SecurityInsights(22-11) (Azure#33287)

* move

* test

* part1

* delete

* finished

Author: mcgallan

eng/Packages.Data.props

@@ -186,6 +186,7 @@
     <PackageReference Update="Azure.Messaging.ServiceBus" Version="7.11.1" />
     <PackageReference Update="Azure.ResourceManager.Compute" Version="1.0.0" />
     <PackageReference Update="Azure.ResourceManager.Network" Version="1.1.0" />
+    <PackageReference Update="Azure.ResourceManager.OperationalInsights" Version="1.0.0" />
     <PackageReference Update="Azure.ResourceManager.Resources" Version="1.3.1" />
     <PackageReference Update="Azure.ResourceManager.Storage" Version="1.1.0" />
     <PackageReference Update="Azure.Search.Documents" Version="11.2.0" />

sdk/securityinsights/Azure.ResourceManager.SecurityInsights/tests/Azure.ResourceManager.SecurityInsights.Tests.csproj

@@ -1,5 +1,13 @@
 <Project Sdk="Microsoft.NET.Sdk">
+  <ItemGroup>
+    <Compile Remove="TestCase\ActionResponseCollectionTests.cs" />
+    <Compile Remove="TestCase\ActionResponseResourceTests.cs" />
+  </ItemGroup>
   <ItemGroup>
     <ProjectReference Include="..\src\Azure.ResourceManager.SecurityInsights.csproj" />
   </ItemGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Azure.ResourceManager.OperationalInsights" />
+  </ItemGroup>
 </Project>

sdk/securityinsights/Azure.ResourceManager.SecurityInsights/tests/Helpers/ResourceDataHelpers.cs

@@ -0,0 +1,224 @@
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+using System.Collections.Generic;
+using Azure.ResourceManager.SecurityInsights.Models;
+using Azure.ResourceManager.Models;
+using Azure.ResourceManager.Resources.Models;
+using NUnit.Framework;
+using Azure.Core;
+using System;
+using System.Text;
+using Azure.ResourceManager.Resources;
+using System.Threading.Tasks;
+using NUnit.Framework.Internal;
+using System.IO;
+
+namespace Azure.ResourceManager.SecurityInsights.Tests.Helpers
+{
+    public static class ResourceDataHelpers
+    {
+        public static IDictionary<string, string> ReplaceWith(this IDictionary<string, string> dest, IDictionary<string, string> src)
+        {
+            dest.Clear();
+            foreach (var kv in src)
+            {
+                dest.Add(kv);
+            }
+
+            return dest;
+        }
+
+        public static void AssertResource(ResourceData r1, ResourceData r2)
+        {
+            Assert.AreEqual(r1.Name, r2.Name);
+            Assert.AreEqual(r1.Id, r2.Id);
+            Assert.AreEqual(r1.ResourceType, r2.ResourceType);
+        }
+
+        #region SecurityInsightsAlertRuleData
+        public static void AssertSecurityInsightsAlertRuleData(SecurityInsightsAlertRuleData data1, SecurityInsightsAlertRuleData data2)
+        {
+            AssertResource(data1, data2);
+            Assert.AreEqual(data1.Kind, data2.Kind);
+        }
+        public static SecurityInsightsAlertRuleData GetSecurityInsightsAlertRuleData()
+        {
+            var data = new MicrosoftSecurityIncidentCreationAlertRule()
+            {
+                ProductFilter = "Microsoft Cloud App Security",
+                IsEnabled = true,
+                DisplayName = "SDKTest"
+            };
+            return data;
+        }
+        #endregion
+
+        #region AutomationRuleData
+        public static void AssertAutomationRuleData(SecurityInsightsAutomationRuleData data1, SecurityInsightsAutomationRuleData data2)
+        {
+            AssertResource(data1, data2);
+            Assert.AreEqual(data1.DisplayName, data2.DisplayName);
+            Assert.AreEqual(data1.Order, data2.Order);
+        }
+        public static SecurityInsightsAutomationRuleData GetAutomationRuleData(string resourcegroup)
+        {
+            var trigger = new SecurityInsightsAutomationRuleTriggeringLogic(false, TriggersOn.Incidents, TriggersWhen.Created);
+            IEnumerable<AutomationRuleModifyPropertiesAction> action = new List<AutomationRuleModifyPropertiesAction>()
+            {
+                new AutomationRuleModifyPropertiesAction(1)
+                {
+                    ActionConfiguration = new SecurityInsightsIncidentActionConfiguration()
+                    {
+                        Labels =
+                        {
+                            new SecurityInsightsIncidentLabel("testlabel1")
+                        }
+                    }
+                }
+            };
+            var data = new SecurityInsightsAutomationRuleData("SDK Test", 1, trigger, action)
+            {
+            };
+            return data;
+        }
+        #endregion
+        #region BookmarkData
+        public static void AssertBookmarkData(SecurityInsightsBookmarkData data1, SecurityInsightsBookmarkData data2)
+        {
+            AssertResource(data1, data2);
+            Assert.AreEqual(data1.DisplayName, data2.DisplayName);
+            Assert.AreEqual(data1.Notes, data2.Notes);
+            Assert.AreEqual(data1.Query, data2.Query);
+            Assert.AreEqual(data1.QueryResult, data2.QueryResult);
+        }
+        public static SecurityInsightsBookmarkData GetBookmarkData()
+        {
+            var data = new SecurityInsightsBookmarkData()
+            {
+                DisplayName = "SDKTestBookmark",
+                Query = "SecurityEvent | take 10",
+            };
+            return data;
+        }
+        #endregion
+
+        #region IncidentData
+        public static void AssertIncidentData(SecurityInsightsIncidentData data1, SecurityInsightsIncidentData data2)
+        {
+            AssertResource(data1, data2);
+            Assert.AreEqual(data1.Title, data2.Title);
+            Assert.AreEqual(data1.Classification, data2.Classification);
+            Assert.AreEqual(data1.Description, data2.Description);
+            Assert.AreEqual(data1.ClassificationComment, data2.ClassificationComment);
+        }
+        public static SecurityInsightsIncidentData GetIncidentData()
+        {
+            var data = new SecurityInsightsIncidentData()
+            {
+                Title = "SDKCreateIncidentTest",
+                Status = "Active",
+                Severity = "Low"
+            };
+            return data;
+        }
+        #endregion
+
+        #region DataConnectorData
+        public static void AssertDataConnectorData(SecurityInsightsDataConnectorData data1, SecurityInsightsDataConnectorData data2)
+        {
+            AssertResource(data1, data2);
+            Assert.AreEqual(data1.Kind, data2.Kind);
+        }
+        public static SecurityInsightsDataConnectorData GetDataConnectorData()
+        {
+            var data = new SecurityInsightsAscDataConnector()
+            {
+                SubscriptionId = "db1ab6f0-4769-4b27-930e-01e2ef9c123c",
+                DataTypes = new SecurityInsightsAlertsDataTypeOfDataConnector(new DataConnectorDataTypeCommon()
+                {
+                    State = SecurityInsightsDataTypeConnectionState.Enabled
+                })
+            };
+            return data;
+        }
+        #endregion
+
+        #region ThreatIntelligenceIndicatorData
+        public static void AssertThreatIntelligenceIndicatorData(SecurityInsightsThreatIntelligenceIndicatorBaseData data1, SecurityInsightsThreatIntelligenceIndicatorBaseData data2)
+        {
+            AssertResource(data1, data2);
+        }
+        public static SecurityInsightsThreatIntelligenceIndicatorData GetThreatIntelligenceIndicatorData()
+        {
+            var data = new SecurityInsightsThreatIntelligenceIndicatorData()
+            {
+                DisplayName = "SDK Test",
+                PatternType = "ipv4-addr",
+                Pattern = "[ipv4-addr:value = '1.1.1.2']",
+                ThreatTypes =
+                {
+                    "unknown"
+                },
+                ValidFrom = DateTime.Now,
+                Source = "Azure Sentinel"
+            };
+            return data;
+        }
+        #endregion
+        #region WatchlistItemData
+        public static void AssertWatchlistItemData(SecurityInsightsWatchlistItemData data1, SecurityInsightsWatchlistItemData data2)
+        {
+            AssertResource(data1, data2);
+            Assert.AreEqual(data1.IsDeleted, data2.IsDeleted);
+            Assert.AreEqual(data1.WatchlistItemId, data2.WatchlistItemId);
+            Assert.AreEqual(data1.TenantId, data2.TenantId);
+            Assert.AreEqual(data1.WatchlistItemType, data2.WatchlistItemType);
+        }
+        public static SecurityInsightsWatchlistItemData GetWatchlistItemData()
+        {
+            return new SecurityInsightsWatchlistItemData()
+            {
+                ItemsKeyValue = BinaryData.FromString("{\"ipaddress\":\"1.1.1.2\"}")
+            };
+        }
+        #endregion
+
+        #region WatchlistData
+        public static void AssertWatchlistData(SecurityInsightsWatchlistData data1, SecurityInsightsWatchlistData data2)
+        {
+            AssertResource(data1, data2);
+            Assert.AreEqual(data1.IsDeleted, data2.IsDeleted);
+            Assert.AreEqual(data1.Source, data2.Source);
+            Assert.AreEqual(data1.TenantId, data2.TenantId);
+            Assert.AreEqual(data1.Provider, data2.Provider);
+        }
+        public static SecurityInsightsWatchlistData GetWatchlistData()
+        {
+            var data = new SecurityInsightsWatchlistData()
+            {
+                DisplayName = "SDK Test",
+                Provider = "SDK Test",
+                Source = "sdktest",
+                ItemsSearchKey = "ipaddress"
+            };
+            return data;
+        }
+        #endregion
+
+        #region SentinelOnboardingStateData
+        public static void AssertSentinelOnboardingStateData(SecurityInsightsSentinelOnboardingStateData data1, SecurityInsightsSentinelOnboardingStateData data2)
+        {
+            AssertResource(data1, data2);
+            Assert.AreEqual(data1.IsCustomerManagedKeySet, data2.IsCustomerManagedKeySet);
+        }
+        public static SecurityInsightsSentinelOnboardingStateData GetSentinelOnboardingStateData()
+        {
+            return new SecurityInsightsSentinelOnboardingStateData()
+            {
+                IsCustomerManagedKeySet = false,
+            };
+        }
+        #endregion
+    }
+}

sdk/securityinsights/Azure.ResourceManager.SecurityInsights/tests/SecurityInsightsManagementTestBase.cs

@@ -5,37 +5,82 @@
 using Azure.Core.TestFramework;
 using Azure.ResourceManager.Resources;
 using Azure.ResourceManager.TestFramework;
+using Azure.ResourceManager.OperationalInsights;
 using NUnit.Framework;
 using System.Threading.Tasks;
+using System;
+using Azure.ResourceManager.OperationalInsights.Models;
 
 namespace Azure.ResourceManager.SecurityInsights.Tests
 {
     public class SecurityInsightsManagementTestBase : ManagementRecordedTestBase<SecurityInsightsManagementTestEnvironment>
     {
         protected ArmClient Client { get; private set; }
+        protected AzureLocation DefaultLocation => AzureLocation.EastUS;
+        protected string groupName;
+        protected SubscriptionResource DefaultSubscription { get; private set; }
 
         protected SecurityInsightsManagementTestBase(bool isAsync, RecordedTestMode mode)
         : base(isAsync, mode)
         {
         }
 
+        public ResourceIdentifier CreateResourceIdentifier(string subscriptionId, string resourceGroupName, string workspaceName)
+        {
+            var resourceId = $"/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}";
+            return new ResourceIdentifier(resourceId);
+        }
+
         protected SecurityInsightsManagementTestBase(bool isAsync)
             : base(isAsync)
         {
         }
 
         [SetUp]
-        public void CreateCommonClient()
+        public async Task CreateCommonClient()
         {
             Client = GetArmClient();
+            DefaultSubscription = await Client.GetDefaultSubscriptionAsync().ConfigureAwait(false);
         }
 
-        protected async Task<ResourceGroupResource> CreateResourceGroup(SubscriptionResource subscription, string rgNamePrefix, AzureLocation location)
+        protected async Task<ResourceGroupResource> CreateResourceGroupAsync()
+        {
+            var resourceGroupName = Recording.GenerateAssetName("testRG-");
+            var rgOp = await DefaultSubscription.GetResourceGroups().CreateOrUpdateAsync(
+                WaitUntil.Completed,
+                resourceGroupName,
+                new ResourceGroupData(DefaultLocation)
+                {
+                    Tags =
+                    {
+                        { "test", "env" }
+                    }
+                });
+            if (Mode == RecordedTestMode.Playback)
+            {
+                groupName = resourceGroupName;
+            }
+            else
+            {
+                using (Recording.DisableRecording())
+                {
+                    groupName = rgOp.Value.Data.Name;
+                }
+            }
+            return rgOp.Value;
+        }
+        #region workspace
+        public static OperationalInsightsWorkspaceData GetWorkspaceData()
         {
-            string rgName = Recording.GenerateAssetName(rgNamePrefix);
-            ResourceGroupData input = new ResourceGroupData(location);
-            var lro = await subscription.GetResourceGroups().CreateOrUpdateAsync(WaitUntil.Completed, rgName, input);
-            return lro.Value;
+            var data = new OperationalInsightsWorkspaceData(AzureLocation.WestUS)
+            {
+                RetentionInDays = 30,
+                Sku = new OperationalInsightsWorkspaceSku(OperationalInsightsWorkspaceSkuName.PerNode),
+                PublicNetworkAccessForIngestion = OperationalInsightsPublicNetworkAccessType.Enabled,
+                PublicNetworkAccessForQuery = OperationalInsightsPublicNetworkAccessType.Enabled,
+            };
+            return data;
         }
+        #endregion
     }
 }