Skip to content

Commit bb04b4b

Browse files
dosisoanat-gilenson
dosiso
authored and
anat-gilenson
committed
Export incidents resource to new preview API version
1 parent 8017a09 commit bb04b4b

17 files changed

+4752
-0
lines changed

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/Incidents.json‎

Lines changed: 4072 additions & 0 deletions
Large diffs are not rendered by default.

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/incidents/CreateIncident.json‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
{
2+
"parameters": {
3+
"api-version": "2021-03-01-preview",
4+
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
5+
"resourceGroupName": "myRg",
6+
"workspaceName": "myWorkspace",
7+
"operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
8+
"incidentId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
9+
"incident": {
10+
"etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
11+
"properties": {
12+
"lastActivityTimeUtc": "2019-01-01T13:05:30Z",
13+
"firstActivityTimeUtc": "2019-01-01T13:00:30Z",
14+
"description": "This is a demo incident",
15+
"title": "My incident",
16+
"owner": {
17+
"objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70"
18+
},
19+
"severity": "High",
20+
"classification": "FalsePositive",
21+
"classificationComment": "Not a malicious activity",
22+
"classificationReason": "IncorrectAlertLogic",
23+
"status": "Closed"
24+
}
25+
}
26+
},
27+
"responses": {
28+
"200": {
29+
"body": {
30+
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
31+
"name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
32+
"type": "Microsoft.SecurityInsights/incidents",
33+
"etag": "\"0300bf09-0000-0000-0000-5c37296e0001\"",
34+
"properties": {
35+
"lastModifiedTimeUtc": "2019-01-01T13:15:30Z",
36+
"createdTimeUtc": "2019-01-01T13:15:30Z",
37+
"lastActivityTimeUtc": "2019-01-01T13:05:30Z",
38+
"firstActivityTimeUtc": "2019-01-01T13:00:30Z",
39+
"description": "This is a demo incident",
40+
"title": "My incident",
41+
"owner": {
42+
"objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
43+
"email": "john.doe@contoso.com",
44+
"userPrincipalName": "john@contoso.com",
45+
"assignedTo": "john doe"
46+
},
47+
"severity": "High",
48+
"classification": "FalsePositive",
49+
"classificationComment": "Not a malicious activity",
50+
"classificationReason": "IncorrectAlertLogic",
51+
"status": "Closed",
52+
"incidentUrl": "https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
53+
"incidentNumber": 3177,
54+
"labels": [],
55+
"providerName": "Azure Sentinel",
56+
"providerIncidentId": "3177",
57+
"relatedAnalyticRuleIds": [],
58+
"additionalData": {
59+
"alertsCount": 0,
60+
"bookmarksCount": 0,
61+
"commentsCount": 3,
62+
"alertProductNames": [],
63+
"tactics": []
64+
}
65+
}
66+
}
67+
},
68+
"201": {
69+
"body": {
70+
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
71+
"name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
72+
"type": "Microsoft.SecurityInsights/incidents",
73+
"etag": "\"0300bf09-0000-0000-0000-5c37296e0001\"",
74+
"properties": {
75+
"lastModifiedTimeUtc": "2019-01-01T13:15:30Z",
76+
"createdTimeUtc": "2019-01-01T13:15:30Z",
77+
"lastActivityTimeUtc": "2019-01-01T13:05:30Z",
78+
"firstActivityTimeUtc": "2019-01-01T13:00:30Z",
79+
"description": "This is a demo incident",
80+
"title": "My incident",
81+
"owner": {
82+
"objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
83+
"email": "john.doe@contoso.com",
84+
"userPrincipalName": "john@contoso.com",
85+
"assignedTo": "john doe"
86+
},
87+
"severity": "High",
88+
"classification": "FalsePositive",
89+
"classificationComment": "Not a malicious activity",
90+
"classificationReason": "IncorrectAlertLogic",
91+
"status": "Closed",
92+
"incidentUrl": "https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
93+
"incidentNumber": 3177,
94+
"labels": [],
95+
"providerName": "Azure Sentinel",
96+
"providerIncidentId": "3177",
97+
"relatedAnalyticRuleIds": [],
98+
"additionalData": {
99+
"alertsCount": 0,
100+
"bookmarksCount": 0,
101+
"commentsCount": 3,
102+
"alertProductNames": [],
103+
"tactics": []
104+
}
105+
}
106+
}
107+
}
108+
}
109+
}

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/incidents/DeleteIncident.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{
2+
"parameters": {
3+
"api-version": "2021-03-01-preview",
4+
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
5+
"resourceGroupName": "myRg",
6+
"workspaceName": "myWorkspace",
7+
"operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
8+
"incidentId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5"
9+
},
10+
"responses": {
11+
"200": {},
12+
"204": {}
13+
}
14+
}

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/incidents/GetAllIncidentAlerts.json‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
{
2+
"parameters": {
3+
"api-version": "2021-03-01-preview",
4+
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
5+
"resourceGroupName": "myRg",
6+
"workspaceName": "myWorkspace",
7+
"operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
8+
"incidentId": "afbd324f-6c48-459c-8710-8d1e1cd03812"
9+
},
10+
"responses": {
11+
"200": {
12+
"body": {
13+
"value": [
14+
{
15+
"id": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/myRG/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/Entities/baa8a239-6fde-4ab7-a093-d09f7b75c58c",
16+
"name": "baa8a239-6fde-4ab7-a093-d09f7b75c58c",
17+
"type": "Microsoft.SecurityInsights/Entities",
18+
"kind": "SecurityAlert",
19+
"properties": {
20+
"systemAlertId": "baa8a239-6fde-4ab7-a093-d09f7b75c58c",
21+
"tactics": [],
22+
"alertDisplayName": "myAlert",
23+
"confidenceLevel": "Unknown",
24+
"severity": "Low",
25+
"vendorName": "Microsoft",
26+
"productName": "Azure Security Center",
27+
"alertType": "myAlert",
28+
"processingEndTime": "2020-07-20T18:21:53.6158361Z",
29+
"status": "New",
30+
"endTimeUtc": "2020-07-20T18:21:53.6158361Z",
31+
"startTimeUtc": "2020-07-20T18:21:53.6158361Z",
32+
"timeGenerated": "2020-07-20T18:21:53.6158361Z",
33+
"resourceIdentifiers": [
34+
{
35+
"type": "LogAnalytics",
36+
"workspaceId": "c8c99641-985d-4e4e-8e91-fb3466cd0e5b",
37+
"subscriptionId": "bd794837-4d29-4647-9105-6339bfdb4e6a",
38+
"resourceGroup": "myRG"
39+
}
40+
],
41+
"additionalData": {
42+
"AlertMessageEnqueueTime": "2020-07-20T18:21:57.304Z"
43+
},
44+
"friendlyName": "myAlert"
45+
}
46+
}
47+
]
48+
}
49+
}
50+
}
51+
}

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/incidents/GetAllIncidentBookmarks.json‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
{
2+
"parameters": {
3+
"api-version": "2021-03-01-preview",
4+
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
5+
"resourceGroupName": "myRg",
6+
"workspaceName": "myWorkspace",
7+
"operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
8+
"incidentId": "afbd324f-6c48-459c-8710-8d1e1cd03812"
9+
},
10+
"responses": {
11+
"200": {
12+
"body": {
13+
"value": [
14+
{
15+
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/bookmarks/afbd324f-6c48-459c-8710-8d1e1cd03812",
16+
"name": "afbd324f-6c48-459c-8710-8d1e1cd03812",
17+
"type": "Microsoft.SecurityInsights/Entities",
18+
"kind": "Bookmark",
19+
"properties": {
20+
"displayName": "SecurityEvent - 868f40f4698d",
21+
"created": "2020-06-17T15:34:01.4265524+00:00",
22+
"updated": "2020-06-17T15:34:01.4265524+00:00",
23+
"createdBy": {
24+
"objectId": "b03ca914-5eb6-45e5-9417-fe0797c372fd",
25+
"email": "user@microsoft.com",
26+
"name": "user"
27+
},
28+
"updatedBy": {
29+
"objectId": "b03ca914-5eb6-45e5-9417-fe0797c372fd",
30+
"email": "user@microsoft.com",
31+
"name": "user"
32+
},
33+
"eventTime": "2020-06-17T15:34:01.4265524+00:00",
34+
"labels": [],
35+
"query": "SecurityEvent\r\n| take 1\n",
36+
"queryResult": "{\"TimeGenerated\":\"2020-05-24T01:24:25.67Z\",\"Account\":\"\\\\ADMINISTRATOR\",\"AccountType\":\"User\",\"Computer\":\"SecurityEvents\",\"EventSourceName\":\"Microsoft-Windows-Security-Auditing\",\"Channel\":\"Security\",\"Task\":12544,\"Level\":\"16\",\"EventID\":4625,\"Activity\":\"4625 - An account failed to log on.\",\"AuthenticationPackageName\":\"NTLM\",\"FailureReason\":\"%%2313\",\"IpAddress\":\"176.113.115.73\",\"IpPort\":\"0\",\"LmPackageName\":\"-\",\"LogonProcessName\":\"NtLmSsp \",\"LogonType\":3,\"LogonTypeName\":\"3 - Network\",\"Process\":\"-\",\"ProcessId\":\"0x0\",\"__entityMapping\":{\"\\\\ADMINISTRATOR\":\"Account\",\"SecurityEvents\":\"Host\"}}",
37+
"additionalData": {
38+
"ETag": "\"3b00acab-0000-0d00-0000-5f15e4ed0000\"",
39+
"EntityId": "afbd324f-6c48-459c-8710-8d1e1cd03812"
40+
},
41+
"friendlyName": "SecurityEvent - 868f40f4698d"
42+
}
43+
},
44+
{
45+
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/bookmarks/bbbd324f-6c48-459c-8710-8d1e1cd03812",
46+
"name": "bbbd324f-6c48-459c-8710-8d1e1cd03812",
47+
"type": "Microsoft.SecurityInsights/Entities",
48+
"kind": "Bookmark",
49+
"properties": {
50+
"displayName": "SecurityEvent - 868f40f4698d",
51+
"created": "2020-06-17T15:34:01.4265524+00:00",
52+
"updated": "2020-06-17T15:34:01.4265524+00:00",
53+
"createdBy": {
54+
"objectId": "303ca914-5eb6-45e5-9417-fe0797c372fd",
55+
"email": "user@microsoft.com",
56+
"name": "user"
57+
},
58+
"updatedBy": {
59+
"objectId": "b03ca914-5eb6-45e5-9417-fe0797c372fd",
60+
"email": "user@microsoft.com",
61+
"name": "user"
62+
},
63+
"eventTime": "2020-06-17T15:34:01.4265524+00:00",
64+
"labels": [],
65+
"query": "SecurityEvent\r\n| take 1\n",
66+
"queryResult": "{\"TimeGenerated\":\"2020-05-24T01:24:25.67Z\",\"Account\":\"\\\\ADMINISTRATOR\",\"AccountType\":\"User\",\"Computer\":\"SecurityEvents\",\"EventSourceName\":\"Microsoft-Windows-Security-Auditing\",\"Channel\":\"Security\",\"Task\":12544,\"Level\":\"16\",\"EventID\":4625,\"Activity\":\"4625 - An account failed to log on.\",\"AuthenticationPackageName\":\"NTLM\",\"FailureReason\":\"%%2313\",\"IpAddress\":\"176.113.115.73\",\"IpPort\":\"0\",\"LmPackageName\":\"-\",\"LogonProcessName\":\"NtLmSsp \",\"LogonType\":3,\"LogonTypeName\":\"3 - Network\",\"Process\":\"-\",\"ProcessId\":\"0x0\",\"__entityMapping\":{\"\\\\ADMINISTRATOR\":\"Account\",\"SecurityEvents\":\"Host\"}}",
67+
"additionalData": {
68+
"ETag": "\"3b00acab-0000-0d00-0000-5f15e4ed0000\"",
69+
"EntityId": "afbd324f-6c48-459c-8710-8d1e1cd03812"
70+
},
71+
"friendlyName": "SecurityEvent - 868f40f4698d"
72+
}
73+
}
74+
]
75+
}
76+
}
77+
}
78+
}

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/incidents/GetIncidentById.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"parameters": {
3+
"api-version": "2021-03-01-preview",
4+
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
5+
"resourceGroupName": "myRg",
6+
"workspaceName": "myWorkspace",
7+
"operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
8+
"incidentId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5"
9+
},
10+
"responses": {
11+
"200": {
12+
"body": {
13+
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
14+
"name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
15+
"type": "Microsoft.SecurityInsights/incidents",
16+
"etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
17+
"properties": {
18+
"lastModifiedTimeUtc": "2019-01-01T13:15:30Z",
19+
"createdTimeUtc": "2019-01-01T13:15:30Z",
20+
"lastActivityTimeUtc": "2019-01-01T13:05:30Z",
21+
"firstActivityTimeUtc": "2019-01-01T13:00:30Z",
22+
"description": "This is a demo incident",
23+
"title": "My incident",
24+
"owner": {
25+
"objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
26+
"email": "john.doe@contoso.com",
27+
"userPrincipalName": "john@contoso.com",
28+
"assignedTo": "john doe"
29+
},
30+
"severity": "High",
31+
"classification": "FalsePositive",
32+
"classificationComment": "Not a malicious activity",
33+
"classificationReason": "InaccurateData",
34+
"status": "Closed",
35+
"incidentUrl": "https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
36+
"incidentNumber": 3177,
37+
"labels": [],
38+
"providerName": "Azure Sentinel",
39+
"providerIncidentId": "3177",
40+
"relatedAnalyticRuleIds": [
41+
"/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/fab3d2d4-747f-46a7-8ef0-9c0be8112bf7"
42+
],
43+
"additionalData": {
44+
"alertsCount": 0,
45+
"bookmarksCount": 0,
46+
"commentsCount": 3,
47+
"alertProductNames": [],
48+
"tactics": [
49+
"InitialAccess",
50+
"Persistence"
51+
]
52+
}
53+
}
54+
}
55+
}
56+
}
57+
}

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/incidents/GetIncidents.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"parameters": {
3+
"api-version": "2021-03-01-preview",
4+
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
5+
"resourceGroupName": "myRg",
6+
"workspaceName": "myWorkspace",
7+
"operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
8+
"$orderby": "properties/createdTimeUtc desc",
9+
"$top": 1
10+
},
11+
"responses": {
12+
"200": {
13+
"body": {
14+
"value": [
15+
{
16+
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
17+
"name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
18+
"type": "Microsoft.SecurityInsights/incidents",
19+
"etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
20+
"properties": {
21+
"lastModifiedTimeUtc": "2019-01-01T13:15:30Z",
22+
"createdTimeUtc": "2019-01-01T13:15:30Z",
23+
"lastActivityTimeUtc": "2019-01-01T13:05:30Z",
24+
"firstActivityTimeUtc": "2019-01-01T13:00:30Z",
25+
"description": "This is a demo incident",
26+
"title": "My incident",
27+
"owner": {
28+
"objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
29+
"email": "john.doe@contoso.com",
30+
"userPrincipalName": "john@contoso.com",
31+
"assignedTo": "john doe"
32+
},
33+
"severity": "High",
34+
"classification": "FalsePositive",
35+
"classificationComment": "Not a malicious activity",
36+
"classificationReason": "IncorrectAlertLogic",
37+
"status": "Closed",
38+
"incidentUrl": "https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
39+
"incidentNumber": 3177,
40+
"labels": [],
41+
"providerName": "Azure Sentinel",
42+
"providerIncidentId": "3177",
43+
"relatedAnalyticRuleIds": [
44+
"/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/fab3d2d4-747f-46a7-8ef0-9c0be8112bf7",
45+
"/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/8deb8303-e94d-46ff-96e0-5fd94b33df1a"
46+
],
47+
"additionalData": {
48+
"alertsCount": 0,
49+
"bookmarksCount": 0,
50+
"commentsCount": 3,
51+
"alertProductNames": [],
52+
"tactics": [
53+
"Persistence"
54+
]
55+
}
56+
}
57+
}
58+
]
59+
}
60+
}
61+
}
62+
}

0 commit comments

Comments
 (0)