"resourceGroupName": "myRg",
6+
"workspaceName": "myWorkspace",
7+
"operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
8+
"alertRuleTemplateId": "65360bb0-8986-4ade-a89d-af3cf44d28aa"
9+
},
10+
"responses": {
11+
"200": {
12+
"body": {
13+
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRuleTemplates/65360bb0-8986-4ade-a89d-af3cf44d28aa",
14+
"name": "65360bb0-8986-4ade-a89d-af3cf44d28aa",
15+
"type": "Microsoft.SecurityInsights/AlertRuleTemplates",
16+
"kind": "Scheduled",
17+
"properties": {
18+
"severity": "Low",
19+
"query": "let timeframe = 1d;\nAWSCloudTrail\n| where TimeGenerated >= ago(timeframe)\n| where EventName == \"CreateNetworkAclEntry\"\n or EventName == \"CreateRoute\"\n| project TimeGenerated, EventName, EventTypeName, UserIdentityAccountId, UserIdentityPrincipalid, UserAgent, UserIdentityUserName, SessionMfaAuthenticated, SourceIpAddress, AWSRegion, EventSource, AdditionalEventData, ResponseElements\n| extend AccountCustomEntity = UserIdentityUserName, IPCustomEntity = SourceIpAddress",
20+
"queryFrequency": "P1D",
21+
"queryPeriod": "P1D",
22+
"triggerOperator": "GreaterThan",
23+
"triggerThreshold": 0,
24+
"displayName": "Changes to Amazon VPC settings",
25+
"description": "This alert monitors changes to Amazon VPC (Virtual Private Cloud) settings such as new ACL entries and routes in route tables.\nMore information: https://medium.com/@GorillaStack/the-most-important-aws-cloudtrail-security-events-to-track-a5b9873f8255 \nand https://aws.amazon.com/vpc/",
26+
"eventGroupingSettings": {
27+
"aggregationKind": "AlertPerResult"
28+
},
29+
"tactics": [
30+
"PrivilegeEscalation",
31+
"LateralMovement"
32+
],
33+
"lastUpdatedDateUTC": "2020-02-27T00:00:00Z",
34+
"createdDateUTC": "2019-02-27T00:00:00Z",
35+
"status": "Available",
36+
"requiredDataConnectors": [
37+
{
38+
"connectorId": "AWS",
39+
"dataTypes": [
40+
"AWSCloudTrail"
41+
]
42+
}
43+
],
44+
"alertRulesCreatedByTemplateCount": 0
45+
}
46+
}
47+
}
48+
}
49+
}

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/alertRuleTemplates/GetAlertRuleTemplates.json‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
{
2+
"parameters": {
3+
"api-version": "2019-01-01-preview",
4+
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
5+
"resourceGroupName": "myRg",
6+
"workspaceName": "myWorkspace",
7+
"operationalInsightsResourceProvider": "Microsoft.OperationalIinsights"
8+
},
9+
"responses": {
10+
"200": {
11+
"body": {
12+
"value": [
13+
{
14+
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/AlertRuleTemplates/65360bb0-8986-4ade-a89d-af3cf44d28aa",
15+
"name": "65360bb0-8986-4ade-a89d-af3cf44d28aa",
16+
"type": "Microsoft.SecurityInsights/AlertRuleTemplates",
17+
"kind": "Scheduled",
18+
"properties": {
19+
"severity": "Low",
20+
"query": "let timeframe = 1d;\nAWSCloudTrail\n| where TimeGenerated >= ago(timeframe)\n| where EventName == \"CreateNetworkAclEntry\"\n or EventName == \"CreateRoute\"\n| project TimeGenerated, EventName, EventTypeName, UserIdentityAccountId, UserIdentityPrincipalid, UserAgent, UserIdentityUserName, SessionMfaAuthenticated, SourceIpAddress, AWSRegion, EventSource, AdditionalEventData, ResponseElements\n| extend AccountCustomEntity = UserIdentityUserName, IPCustomEntity = SourceIpAddress",
21+
"queryFrequency": "P1D",
22+
"queryPeriod": "P1D",
23+
"triggerOperator": "GreaterThan",
24+
"triggerThreshold": 0,
25+
"displayName": "Changes to Amazon VPC settings",
26+
"description": "This alert monitors changes to Amazon VPC (Virtual Private Cloud) settings such as new ACL entries and routes in route tables.\nMore information: https://medium.com/@GorillaStack/the-most-important-aws-cloudtrail-security-events-to-track-a5b9873f8255 \nand https://aws.amazon.com/vpc/",
27+
"tactics": [
28+
"PrivilegeEscalation",
29+
"LateralMovement"
30+
],
31+
"lastUpdatedDateUTC": "2020-02-27T00:00:00Z",
32+
"createdDateUTC": "2019-02-27T00:00:00Z",
33+
"status": "Available",
34+
"requiredDataConnectors": [
35+
{
36+
"connectorId": "AWS",
37+
"dataTypes": [
38+
"AWSCloudTrail"
39+
]
40+
}
41+
],
42+
"alertRulesCreatedByTemplateCount": 0
43+
}
44+
},
45+
{
46+
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/AlertRuleTemplates/f71aba3d-28fb-450b-b192-4e76a83015c8",
47+
"name": "f71aba3d-28fb-450b-b192-4e76a83015c8",
48+
"type": "Microsoft.SecurityInsights/AlertRuleTemplates",
49+
"kind": "Fusion",
50+
"properties": {
51+
"displayName": "Advanced Multi-Stage Attack Detection",
52+
"description": "Place holder: Fusion uses graph powered machine learning algorithms to correlate between millions of lower fidelity anomalous activities from different products such as Azure AD Identity Protection, and Microsoft Cloud App Security, to combine them into a manageable number of interesting security cases.\n",
53+
"tactics": [
54+
"Persistence",
55+
"LateralMovement",
56+
"Exfiltration",
57+
"CommandAndControl"
58+
],
59+
"lastUpdatedDateUTC": "2020-02-27T00:00:00Z",
60+
"createdDateUTC": "2019-07-25T00:00:00Z",
61+
"status": "Available",
62+
"severity": "High",
63+
"alertRulesCreatedByTemplateCount": 0
64+
}
65+
},
66+
{
67+
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/AlertRuleTemplates/b3cfc7c0-092c-481c-a55b-34a3979758cb",
68+
"name": "b3cfc7c0-092c-481c-a55b-34a3979758cb",
69+
"type": "Microsoft.SecurityInsights/AlertRuleTemplates",
70+
"kind": "MicrosoftSecurityIncidentCreation",
71+
"properties": {
72+
"productFilter": "Microsoft Cloud App Security",
73+
"displayName": "Create incidents based on Microsoft Cloud App Security alerts",
74+
"description": "Create incidents based on all alerts generated in Microsoft Cloud App Security",
75+
"lastUpdatedDateUTC": "2020-02-27T00:00:00Z",
76+
"createdDateUTC": "2019-07-16T00:00:00Z",
77+
"status": "Available",
78+
"alertRulesCreatedByTemplateCount": 0
79+
}
80+
}
81+
]
82+
}
83+
}
84+
}
85+
}

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/alertRules/CreateFusionAlertRule.json‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
{
2+
"parameters": {
3+
"api-version": "2019-01-01-preview",
4+
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
5+
"resourceGroupName": "myRg",
6+
"workspaceName": "myWorkspace",
7+
"operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
8+
"ruleId": "myFirstFusionRule",
9+
"alertRule": {
10+
"kind": "Fusion",
11+
"etag": "3d00c3ca-0000-0100-0000-5d42d5010000",
12+
"properties": {
13+
"enabled": true,
14+
"alertRuleTemplateName": "f71aba3d-28fb-450b-b192-4e76a83015c8"
15+
}
16+
}
17+
},
18+
"responses": {
19+
"200": {
20+
"body": {
21+
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/myFirstFusionRule",
22+
"name": "myFirstFusionRule",
23+
"etag": "\"260090e2-0000-0d00-0000-5d6fb8670000\"",
24+
"type": "Microsoft.SecurityInsights/alertRules",
25+
"kind": "Fusion",
26+
"properties": {
27+
"displayName": "Advanced Multi-Stage Attack Detection",
28+
"description": "In this mode, Sentinel combines low fidelity alerts, which themselves may not be actionable, and events across multiple products, into high fidelity security interesting incidents. The system looks at multiple products to produce actionable incidents. Custom tailored to each tenant, Fusion not only reduces false positive rates but also can detect attacks with limited or missing information. \nIncidents generated by Fusion system will encase two or more alerts. By design, Fusion incidents are low volume, high fidelity and will be high severity, which is why Fusion is turned ON by default in Azure Sentinel.\n\nFor Fusion to work, please configure the following data sources in Data Connectors tab:\nRequired - Azure Active Directory Identity Protection\nRequired - Microsoft Cloud App Security\nIf Available - Palo Alto Network\n\nFor full list of scenarios covered by Fusion, and detail instructions on how to configure the required data sources, go to aka.ms/SentinelFusion",
29+
"alertRuleTemplateName": "f71aba3d-28fb-450b-b192-4e76a83015c8",
30+
"tactics": [
31+
"Persistence",
32+
"LateralMovement",
33+
"Exfiltration",
34+
"CommandAndControl"
35+
],
36+
"severity": "High",
37+
"enabled": true,
38+
"lastModifiedUtc": "2019-09-04T13:13:11.5340061Z"
39+
}
40+
}
41+
},
42+
"201": {
43+
"body": {
44+
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/myFirstFusionRule",
45+
"name": "myFirstFusionRule",
46+
"etag": "\"260090e2-0000-0d00-0000-5d6fb8670000\"",
47+
"type": "Microsoft.SecurityInsights/alertRules",
48+
"kind": "Fusion",
49+
"properties": {
50+
"displayName": "Advanced Multi-Stage Attack Detection",
51+
"description": "In this mode, Sentinel combines low fidelity alerts, which themselves may not be actionable, and events across multiple products, into high fidelity security interesting incidents. The system looks at multiple products to produce actionable incidents. Custom tailored to each tenant, Fusion not only reduces false positive rates but also can detect attacks with limited or missing information. \nIncidents generated by Fusion system will encase two or more alerts. By design, Fusion incidents are low volume, high fidelity and will be high severity, which is why Fusion is turned ON by default in Azure Sentinel.\n\nFor Fusion to work, please configure the following data sources in Data Connectors tab:\nRequired - Azure Active Directory Identity Protection\nRequired - Microsoft Cloud App Security\nIf Available - Palo Alto Network\n\nFor full list of scenarios covered by Fusion, and detail instructions on how to configure the required data sources, go to aka.ms/SentinelFusion",
52+
"alertRuleTemplateName": "f71aba3d-28fb-450b-b192-4e76a83015c8",
53+
"tactics": [
54+
"Persistence",
55+
"LateralMovement",
56+
"Exfiltration",
57+
"CommandAndControl"
58+
],
59+
"severity": "High",
60+
"enabled": true,
61+
"lastModifiedUtc": "2019-09-04T13:13:11.5340061Z"
62+
}
63+
}
64+
}
65+
}
66+
}

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/alertRules/CreateMicrosoftSecurityIncidentCreationAlertRule.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"parameters": {
3+
"api-version": "2019-01-01-preview",
4+
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
5+
"resourceGroupName": "myRg",
6+
"workspaceName": "myWorkspace",
7+
"operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
8+
"ruleId": "microsoftSecurityIncidentCreationRuleExample",
9+
"alertRule": {
10+
"etag": "\"260097e0-0000-0d00-0000-5d6fa88f0000\"",
11+
"kind": "MicrosoftSecurityIncidentCreation",
12+
"properties": {
13+
"productFilter": "Microsoft Cloud App Security",
14+
"displayName": "testing displayname",
15+
"enabled": true
16+
}
17+
}
18+
},
19+
"responses": {
20+
"200": {
21+
"body": {
22+
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/microsoftSecurityIncidentCreationRuleExample",
23+
"name": "microsoftSecurityIncidentCreationRuleExample",
24+
"etag": "\"260097e0-0000-0d00-0000-5d6fa88f0000\"",
25+
"type": "Microsoft.SecurityInsights/alertRules",
26+
"kind": "MicrosoftSecurityIncidentCreation",
27+
"properties": {
28+
"productFilter": "Microsoft Cloud App Security",
29+
"severitiesFilter": null,
30+
"displayNamesFilter": null,
31+
"displayName": "testing displayname",
32+
"enabled": true,
33+
"description": null,
34+
"alertRuleTemplateName": null,
35+
"lastModifiedUtc": "2019-09-04T12:05:35.7296311Z"
36+
}
37+
}
38+
},
39+
"201": {
40+
"body": {
41+
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/microsoftSecurityIncidentCreationRuleExample",
42+
"name": "microsoftSecurityIncidentCreationRuleExample",
43+
"etag": "\"260097e0-0000-0d00-0000-5d6fa88f0000\"",
44+
"type": "Microsoft.SecurityInsights/alertRules",
45+
"kind": "MicrosoftSecurityIncidentCreation",
46+
"properties": {
47+
"productFilter": "Microsoft Cloud App Security",
48+
"severitiesFilter": null,
49+
"displayNamesFilter": null,
50+
"displayName": "testing displayname",
51+
"enabled": true,
52+
"description": null,
53+
"alertRuleTemplateName": null,
54+
"lastModifiedUtc": "2019-09-04T12:05:35.7296311Z"
55+
}
56+
}
57+
}
58+
}
59+
}

0 commit comments

Comments
 (0)