Skip to content

Commit 7f5e878

Browse files
hassanchawichehassanchawiche
authored
[Hub Generated] Review request for Microsoft.SecurityInsights to add version preview/2019-01-01-preview (#11795)
* Added Watchlist-Item endpoint to Add/Update/Delete Watchlist Item resource * Adjustments as per ARM Review * Adjustments as per ARM Review * Fixed Avecado issues and enhaced Watchlist examples * Updated Watchlist Item definition
1 parent bd71f9a commit 7f5e878

File tree

4 files changed

+304
-19
lines changed

4 files changed

+304
-19
lines changed

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/SecurityInsights.json‎

Lines changed: 197 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3838,7 +3838,7 @@
38383838
"tags": [
38393839
"Watchlists"
38403840
],
3841-
"description": "Creates a watchlist and its watchlist items (bulk creation, e.g. through text/csv content type). To create a Watchlist and its Items, we should call this endpoint twice : the first call will create am empty Watchlist, and the second one will create its Items.",
3841+
"description": "Creates a watchlist and its watchlist items (bulk creation, e.g. through text/csv content type). To create a Watchlist and its Items, we should call this endpoint twice : the first call will create an empty Watchlist, and the second one will create its Items.",
38423842
"operationId": "Watchlists_Create",
38433843
"parameters": [
38443844
{
@@ -3885,6 +3885,115 @@
38853885
}
38863886
}
38873887
},
3888+
"/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/watchlists/{watchlistAlias}/watchlistItems/{watchlistItemId}": {
3889+
"delete": {
3890+
"x-ms-examples": {
3891+
"Delete a watchlist Item.": {
3892+
"$ref": "./examples/watchlists/DeleteWatchlistItem.json"
3893+
}
3894+
},
3895+
"tags": [
3896+
"WatchlistItems"
3897+
],
3898+
"description": "Delete a watchlist item.",
3899+
"operationId": "WatchlistItem_Delete",
3900+
"parameters": [
3901+
{
3902+
"$ref": "#/parameters/ApiVersion"
3903+
},
3904+
{
3905+
"$ref": "#/parameters/SubscriptionId"
3906+
},
3907+
{
3908+
"$ref": "#/parameters/ResourceGroupName"
3909+
},
3910+
{
3911+
"$ref": "#/parameters/OperationalInsightsResourceProvider"
3912+
},
3913+
{
3914+
"$ref": "#/parameters/WorkspaceName"
3915+
},
3916+
{
3917+
"$ref": "#/parameters/WatchlistAlias"
3918+
},
3919+
{
3920+
"$ref": "#/parameters/WatchlistItemId"
3921+
}
3922+
],
3923+
"responses": {
3924+
"200": {
3925+
"description": "OK"
3926+
},
3927+
"204": {
3928+
"description": "No Content"
3929+
},
3930+
"default": {
3931+
"description": "Error response describing why the operation failed.",
3932+
"schema": {
3933+
"$ref": "#/definitions/CloudError"
3934+
}
3935+
}
3936+
}
3937+
},
3938+
"put": {
3939+
"x-ms-examples": {
3940+
"Creates or updates a watchlist item.": {
3941+
"$ref": "./examples/watchlists/CreateWatchlistItem.json"
3942+
}
3943+
},
3944+
"tags": [
3945+
"WatchlistItems"
3946+
],
3947+
"description": "Creates or updates a watchlist item.",
3948+
"operationId": "WatchlistItem_CreateOrUpdate",
3949+
"parameters": [
3950+
{
3951+
"$ref": "#/parameters/ApiVersion"
3952+
},
3953+
{
3954+
"$ref": "#/parameters/SubscriptionId"
3955+
},
3956+
{
3957+
"$ref": "#/parameters/ResourceGroupName"
3958+
},
3959+
{
3960+
"$ref": "#/parameters/OperationalInsightsResourceProvider"
3961+
},
3962+
{
3963+
"$ref": "#/parameters/WorkspaceName"
3964+
},
3965+
{
3966+
"$ref": "#/parameters/WatchlistAlias"
3967+
},
3968+
{
3969+
"$ref": "#/parameters/WatchlistItemId"
3970+
},
3971+
{
3972+
"$ref": "#/parameters/WatchlistItem"
3973+
}
3974+
],
3975+
"responses": {
3976+
"200": {
3977+
"description": "OK",
3978+
"schema": {
3979+
"$ref": "#/definitions/WatchlistItem"
3980+
}
3981+
},
3982+
"201": {
3983+
"description": "Created",
3984+
"schema": {
3985+
"$ref": "#/definitions/WatchlistItem"
3986+
}
3987+
},
3988+
"default": {
3989+
"description": "Error response describing why the operation failed.",
3990+
"schema": {
3991+
"$ref": "#/definitions/CloudError"
3992+
}
3993+
}
3994+
}
3995+
}
3996+
},
38883997
"/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/threatIntelligence/main/createIndicator": {
38893998
"post": {
38903999
"x-ms-examples": {
@@ -10468,6 +10577,75 @@
1046810577
],
1046910578
"type": "object"
1047010579
},
10580+
"WatchlistItem": {
10581+
"allOf": [
10582+
{
10583+
"$ref": "#/definitions/ResourceWithEtag"
10584+
}
10585+
],
10586+
"description": "Represents a Watchlist item in Azure Security Insights.",
10587+
"properties": {
10588+
"properties": {
10589+
"$ref": "#/definitions/WatchlistItemProperties",
10590+
"description": "Watchlist Item properties",
10591+
"x-ms-client-flatten": true
10592+
}
10593+
},
10594+
"type": "object"
10595+
},
10596+
"WatchlistItemProperties": {
10597+
"description": "Describes watchlist item properties",
10598+
"properties": {
10599+
"watchlistItemType": {
10600+
"description": "The type of the watchlist item",
10601+
"type": "string"
10602+
},
10603+
"watchlistItemId": {
10604+
"description": "The id (a Guid) of the watchlist item",
10605+
"type": "string"
10606+
},
10607+
"tenantId": {
10608+
"description": "The tenantId to which the watchlist item belongs to",
10609+
"type": "string"
10610+
},
10611+
"isDeleted": {
10612+
"description": "A flag that indicates if the watchlist item is deleted or not",
10613+
"type": "boolean"
10614+
},
10615+
"created": {
10616+
"description": "The time the watchlist item was created",
10617+
"format": "date-time",
10618+
"type": "string"
10619+
},
10620+
"updated": {
10621+
"description": "The last time the watchlist item was updated",
10622+
"format": "date-time",
10623+
"type": "string"
10624+
},
10625+
"createdBy": {
10626+
"$ref": "#/definitions/UserInfo",
10627+
"description": "Describes a user that created the watchlist item",
10628+
"type": "object"
10629+
},
10630+
"updatedBy": {
10631+
"$ref": "#/definitions/UserInfo",
10632+
"description": "Describes a user that updated the watchlist item",
10633+
"type": "object"
10634+
},
10635+
"itemsKeyValue": {
10636+
"description": "key-value pairs for a watchlist item",
10637+
"type": "object"
10638+
},
10639+
"entityMapping": {
10640+
"description": "key-value pairs for a watchlist item entity mapping",
10641+
"type": "object"
10642+
}
10643+
},
10644+
"required": [
10645+
"itemsKeyValue"
10646+
],
10647+
"type": "object"
10648+
},
1047110649
"ThreatIntelligenceInformationList": {
1047210650
"description": "List of all the threat intelligence information objects.",
1047310651
"properties": {
@@ -11576,6 +11754,24 @@
1157611754
},
1157711755
"x-ms-parameter-location": "method"
1157811756
},
11757+
"WatchlistItem": {
11758+
"description": "The watchlist item",
11759+
"in": "body",
11760+
"name": "watchlistItem",
11761+
"required": true,
11762+
"schema": {
11763+
"$ref": "#/definitions/WatchlistItem"
11764+
},
11765+
"x-ms-parameter-location": "method"
11766+
},
11767+
"WatchlistItemId": {
11768+
"description": "Watchlist Item Id (GUID)",
11769+
"in": "path",
11770+
"name": "watchlistItemId",
11771+
"required": true,
11772+
"type": "string",
11773+
"x-ms-parameter-location": "method"
11774+
},
1157911775
"ThreatIntelligenceName": {
1158011776
"description": "Threat intelligence indicator name field.",
1158111777
"in": "path",

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/watchlists/CreateWatchlist.json‎

Lines changed: 0 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -9,18 +9,10 @@
99
"watchlist": {
1010
"etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
1111
"properties": {
12-
"createdBy": {
13-
"objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70"
14-
},
1512
"displayName": "High Value Assets Watchlist",
1613
"source": "Local file",
1714
"provider": "Microsoft",
1815
"description": "Watchlist from CSV content",
19-
"labels": [
20-
"Tag1",
21-
"Tag2"
22-
],
23-
"defaultDuration": "P1279DT12H30M5S",
2416
"numberOfLinesToSkip": 1,
2517
"rawContent": "This line will be skipped\nheader1,header2\nvalue1,value2",
2618
"contentType": "text/csv"
@@ -55,11 +47,6 @@
5547
"watchlistType": "watchlist",
5648
"watchlistAlias": "highValueAsset",
5749
"isDeleted": false,
58-
"labels": [
59-
"Tag1",
60-
"Tag2"
61-
],
62-
"defaultDuration": "P1279DT12H30M5S",
6350
"tenantId": "f686d426-8d16-42db-81b7-ab578e110ccd"
6451
}
6552
}
@@ -91,11 +78,6 @@
9178
"watchlistType": "watchlist",
9279
"watchlistAlias": "highValueAsset",
9380
"isDeleted": false,
94-
"labels": [
95-
"Tag1",
96-
"Tag2"
97-
],
98-
"defaultDuration": "P1279DT12H30M5S",
9981
"tenantId": "f686d426-8d16-42db-81b7-ab578e110ccd"
10082
}
10183
}

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/watchlists/CreateWatchlistItem.json‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
{
2+
"parameters": {
3+
"api-version": "2019-01-01-preview",
4+
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
5+
"resourceGroupName": "myRg",
6+
"workspaceName": "myWorkspace",
7+
"operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
8+
"watchlistAlias": "highValueAsset",
9+
"watchlistItemId": "82ba292c-dc97-4dfc-969d-d4dd9e666842",
10+
"watchlistItem": {
11+
"etag": "0300bf09-0000-0000-0000-5c37296e0000",
12+
"properties": {
13+
"itemsKeyValue": {
14+
"Gateway subnet": "10.0.255.224/27",
15+
"Web Tier": "10.0.1.0/24",
16+
"Business tier": "10.0.2.0/24",
17+
"Data tier": "10.0.2.0/24",
18+
"Private DMZ in": "10.0.0.0/27",
19+
"Public DMZ out": "10.0.0.96/27"
20+
}
21+
}
22+
}
23+
},
24+
"responses": {
25+
"200": {
26+
"body": {
27+
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/Watchlists/highValueAsset/WatchlistItems/82ba292c-dc97-4dfc-969d-d4dd9e666842",
28+
"etag": "0300bf09-0000-0000-0000-5c37296e0000",
29+
"type": "Microsoft.SecurityInsights/Watchlists/WatchlistItems",
30+
"properties": {
31+
"watchlistItemType": "watchlist-item",
32+
"watchlistItemId": "82ba292c-dc97-4dfc-969d-d4dd9e666842",
33+
"tenantId": "4008512e-1d30-48b2-9ee2-d3612ed9d3ea",
34+
"isDeleted": false,
35+
"created": "2020-11-15T04:58:56.0748363+00:00",
36+
"updated": "2020-11-16T16:05:20+00:00",
37+
"createdBy": {
38+
"objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
39+
"email": "john@contoso.com",
40+
"name": "john doe"
41+
},
42+
"updatedBy": {
43+
"objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
44+
"email": "john@contoso.com",
45+
"name": "john doe"
46+
},
47+
"itemsKeyValue": {
48+
"Gateway subnet": "10.0.255.224/27",
49+
"Web Tier": "10.0.1.0/24",
50+
"Business tier": "10.0.2.0/24",
51+
"Data tier": "10.0.2.0/24",
52+
"Private DMZ in": "10.0.0.0/27",
53+
"Public DMZ out": "10.0.0.96/27"
54+
}
55+
}
56+
}
57+
},
58+
"201": {
59+
"body": {
60+
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/Watchlists/highValueAsset/WatchlistItems/82ba292c-dc97-4dfc-969d-d4dd9e666842",
61+
"etag": "0300bf09-0000-0000-0000-5c37296e0000",
62+
"type": "Microsoft.SecurityInsights/Watchlists/WatchlistItems",
63+
"properties": {
64+
"watchlistItemType": "watchlist-item",
65+
"watchlistItemId": "82ba292c-dc97-4dfc-969d-d4dd9e666842",
66+
"tenantId": "4008512e-1d30-48b2-9ee2-d3612ed9d3ea",
67+
"isDeleted": false,
68+
"created": "2020-11-15T04:58:56.0748363+00:00",
69+
"updated": "2020-11-16T16:05:20+00:00",
70+
"createdBy": {
71+
"objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
72+
"email": "john@contoso.com",
73+
"name": "john doe"
74+
},
75+
"updatedBy": {
76+
"objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
77+
"email": "john@contoso.com",
78+
"name": "john doe"
79+
},
80+
"itemsKeyValue": {
81+
"Gateway subnet": "10.0.255.224/27",
82+
"Web Tier": "10.0.1.0/24",
83+
"Business tier": "10.0.2.0/24",
84+
"Data tier": "10.0.2.0/24",
85+
"Private DMZ in": "10.0.0.0/27",
86+
"Public DMZ out": "10.0.0.96/27"
87+
}
88+
}
89+
}
90+
}
91+
}
92+
}

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/watchlists/DeleteWatchlistItem.json‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{
2+
"parameters": {
3+
"api-version": "2019-01-01-preview",
4+
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
5+
"resourceGroupName": "myRg",
6+
"workspaceName": "myWorkspace",
7+
"operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
8+
"watchlistAlias": "highValueAsset",
9+
"watchlistItemId": "4008512e-1d30-48b2-9ee2-d3612ed9d3ea"
10+
},
11+
"responses": {
12+
"200": {},
13+
"204": {}
14+
}
15+
}

0 commit comments

Comments
 (0)