Skip to content

Commit c8ab856

Browse files
lirancLiran Chen
liranc
and
Liran Chen
authored
[Hub Generated] Review request for Microsoft.Security to add version stable/2019-08-01 (#9653)
* iotAlertType * alert type example * add alertType to readme * Autorest warnings * Autorest warnings (2) * fix description * iotAlert * examples * autorest warnings * added to readme * update example * removed vendor * fix example types * Updates * remove vendor * fix def reference * updates * limit and properties property * Remove alert type list * extended properties vs entities * Description * entities * Ran prettier * format * Added totalCount, fixed nextLink example * Update types * move examples * List alert types * example paths * Update tags * warnings * fix example * prettier * case sensitive * Example name Co-authored-by: Liran Chen <[email protected]>
1 parent f49ffcf commit c8ab856

13 files changed

+756
-8
lines changed

‎specification/security/resource-manager/Microsoft.Security/stable/2019-08-01/examples/IoTSecuritySolutionsAnalytics/GetIoTSecuritySolutionsSecurityAggregatedAlert.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
"body": {
1212
"id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/IoT_Bruteforce_Fail/2019-02-02",
1313
"name": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/IoT_Bruteforce_Fail/2019-02-02",
14-
"type": "Microsoft.Security/IoTSecurityAggregatedAlert",
14+
"type": "Microsoft.Security/iotSecuritySolutions/analyticsModels/aggregatedAlerts",
1515
"properties": {
1616
"alertType": "IoT_Bruteforce_Fail",
1717
"alertDisplayName": "Failed Bruteforce",

‎specification/security/resource-manager/Microsoft.Security/stable/2019-08-01/examples/IoTSecuritySolutionsAnalytics/GetIoTSecuritySolutionsSecurityAggregatedAlertList.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
{
1313
"id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/IoT_Bruteforce_Fail/2019-02-02",
1414
"name": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/IoT_Bruteforce_Fail/2019-02-02",
15-
"type": "Microsoft.Security/IoTSecurityAggregatedAlert",
15+
"type": "Microsoft.Security/iotSecuritySolutions/analyticsModels/aggregatedAlerts",
1616
"properties": {
1717
"alertType": "IoT_Bruteforce_Fail",
1818
"alertDisplayName": "Failed Bruteforce",
@@ -43,7 +43,7 @@
4343
{
4444
"id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/IoT_Bruteforce_Success/2019-02-02",
4545
"name": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/IoT_Bruteforce_Success/2019-02-02",
46-
"type": "Microsoft.Security/IoTSecurityAggregatedAlert",
46+
"type": "Microsoft.Security/iotSecuritySolutions/analyticsModels/aggregatedAlerts",
4747
"properties": {
4848
"alertType": "IoT_Bruteforce_Success",
4949
"alertDisplayName": "Successful Bruteforce",

‎specification/security/resource-manager/Microsoft.Security/stable/2019-08-01/examples/IoTSecuritySolutionsAnalytics/GetIoTSecuritySolutionsSecurityAnalytics.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
"body": {
1111
"id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default",
1212
"name": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default",
13-
"type": "Microsoft.Security/IoTSecuritySolutionAnalyticsModel",
13+
"type": "Microsoft.Security/iotSecuritySolutions/analyticsModels",
1414
"properties": {
1515
"metrics": {
1616
"high": 5,

‎specification/security/resource-manager/Microsoft.Security/stable/2019-08-01/examples/IoTSecuritySolutionsAnalytics/GetIoTSecuritySolutionsSecurityAnalyticsList.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
{
1313
"id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default",
1414
"name": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default",
15-
"type": "Microsoft.Security/IoTSecuritySolutionAnalyticsModelList",
15+
"type": "Microsoft.Security/iotSecuritySolutions/analyticsModels",
1616
"properties": {
1717
"metrics": {
1818
"high": 5,

‎specification/security/resource-manager/Microsoft.Security/stable/2019-08-01/examples/IoTSecuritySolutionsAnalytics/GetIoTSecuritySolutionsSecurityRecommendation.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
"body": {
1212
"id": "/subscriptions/075423e9-7d33-4166-8bdf-3920b04e3735/resourceGroups/IoTEdgeResources/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/OpenPortsOnDevice",
1313
"name": "/subscriptions/075423e9-7d33-4166-8bdf-3920b04e3735/resourceGroups/IoTEdgeResources/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/OpenPortsOnDevice",
14-
"type": "Microsoft.Security/IoTSecurityAggregatedRecommendation",
14+
"type": "Microsoft.Security/iotSecuritySolutions/analyticsModels/aggregatedRecommendations",
1515
"properties": {
1616
"recommendationName": "OpenPortsOnDevice",
1717
"recommendationDisplayName": "Permissive firewall policy in one of the chains was found",

‎specification/security/resource-manager/Microsoft.Security/stable/2019-08-01/examples/IoTSecuritySolutionsAnalytics/GetIoTSecuritySolutionsSecurityRecommendationList.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
{
1313
"id": "/subscriptions/075423e9-7d33-4166-8bdf-3920b04e3735/resourceGroups/IoTEdgeResources/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/OpenPortsOnDevice",
1414
"name": "/subscriptions/075423e9-7d33-4166-8bdf-3920b04e3735/resourceGroups/IoTEdgeResources/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/OpenPortsOnDevice",
15-
"type": "Microsoft.Security/IoTSecurityAggregatedRecommendation",
15+
"type": "Microsoft.Security/iotSecuritySolutions/analyticsModels/aggregatedRecommendations",
1616
"properties": {
1717
"recommendationName": "OpenPortsOnDevice",
1818
"recommendationDisplayName": "Permissive firewall policy in one of the chains was found",
@@ -29,7 +29,7 @@
2929
{
3030
"id": "/subscriptions/075423e9-7d33-4166-8bdf-3920b04e3735/resourceGroups/IoTEdgeResources/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/TooLargeIPRange",
3131
"name": "/subscriptions/075423e9-7d33-4166-8bdf-3920b04e3735/resourceGroups/IoTEdgeResources/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/IoT_InstallAgent",
32-
"type": "Microsoft.Security/IoTSecurityAggregatedRecommendation",
32+
"type": "Microsoft.Security/iotSecuritySolutions/analyticsModels/aggregatedRecommendations",
3333
"properties": {
3434
"recommendationName": "TooLargeIPRange",
3535
"recommendationDisplayName": "Permissive firewall policy in one of the chains was found",

‎specification/security/resource-manager/Microsoft.Security/stable/2019-08-01/examples/IotAlertTypes/GetIoTAlertType.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"parameters": {
3+
"api-version": "2019-08-01",
4+
"subscriptionId": "20ff7fc3-e762-44dd-bd96-b71116dcdc23",
5+
"resourceGroupName": "myGroup",
6+
"solutionName": "mySolution",
7+
"iotAlertTypeName": "IoT_PrivilegedContainer"
8+
},
9+
"responses": {
10+
"200": {
11+
"body": {
12+
"id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/myGroup/providers/Microsoft.Security/iotSecuritySolutions/mySolution/iotAlertTypes/IoT_PrivilegedContainer",
13+
"name": "IoT_PrivilegedContainer",
14+
"type": "Microsoft.Security/iotSecuritySolutions/iotAlertTypes",
15+
"properties": {
16+
"alertDisplayName": "Privileged container detected",
17+
"severity": "Medium",
18+
"description": "Machine logs indicate that a privileged Docker container is running. A privileged container has full access to host resources. If compromised, a malicious actor can use the privileged container to gain access to the host machine.",
19+
"providerName": "IoTSecurity",
20+
"remediationSteps": [
21+
"If the container doesn't need to run in privileged mode, remove the privileges from the container."
22+
],
23+
"intent": "Exploitation,Execution",
24+
"vendorName": "Microsoft"
25+
}
26+
}
27+
}
28+
}
29+
}

‎specification/security/resource-manager/Microsoft.Security/stable/2019-08-01/examples/IotAlertTypes/GetIoTAlertTypeList.json‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
{
2+
"parameters": {
3+
"api-version": "2019-08-01",
4+
"subscriptionId": "20ff7fc3-e762-44dd-bd96-b71116dcdc23",
5+
"resourceGroupName": "myGroup",
6+
"solutionName": "mySolution"
7+
},
8+
"responses": {
9+
"200": {
10+
"body": {
11+
"value": [
12+
{
13+
"id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/myGroup/providers/Microsoft.Security/iotSecuritySolutions/mySolution/iotAlertTypes",
14+
"name": "IoT_PrivilegedContainer",
15+
"type": "Microsoft.Security/iotSecuritySolutions/iotAlertTypes",
16+
"properties": {
17+
"alertDisplayName": "Privileged container detected",
18+
"severity": "Medium",
19+
"description": "Machine logs indicate that a privileged Docker container is running. A privileged container has full access to host resources. If compromised, a malicious actor can use the privileged container to gain access to the host machine.",
20+
"providerName": "IoTSecurity",
21+
"remediationSteps": [
22+
"If the container doesn't need to run in privileged mode, remove the privileges from the container."
23+
],
24+
"intent": "Exploitation,Execution",
25+
"vendorName": "Microsoft"
26+
}
27+
}
28+
]
29+
}
30+
}
31+
}
32+
}

‎specification/security/resource-manager/Microsoft.Security/stable/2019-08-01/examples/IotAlerts/GetIoTAlert.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"parameters": {
3+
"api-version": "2019-08-01",
4+
"subscriptionId": "20ff7fc3-e762-44dd-bd96-b71116dcdc23",
5+
"resourceGroupName": "myGroup",
6+
"solutionName": "mySolution",
7+
"iotAlertId": "903e76ff-17eb-4bac-ac8a-2bc31ab68fd8"
8+
},
9+
"responses": {
10+
"200": {
11+
"body": {
12+
"properties": {
13+
"systemAlertId": "903e76ff-17eb-4bac-ac8a-2bc31ab68fd8",
14+
"compromisedEntity": "device-1",
15+
"alertType": "IoT_PrivilegedContainer",
16+
"startTimeUtc": "2020-05-13T06:32:25Z",
17+
"endTimeUtc": "2020-05-13T06:32:25Z",
18+
"entities": [
19+
{
20+
"$id": "1",
21+
"CommandLine": "docker run --privileged",
22+
"Type": "process"
23+
}
24+
],
25+
"extendedProperties": {
26+
"CommandLine": "docker run --privileged",
27+
"User Name": "aUser",
28+
"UserId": "",
29+
"ParentProcessId": 1593,
30+
"DeviceId": "device-1"
31+
}
32+
}
33+
}
34+
}
35+
}
36+
}

‎specification/security/resource-manager/Microsoft.Security/stable/2019-08-01/examples/IotAlerts/GetIoTAlertList.json‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
{
2+
"parameters": {
3+
"api-version": "2019-08-01",
4+
"subscriptionId": "20ff7fc3-e762-44dd-bd96-b71116dcdc23",
5+
"resourceGroupName": "myGroup",
6+
"solutionName": "mySolution",
7+
"alertType": "IoT_PrivilegedContainer",
8+
"startTimeUtc>": "2020-05-12T06:32:25Z",
9+
"startTimeUtc<": "2020-05-14T06:32:25Z",
10+
"$limit": 1
11+
},
12+
"responses": {
13+
"200": {
14+
"body": {
15+
"value": [
16+
{
17+
"properties": {
18+
"systemAlertId": "903e76ff-17eb-4bac-ac8a-2bc31ab68fd8",
19+
"compromisedEntity": "device-1",
20+
"alertType": "IoT_PrivilegedContainer",
21+
"startTimeUtc": "2020-05-13T06:32:25Z",
22+
"endTimeUtc": "2020-05-13T06:32:25Z",
23+
"entities": [
24+
{
25+
"$id": "1",
26+
"CommandLine": "docker run --privileged",
27+
"Type": "process"
28+
}
29+
],
30+
"extendedProperties": {
31+
"CommandLine": "docker run --privileged",
32+
"User Name": "aUser",
33+
"UserId": "",
34+
"ParentProcessId": 1593,
35+
"DeviceId": "device-1"
36+
}
37+
}
38+
}
39+
],
40+
"nextLink": "https://management.azure.com/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/myGroup/providers/Microsoft.Security/iotSecuritySolutions/mySolution/iotAlerts?api-version=2019-08-01&alertType=IoT_PrivilegedContainer&startTimeUtc>=2020-05-12T06:32:25Z&startTimeUtc<=2020-05-14T06:32:25Z&$limit=1&$skipToken=903e76ff-17eb-4bac-ac8a-2bc31ab68fd8",
41+
"totalCount": 23
42+
}
43+
}
44+
}
45+
}

0 commit comments

Comments
 (0)