diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-10-01/AutomationRules.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-10-01/AutomationRules.json
new file mode 100644
index 000000000000..15c4f57c56ce
--- /dev/null
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-10-01/AutomationRules.json
@@ -0,0 +1,953 @@
+{
+  "swagger": "2.0",
+  "info": {
+    "title": "Security Insights",
+    "description": "API spec for Microsoft.SecurityInsights (Azure Security Insights) resource provider",
+    "version": "2021-10-01",
+    "x-ms-code-generation-settings": {
+      "name": "SecurityInsights"
+    }
+  },
+  "paths": {
+    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/automationRules/{automationRuleId}": {
+      "get": {
+        "tags": [
+          "automationRules"
+        ],
+        "description": "Gets the automation rule",
+        "operationId": "AutomationRules_Get",
+        "produces": [
+          "application/json"
+        ],
+        "parameters": [
+          {
+            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ApiVersionParameter"
+          },
+          {
+            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/SubscriptionIdParameter"
+          },
+          {
+            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ResourceGroupNameParameter"
+          },
+          {
+            "$ref": "../../../common/2.0/types.json#/parameters/WorkspaceName"
+          },
+          {
+            "$ref": "#/parameters/AutomationRuleId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Ok",
+            "schema": {
+              "$ref": "#/definitions/AutomationRule"
+            }
+          },
+          "default": {
+            "description": "Error response describing why the operation failed.",
+            "schema": {
+              "$ref": "../../../common/2.0/types.json#/definitions/CloudError"
+            }
+          }
+        },
+        "x-ms-examples": {
+          "AutomationRules_Get": {
+            "$ref": "./examples/automationRules/AutomationRules_Get.json"
+          }
+        }
+      },
+      "put": {
+        "tags": [
+          "automationRules"
+        ],
+        "description": "Creates or updates the automation rule",
+        "operationId": "AutomationRules_CreateOrUpdate",
+        "consumes": [
+          "application/json"
+        ],
+        "produces": [
+          "application/json"
+        ],
+        "parameters": [
+          {
+            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ApiVersionParameter"
+          },
+          {
+            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/SubscriptionIdParameter"
+          },
+          {
+            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ResourceGroupNameParameter"
+          },
+          {
+            "$ref": "../../../common/2.0/types.json#/parameters/WorkspaceName"
+          },
+          {
+            "$ref": "#/parameters/AutomationRuleId"
+          },
+          {
+            "in": "body",
+            "name": "automationRuleToUpsert",
+            "description": "The automation rule",
+            "schema": {
+              "$ref": "#/definitions/AutomationRule"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Ok",
+            "schema": {
+              "$ref": "#/definitions/AutomationRule"
+            }
+          },
+          "201": {
+            "description": "Created",
+            "schema": {
+              "$ref": "#/definitions/AutomationRule"
+            }
+          },
+          "default": {
+            "description": "Error response describing why the operation failed.",
+            "schema": {
+              "$ref": "../../../common/2.0/types.json#/definitions/CloudError"
+            }
+          }
+        },
+        "x-ms-examples": {
+          "AutomationRules_CreateOrUpdate": {
+            "$ref": "./examples/automationRules/AutomationRules_CreateOrUpdate.json"
+          }
+        }
+      },
+      "delete": {
+        "tags": [
+          "automationRules"
+        ],
+        "description": "Delete the automation rule",
+        "operationId": "AutomationRules_Delete",
+        "produces": [
+          "application/json"
+        ],
+        "parameters": [
+          {
+            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ApiVersionParameter"
+          },
+          {
+            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/SubscriptionIdParameter"
+          },
+          {
+            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ResourceGroupNameParameter"
+          },
+          {
+            "$ref": "../../../common/2.0/types.json#/parameters/WorkspaceName"
+          },
+          {
+            "$ref": "#/parameters/AutomationRuleId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Ok",
+            "schema": {
+              "type": "object"
+            }
+          },
+          "204": {
+            "description": "No Content",
+            "schema": {
+              "type": "object"
+            }
+          },
+          "default": {
+            "description": "Error response describing why the operation failed.",
+            "schema": {
+              "$ref": "../../../common/2.0/types.json#/definitions/CloudError"
+            }
+          }
+        },
+        "x-ms-examples": {
+          "AutomationRules_Delete": {
+            "$ref": "./examples/automationRules/AutomationRules_Delete.json"
+          }
+        }
+      }
+    },
+    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/automationRules": {
+      "get": {
+        "tags": [
+          "automationRules"
+        ],
+        "description": "Gets all automation rules",
+        "operationId": "AutomationRules_List",
+        "produces": [
+          "application/json"
+        ],
+        "parameters": [
+          {
+            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ApiVersionParameter"
+          },
+          {
+            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/SubscriptionIdParameter"
+          },
+          {
+            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ResourceGroupNameParameter"
+          },
+          {
+            "$ref": "../../../common/2.0/types.json#/parameters/WorkspaceName"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Ok",
+            "schema": {
+              "$ref": "#/definitions/AutomationRulesList"
+            }
+          },
+          "default": {
+            "description": "Error response describing why the operation failed.",
+            "schema": {
+              "$ref": "../../../common/2.0/types.json#/definitions/CloudError"
+            }
+          }
+        },
+        "x-ms-pageable": {
+          "nextLinkName": "nextLink"
+        },
+        "x-ms-examples": {
+          "AutomationRules_List": {
+            "$ref": "./examples/automationRules/AutomationRules_List.json"
+          }
+        }
+      }
+    }
+  },
+  "definitions": {
+    "ActionType": {
+      "description": "The type of the automation rule action",
+      "enum": [
+        "ModifyProperties",
+        "RunPlaybook"
+      ],
+      "type": "string",
+      "example": "ModifyProperties",
+      "x-ms-enum": {
+        "name": "ActionType",
+        "modelAsString": true,
+        "values": [
+          {
+            "value": "ModifyProperties",
+            "description": "Modify an object's properties"
+          },
+          {
+            "value": "RunPlaybook",
+            "description": "Run a playbook on an object"
+          }
+        ]
+      }
+    },
+    "AutomationRule": {
+      "required": [
+        "properties"
+      ],
+      "type": "object",
+      "allOf": [
+        {
+          "$ref": "../../../common/2.0/types.json#/definitions/ResourceWithEtag"
+        }
+      ],
+      "properties": {
+        "properties": {
+          "type": "object",
+          "$ref": "#/definitions/AutomationRuleProperties",
+          "x-ms-client-flatten": true
+        }
+      }
+    },
+    "AutomationRuleAction": {
+      "description": "Describes an automation rule action",
+      "required": [
+        "actionType",
+        "order"
+      ],
+      "type": "object",
+      "properties": {
+        "order": {
+          "format": "int32",
+          "type": "integer"
+        },
+        "actionType": {
+          "$ref": "#/definitions/ActionType"
+        }
+      },
+      "discriminator": "actionType"
+    },
+    "AutomationRuleCondition": {
+      "description": "Describes an automation rule condition",
+      "required": [
+        "conditionType"
+      ],
+      "type": "object",
+      "properties": {
+        "conditionType": {
+          "$ref": "#/definitions/ConditionType"
+        }
+      },
+      "discriminator": "conditionType"
+    },
+    "AutomationRuleModifyPropertiesAction": {
+      "description": "Describes an automation rule action to modify an object's properties.",
+      "type": "object",
+      "allOf": [
+        {
+          "$ref": "#/definitions/AutomationRuleAction"
+        }
+      ],
+      "properties": {
+        "actionConfiguration": {
+          "type": "object",
+          "x-ms-client-flatten": true,
+          "$ref": "#/definitions/IncidentPropertiesAction"
+        }
+      },
+      "x-ms-discriminator-value": "ModifyProperties"
+    },
+    "AutomationRuleProperties": {
+      "description": "Automation rule properties",
+      "required": [
+        "actions",
+        "displayName",
+        "order",
+        "triggeringLogic"
+      ],
+      "type": "object",
+      "properties": {
+        "displayName": {
+          "description": "The display name of the automation rule",
+          "type": "string",
+          "maxLength": 500
+        },
+        "order": {
+          "format": "int32",
+          "description": "The order of execution of the automation rule",
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 1000
+        },
+        "triggeringLogic": {
+          "$ref": "#/definitions/AutomationRuleTriggeringLogic"
+        },
+        "actions": {
+          "description": "The actions to execute when the automation rule is triggered",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/AutomationRuleAction"
+          },
+          "x-ms-identifiers": [],
+          "maxItems": 20
+        },
+        "lastModifiedTimeUtc": {
+          "format": "date-time",
+          "description": "The last time the automation rule was updated",
+          "type": "string",
+          "readOnly": true
+        },
+        "createdTimeUtc": {
+          "format": "date-time",
+          "description": "The time the automation rule was created",
+          "type": "string",
+          "readOnly": true
+        },
+        "lastModifiedBy": {
+          "readOnly": true,
+          "$ref": "../../../common/2.0/types.json#/definitions/ClientInfo"
+        },
+        "createdBy": {
+          "readOnly": true,
+          "$ref": "../../../common/2.0/types.json#/definitions/ClientInfo"
+        }
+      }
+    },
+    "AutomationRulePropertyConditionSupportedOperator": {
+      "enum": [
+        "Equals",
+        "NotEquals",
+        "Contains",
+        "NotContains",
+        "StartsWith",
+        "NotStartsWith",
+        "EndsWith",
+        "NotEndsWith"
+      ],
+      "type": "string",
+      "example": "Equals",
+      "x-ms-enum": {
+        "name": "AutomationRulePropertyConditionSupportedOperator",
+        "modelAsString": true,
+        "values": [
+          {
+            "value": "Equals",
+            "description": "Evaluates if the property equals at least one of the condition values"
+          },
+          {
+            "value": "NotEquals",
+            "description": "Evaluates if the property does not equal any of the condition values"
+          },
+          {
+            "value": "Contains",
+            "description": "Evaluates if the property contains at least one of the condition values"
+          },
+          {
+            "value": "NotContains",
+            "description": "Evaluates if the property does not contain any of the condition values"
+          },
+          {
+            "value": "StartsWith",
+            "description": "Evaluates if the property starts with any of the condition values"
+          },
+          {
+            "value": "NotStartsWith",
+            "description": "Evaluates if the property does not start with any of the condition values"
+          },
+          {
+            "value": "EndsWith",
+            "description": "Evaluates if the property ends with any of the condition values"
+          },
+          {
+            "value": "NotEndsWith",
+            "description": "Evaluates if the property does not end with any of the condition values"
+          }
+        ]
+      }
+    },
+    "AutomationRulePropertyConditionSupportedProperty": {
+      "description": "The property to evaluate in an automation rule property condition",
+      "enum": [
+        "IncidentTitle",
+        "IncidentDescription",
+        "IncidentSeverity",
+        "IncidentStatus",
+        "IncidentRelatedAnalyticRuleIds",
+        "IncidentTactics",
+        "IncidentProviderName",
+        "AccountAadTenantId",
+        "AccountAadUserId",
+        "AccountName",
+        "AccountNTDomain",
+        "AccountPUID",
+        "AccountSid",
+        "AccountObjectGuid",
+        "AccountUPNSuffix",
+        "AlertProductNames",
+        "AzureResourceResourceId",
+        "AzureResourceSubscriptionId",
+        "CloudApplicationAppId",
+        "CloudApplicationAppName",
+        "DNSDomainName",
+        "FileDirectory",
+        "FileName",
+        "FileHashValue",
+        "HostAzureID",
+        "HostName",
+        "HostNetBiosName",
+        "HostNTDomain",
+        "HostOSVersion",
+        "IoTDeviceId",
+        "IoTDeviceName",
+        "IoTDeviceType",
+        "IoTDeviceVendor",
+        "IoTDeviceModel",
+        "IoTDeviceOperatingSystem",
+        "IPAddress",
+        "MailboxDisplayName",
+        "MailboxPrimaryAddress",
+        "MailboxUPN",
+        "MailMessageDeliveryAction",
+        "MailMessageDeliveryLocation",
+        "MailMessageRecipient",
+        "MailMessageSenderIP",
+        "MailMessageSubject",
+        "MailMessageP1Sender",
+        "MailMessageP2Sender",
+        "MalwareCategory",
+        "MalwareName",
+        "ProcessCommandLine",
+        "ProcessId",
+        "RegistryKey",
+        "RegistryValueData",
+        "Url"
+      ],
+      "type": "string",
+      "example": "IncidentTitle",
+      "x-ms-enum": {
+        "name": "AutomationRulePropertyConditionSupportedProperty",
+        "modelAsString": true,
+        "values": [
+          {
+            "value": "IncidentTitle",
+            "description": "The title of the incident"
+          },
+          {
+            "value": "IncidentDescription",
+            "description": "The description of the incident"
+          },
+          {
+            "value": "IncidentSeverity",
+            "description": "The severity of the incident"
+          },
+          {
+            "value": "IncidentStatus",
+            "description": "The status of the incident"
+          },
+          {
+            "value": "IncidentRelatedAnalyticRuleIds",
+            "description": "The related Analytic rule ids of the incident"
+          },
+          {
+            "value": "IncidentTactics",
+            "description": "The tactics of the incident"
+          },
+          {
+            "value": "IncidentProviderName",
+            "description": "The provider name of the incident"
+          },
+          {
+            "value": "AccountAadTenantId",
+            "description": "The account Azure Active Directory tenant id"
+          },
+          {
+            "value": "AccountAadUserId",
+            "description": "The account Azure Active Directory user id"
+          },
+          {
+            "value": "AccountName",
+            "description": "The account name"
+          },
+          {
+            "value": "AccountNTDomain",
+            "description": "The account NetBIOS domain name"
+          },
+          {
+            "value": "AccountPUID",
+            "description": "The account Azure Active Directory Passport User ID"
+          },
+          {
+            "value": "AccountSid",
+            "description": "The account security identifier"
+          },
+          {
+            "value": "AccountObjectGuid",
+            "description": "The account unique identifier"
+          },
+          {
+            "value": "AccountUPNSuffix",
+            "description": "The account user principal name suffix"
+          },
+          {
+            "value": "AlertProductNames",
+            "description": "The name of the product of the alert"
+          },
+          {
+            "value": "AzureResourceResourceId",
+            "description": "The Azure resource id"
+          },
+          {
+            "value": "AzureResourceSubscriptionId",
+            "description": "The Azure resource subscription id"
+          },
+          {
+            "value": "CloudApplicationAppId",
+            "description": "The cloud application identifier"
+          },
+          {
+            "value": "CloudApplicationAppName",
+            "description": "The cloud application name"
+          },
+          {
+            "value": "DNSDomainName",
+            "description": "The dns record domain name"
+          },
+          {
+            "value": "FileDirectory",
+            "description": "The file directory full path"
+          },
+          {
+            "value": "FileName",
+            "description": "The file name without path"
+          },
+          {
+            "value": "FileHashValue",
+            "description": "The file hash value"
+          },
+          {
+            "value": "HostAzureID",
+            "description": "The host Azure resource id"
+          },
+          {
+            "value": "HostName",
+            "description": "The host name without domain"
+          },
+          {
+            "value": "HostNetBiosName",
+            "description": "The host NetBIOS name"
+          },
+          {
+            "value": "HostNTDomain",
+            "description": "The host NT domain"
+          },
+          {
+            "value": "HostOSVersion",
+            "description": "The host operating system"
+          },
+          {
+            "value": "IoTDeviceId",
+            "description": "\"The IoT device id"
+          },
+          {
+            "value": "IoTDeviceName",
+            "description": "The IoT device name"
+          },
+          {
+            "value": "IoTDeviceType",
+            "description": "The IoT device type"
+          },
+          {
+            "value": "IoTDeviceVendor",
+            "description": "The IoT device vendor"
+          },
+          {
+            "value": "IoTDeviceModel",
+            "description": "The IoT device model"
+          },
+          {
+            "value": "IoTDeviceOperatingSystem",
+            "description": "The IoT device operating system"
+          },
+          {
+            "value": "IPAddress",
+            "description": "The IP address"
+          },
+          {
+            "value": "MailboxDisplayName",
+            "description": "The mailbox display name"
+          },
+          {
+            "value": "MailboxPrimaryAddress",
+            "description": "The mailbox primary address"
+          },
+          {
+            "value": "MailboxUPN",
+            "description": "The mailbox user principal name"
+          },
+          {
+            "value": "MailMessageDeliveryAction",
+            "description": "The mail message delivery action"
+          },
+          {
+            "value": "MailMessageDeliveryLocation",
+            "description": "The mail message delivery location"
+          },
+          {
+            "value": "MailMessageRecipient",
+            "description": "The mail message recipient"
+          },
+          {
+            "value": "MailMessageSenderIP",
+            "description": "The mail message sender IP address"
+          },
+          {
+            "value": "MailMessageSubject",
+            "description": "The mail message subject"
+          },
+          {
+            "value": "MailMessageP1Sender",
+            "description": "The mail message P1 sender"
+          },
+          {
+            "value": "MailMessageP2Sender",
+            "description": "The mail message P2 sender"
+          },
+          {
+            "value": "MalwareCategory",
+            "description": "The malware category"
+          },
+          {
+            "value": "MalwareName",
+            "description": "The malware name"
+          },
+          {
+            "value": "ProcessCommandLine",
+            "description": "The process execution command line"
+          },
+          {
+            "value": "ProcessId",
+            "description": "The process id"
+          },
+          {
+            "value": "RegistryKey",
+            "description": "The registry key path"
+          },
+          {
+            "value": "RegistryValueData",
+            "description": "The registry key value in string formatted representation"
+          },
+          {
+            "value": "Url",
+            "description": "The url"
+          }
+        ]
+      }
+    },
+    "AutomationRulePropertyValuesCondition": {
+      "type": "object",
+      "properties": {
+        "propertyName": {
+          "$ref": "#/definitions/AutomationRulePropertyConditionSupportedProperty"
+        },
+        "operator": {
+          "$ref": "#/definitions/AutomationRulePropertyConditionSupportedOperator"
+        },
+        "propertyValues": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "AutomationRuleRunPlaybookAction": {
+      "description": "Describes an automation rule action to run a playbook",
+      "type": "object",
+      "allOf": [
+        {
+          "$ref": "#/definitions/AutomationRuleAction"
+        }
+      ],
+      "properties": {
+        "actionConfiguration": {
+          "type": "object",
+          "x-ms-client-flatten": true,
+          "$ref": "#/definitions/PlaybookActionProperties"
+        }
+      },
+      "x-ms-discriminator-value": "RunPlaybook"
+    },
+    "AutomationRulesList": {
+      "type": "object",
+      "properties": {
+        "value": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/AutomationRule"
+          }
+        },
+        "nextLink": {
+          "type": "string"
+        }
+      }
+    },
+    "AutomationRuleTriggeringLogic": {
+      "description": "Describes automation rule triggering logic",
+      "required": [
+        "isEnabled",
+        "triggersOn",
+        "triggersWhen"
+      ],
+      "type": "object",
+      "properties": {
+        "isEnabled": {
+          "description": "Determines whether the automation rule is enabled or disabled",
+          "type": "boolean"
+        },
+        "expirationTimeUtc": {
+          "format": "date-time",
+          "description": "Determines when the automation rule should automatically expire and be disabled.",
+          "type": "string"
+        },
+        "triggersOn": {
+          "$ref": "#/definitions/triggersOn"
+        },
+        "triggersWhen": {
+          "$ref": "#/definitions/triggersWhen"
+        },
+        "conditions": {
+          "description": "The conditions to evaluate to determine if the automation rule should be triggered on a given object",
+          "type": "array",
+          "maxItems": 50,
+          "items": {
+            "$ref": "#/definitions/AutomationRuleCondition"
+          },
+          "x-ms-identifiers": [
+            "conditionType"
+          ]
+        }
+      }
+    },
+    "ConditionType": {
+      "enum": [
+        "Property"
+      ],
+      "type": "string",
+      "example": "Property",
+      "x-ms-enum": {
+        "name": "ConditionType",
+        "modelAsString": true,
+        "values": [
+          {
+            "value": "Property",
+            "description": "Evaluate an object property value"
+          }
+        ]
+      }
+    },
+    "IncidentPropertiesAction": {
+      "type": "object",
+      "properties": {
+        "severity": {
+          "$ref": "./common/IncidentTypes.json#/definitions/IncidentSeverityEnum"
+        },
+        "status": {
+          "$ref": "./common/IncidentTypes.json#/definitions/IncidentStatusEnum"
+        },
+        "classification": {
+          "$ref": "./common/IncidentTypes.json#/definitions/IncidentClassificationEnum"
+        },
+        "classificationReason": {
+          "$ref": "./common/IncidentTypes.json#/definitions/IncidentClassificationReasonEnum"
+        },
+        "classificationComment": {
+          "description": "Describes the reason the incident was closed",
+          "type": "string"
+        },
+        "owner": {
+          "$ref": "./common/IncidentTypes.json#/definitions/IncidentOwnerInfo"
+        },
+        "labels": {
+          "description": "List of labels to add to the incident",
+          "type": "array",
+          "x-ms-identifiers": [
+            "labelName"
+          ],
+          "items": {
+            "$ref": "./common/IncidentTypes.json#/definitions/IncidentLabel"
+          }
+        }
+      }
+    },
+    "PlaybookActionProperties": {
+      "type": "object",
+      "required": [
+        "logicAppResourceId"
+      ],
+      "properties": {
+        "logicAppResourceId": {
+          "description": "The resource id of the playbook resource",
+          "type": "string"
+        },
+        "tenantId": {
+          "format": "uuid",
+          "description": "The tenant id of the playbook resource",
+          "type": "string"
+        }
+      }
+    },
+    "PropertyConditionProperties": {
+      "description": "Describes an automation rule condition that evaluates a property's value",
+      "type": "object",
+      "allOf": [
+        {
+          "$ref": "#/definitions/AutomationRuleCondition"
+        }
+      ],
+      "properties": {
+        "conditionProperties": {
+          "type": "object",
+          "x-ms-client-flatten": true,
+          "$ref": "#/definitions/AutomationRulePropertyValuesCondition"
+        }
+      },
+      "x-ms-discriminator-value": "Property"
+    },
+    "triggersOn": {
+      "enum": [
+        "Incidents"
+      ],
+      "type": "string",
+      "example": "Incidents",
+      "x-ms-enum": {
+        "name": "triggersOn",
+        "modelAsString": true,
+        "values": [
+          {
+            "value": "Incidents",
+            "description": "Trigger on Incidents"
+          }
+        ]
+      }
+    },
+    "triggersWhen": {
+      "enum": [
+        "Created"
+      ],
+      "type": "string",
+      "example": "Created",
+      "x-ms-enum": {
+        "name": "triggersWhen",
+        "modelAsString": true,
+        "values": [
+          {
+            "value": "Created",
+            "description": "Trigger on created objects"
+          }
+        ]
+      }
+    }
+  },
+  "parameters": {
+    "AutomationRule": {
+      "name": "automationRule",
+      "description": "The automation rule",
+      "required": true,
+      "in": "body",
+      "x-ms-parameter-location": "method",
+      "schema": {
+        "$ref": "#/definitions/AutomationRule"
+      }
+    },
+    "AutomationRuleId": {
+      "in": "path",
+      "name": "automationRuleId",
+      "description": "Automation rule ID",
+      "required": true,
+      "x-ms-parameter-location": "method",
+      "type": "string"
+    }
+  },
+  "securityDefinitions": {
+    "azure_auth": {
+      "type": "oauth2",
+      "flow": "implicit",
+      "authorizationUrl": "https://login.microsoftonline.com/common/oauth2/authorize",
+      "scopes": {
+        "user_impersonation": "impersonate your user account"
+      },
+      "description": "Azure Active Directory OAuth2 Flow"
+    }
+  },
+  "security": [
+    {
+      "azure_auth": [
+        "user_impersonation"
+      ]
+    }
+  ],
+  "host": "management.azure.com",
+  "schemes": [
+    "https"
+  ],
+  "produces": [
+    "application/json"
+  ],
+  "consumes": [
+    "application/json"
+  ]
+}
diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-10-01/Incidents.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-10-01/Incidents.json
index 3a1f8c719e63..63e83d17c53a 100644
--- a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-10-01/Incidents.json
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-10-01/Incidents.json
@@ -1049,42 +1049,6 @@
       ],
       "type": "object"
     },
-    "IncidentLabel": {
-      "description": "Represents an incident label",
-      "properties": {
-        "labelName": {
-          "description": "The name of the label",
-          "type": "string"
-        },
-        "labelType": {
-          "description": "The type of the label",
-          "enum": [
-            "User",
-            "System"
-          ],
-          "type": "string",
-          "readOnly": true,
-          "x-ms-enum": {
-            "modelAsString": true,
-            "name": "IncidentLabelType",
-            "values": [
-              {
-                "description": "Label manually created by a user",
-                "value": "User"
-              },
-              {
-                "description": "Label automatically created by the system",
-                "value": "System"
-              }
-            ]
-          }
-        }
-      },
-      "required": [
-        "labelName"
-      ],
-      "type": "object"
-    },
     "IncidentList": {
       "description": "List all the incidents.",
       "properties": {
@@ -1235,7 +1199,7 @@
         "labels": {
           "description": "List of labels relevant to this incident",
           "items": {
-            "$ref": "#/definitions/IncidentLabel"
+            "$ref": "./common/IncidentTypes.json#/definitions/IncidentLabel"
           },
           "type": "array"
         },
diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-10-01/common/IncidentTypes.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-10-01/common/IncidentTypes.json
index bc48c6e705bd..a10746d06aca 100644
--- a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-10-01/common/IncidentTypes.json
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-10-01/common/IncidentTypes.json
@@ -6,6 +6,109 @@
   },
   "paths": {},
   "definitions": {
+    "IncidentClassificationEnum": {
+      "description": "The reason the incident was closed",
+      "enum": [
+        "Undetermined",
+        "TruePositive",
+        "BenignPositive",
+        "FalsePositive"
+      ],
+      "type": "string",
+      "x-ms-enum": {
+        "modelAsString": true,
+        "name": "IncidentClassification",
+        "values": [
+          {
+            "description": "Incident classification was undetermined",
+            "value": "Undetermined"
+          },
+          {
+            "description": "Incident was true positive",
+            "value": "TruePositive"
+          },
+          {
+            "description": "Incident was benign positive",
+            "value": "BenignPositive"
+          },
+          {
+            "description": "Incident was false positive",
+            "value": "FalsePositive"
+          }
+        ]
+      }
+    },
+    "IncidentClassificationReasonEnum": {
+      "description": "The classification reason the incident was closed with",
+      "enum": [
+        "SuspiciousActivity",
+        "SuspiciousButExpected",
+        "IncorrectAlertLogic",
+        "InaccurateData"
+      ],
+      "type": "string",
+      "x-ms-enum": {
+        "modelAsString": true,
+        "name": "IncidentClassificationReason",
+        "values": [
+          {
+            "description": "Classification reason was suspicious activity",
+            "value": "SuspiciousActivity"
+          },
+          {
+            "description": "Classification reason was suspicious but expected",
+            "value": "SuspiciousButExpected"
+          },
+          {
+            "description": "Classification reason was incorrect alert logic",
+            "value": "IncorrectAlertLogic"
+          },
+          {
+            "description": "Classification reason was inaccurate data",
+            "value": "InaccurateData"
+          }
+        ]
+      }
+    },
+    "IncidentLabel": {
+      "description": "Represents an incident label",
+      "properties": {
+        "labelName": {
+          "description": "The name of the label",
+          "type": "string"
+        },
+        "labelType": {
+          "$ref": "#/definitions/IncidentLabelType"
+        }
+      },
+      "required": [
+        "labelName"
+      ],
+      "type": "object"
+    },
+    "IncidentLabelType": {
+      "description": "The type of the label",
+      "enum": [
+        "User",
+        "AutoAssigned"
+      ],
+      "type": "string",
+      "readOnly": true,
+      "x-ms-enum": {
+        "modelAsString": true,
+        "name": "IncidentLabelType",
+        "values": [
+          {
+            "description": "Label manually created by a user",
+            "value": "User"
+          },
+          {
+            "description": "Label automatically created by the system",
+            "value": "AutoAssigned"
+          }
+        ]
+      }
+    },
     "IncidentSeverityEnum": {
       "description": "The severity of the incident",
       "enum": [
@@ -38,6 +141,83 @@
         ]
       }
     },
+    "IncidentStatusEnum": {
+      "description": "The status of the incident",
+      "enum": [
+        "New",
+        "Active",
+        "Closed"
+      ],
+      "type": "string",
+      "x-ms-enum": {
+        "modelAsString": true,
+        "name": "IncidentStatus",
+        "values": [
+          {
+            "description": "An active incident which isn't being handled currently",
+            "value": "New"
+          },
+          {
+            "description": "An active incident which is being handled",
+            "value": "Active"
+          },
+          {
+            "description": "A non-active incident",
+            "value": "Closed"
+          }
+        ]
+      }
+    },
+    "IncidentOwnerInfo": {
+      "description": "Information on the user an incident is assigned to",
+      "properties": {
+        "email": {
+          "description": "The email of the user the incident is assigned to.",
+          "type": "string"
+        },
+        "assignedTo": {
+          "description": "The name of the user the incident is assigned to.",
+          "type": "string"
+        },
+        "objectId": {
+          "description": "The object id of the user the incident is assigned to.",
+          "format": "uuid",
+          "type": "string"
+        },
+        "userPrincipalName": {
+          "description": "The user principal name of the user the incident is assigned to.",
+          "type": "string"
+        },
+        "ownerType": {
+          "description": "The type of the owner the incident is assigned to.",
+          "type": "string",
+          "enum": [
+            "Unknown",
+            "User",
+            "Group"
+          ],
+          "x-ms-enum": {
+            "modelAsString": true,
+            "name": "OwnerType",
+            "values": [
+              {
+                "description": "The incident owner type is unknown",
+                "value": "Unknown"
+              },
+              {
+                "description": "The incident owner type is an AAD user",
+                "value": "User"
+              },
+              {
+                "description": "The incident owner type is an AAD group",
+                "value": "Group"
+              }
+            ]
+          }
+        }
+      },
+      "type": "object"
+    },
     "IncidentInfo": {
       "description": "Describes related incident information for the bookmark",
       "properties": {
diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-10-01/examples/automationRules/AutomationRules_CreateOrUpdate.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-10-01/examples/automationRules/AutomationRules_CreateOrUpdate.json
new file mode 100644
index 000000000000..be8007fef276
--- /dev/null
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-10-01/examples/automationRules/AutomationRules_CreateOrUpdate.json
@@ -0,0 +1,168 @@
+{
+  "parameters": {
+    "api-version": "2021-10-01",
+    "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+    "resourceGroupName": "myRg",
+    "workspaceName": "myWorkspace",
+    "automationRuleId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+    "automationRule": {
+      "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/automationRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+      "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+      "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
+      "type": "Microsoft.SecurityInsights/automationRules",
+      "properties": {
+        "displayName": "High severity incidents escalation",
+        "order": 1,
+        "triggeringLogic": {
+          "isEnabled": true,
+          "triggersOn": "Incidents",
+          "triggersWhen": "Created",
+          "conditions": [
+            {
+              "conditionType": "Property",
+              "conditionProperties": {
+                "propertyName": "IncidentRelatedAnalyticRuleIds",
+                "operator": "Contains",
+                "propertyValues": [
+                  "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/fab3d2d4-747f-46a7-8ef0-9c0be8112bf7",
+                  "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/8deb8303-e94d-46ff-96e0-5fd94b33df1a"
+                ]
+              }
+            }
+          ]
+        },
+        "actions": [
+          {
+            "order": 1,
+            "actionType": "ModifyProperties",
+            "actionConfiguration": {
+              "severity": "High"
+            }
+          }
+        ],
+        "lastModifiedTimeUtc": "2019-01-01T13:00:30Z",
+        "createdTimeUtc": "2019-01-01T13:00:00Z",
+        "lastModifiedBy": {
+          "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
+          "email": "john.doe@contoso.com",
+          "name": "john doe",
+          "userPrincipalName": "john@contoso.com"
+        },
+        "createdBy": {
+          "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
+          "email": "john.doe@contoso.com",
+          "name": "john doe",
+          "userPrincipalName": "john@contoso.com"
+        }
+      }
+    }
+  },
+  "responses": {
+    "200": {
+      "body": {
+        "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/automationRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+        "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+        "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
+        "type": "Microsoft.SecurityInsights/automationRules",
+        "properties": {
+          "displayName": "High severity incidents escalation",
+          "order": 1,
+          "triggeringLogic": {
+            "isEnabled": true,
+            "triggersOn": "Incidents",
+            "triggersWhen": "Created",
+            "conditions": [
+              {
+                "conditionType": "Property",
+                "conditionProperties": {
+                  "propertyName": "IncidentRelatedAnalyticRuleIds",
+                  "operator": "Contains",
+                  "propertyValues": [
+                    "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/fab3d2d4-747f-46a7-8ef0-9c0be8112bf7",
+                    "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/8deb8303-e94d-46ff-96e0-5fd94b33df1a"
+                  ]
+                }
+              }
+            ]
+          },
+          "actions": [
+            {
+              "order": 1,
+              "actionType": "ModifyProperties",
+              "actionConfiguration": {
+                "severity": "High"
+              }
+            }
+          ],
+          "lastModifiedTimeUtc": "2019-01-01T13:00:30Z",
+          "createdTimeUtc": "2019-01-01T13:00:00Z",
+          "lastModifiedBy": {
+            "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
+            "email": "john.doe@contoso.com",
+            "name": "john doe",
+            "userPrincipalName": "john@contoso.com"
+          },
+          "createdBy": {
+            "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
+            "email": "john.doe@contoso.com",
+            "name": "john doe",
+            "userPrincipalName": "john@contoso.com"
+          }
+        }
+      }
+    },
+    "201": {
+      "body": {
+        "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/automationRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+        "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+        "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
+        "type": "Microsoft.SecurityInsights/automationRules",
+        "properties": {
+          "displayName": "High severity incidents escalation",
+          "order": 1,
+          "triggeringLogic": {
+            "isEnabled": true,
+            "triggersOn": "Incidents",
+            "triggersWhen": "Created",
+            "conditions": [
+              {
+                "conditionType": "Property",
+                "conditionProperties": {
+                  "propertyName": "IncidentRelatedAnalyticRuleIds",
+                  "operator": "Contains",
+                  "propertyValues": [
+                    "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/fab3d2d4-747f-46a7-8ef0-9c0be8112bf7",
+                    "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/8deb8303-e94d-46ff-96e0-5fd94b33df1a"
+                  ]
+                }
+              }
+            ]
+          },
+          "actions": [
+            {
+              "order": 1,
+              "actionType": "ModifyProperties",
+              "actionConfiguration": {
+                "severity": "High"
+              }
+            }
+          ],
+          "lastModifiedTimeUtc": "2019-01-01T13:00:30Z",
+          "createdTimeUtc": "2019-01-01T13:00:00Z",
+          "lastModifiedBy": {
+            "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
+            "email": "john.doe@contoso.com",
+            "name": "john doe",
+            "userPrincipalName": "john@contoso.com"
+          },
+          "createdBy": {
+            "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
+            "email": "john.doe@contoso.com",
+            "name": "john doe",
+            "userPrincipalName": "john@contoso.com"
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-10-01/examples/automationRules/AutomationRules_Delete.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-10-01/examples/automationRules/AutomationRules_Delete.json
new file mode 100644
index 000000000000..56826c8367e8
--- /dev/null
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-10-01/examples/automationRules/AutomationRules_Delete.json
@@ -0,0 +1,17 @@
+{
+  "parameters": {
+    "api-version": "2021-10-01",
+    "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+    "resourceGroupName": "myRg",
+    "workspaceName": "myWorkspace",
+    "automationRuleId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5"
+  },
+  "responses": {
+    "200": {
+      "body": {}
+    },
+    "204": {
+      "body": {}
+    }
+  }
+}
diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-10-01/examples/automationRules/AutomationRules_Get.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-10-01/examples/automationRules/AutomationRules_Get.json
new file mode 100644
index 000000000000..ee32f18f53cc
--- /dev/null
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-10-01/examples/automationRules/AutomationRules_Get.json
@@ -0,0 +1,64 @@
+{
+  "parameters": {
+    "api-version": "2021-10-01",
+    "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+    "resourceGroupName": "myRg",
+    "workspaceName": "myWorkspace",
+    "automationRuleId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5"
+  },
+  "responses": {
+    "200": {
+      "body": {
+        "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/automationRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+        "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+        "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
+        "type": "Microsoft.SecurityInsights/automationRules",
+        "properties": {
+          "displayName": "High severity incidents escalation",
+          "order": 1,
+          "triggeringLogic": {
+            "isEnabled": true,
+            "triggersOn": "Incidents",
+            "triggersWhen": "Created",
+            "conditions": [
+              {
+                "conditionType": "Property",
+                "conditionProperties": {
+                  "propertyName": "IncidentRelatedAnalyticRuleIds",
+                  "operator": "Contains",
+                  "propertyValues": [
+                    "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/fab3d2d4-747f-46a7-8ef0-9c0be8112bf7",
+                    "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/8deb8303-e94d-46ff-96e0-5fd94b33df1a"
+                  ]
+                }
+              }
+            ]
+          },
+          "actions": [
+            {
+              "order": 1,
+              "actionType": "ModifyProperties",
+              "actionConfiguration": {
+                "severity": "High"
+              }
+            }
+          ],
+          "lastModifiedTimeUtc": "2019-01-01T13:00:30Z",
+          "createdTimeUtc": "2019-01-01T13:00:00Z",
+          "lastModifiedBy": {
+            "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
+            "email": "john.doe@contoso.com",
+            "name": "john doe",
+            "userPrincipalName": "john@contoso.com"
+          },
+          "createdBy": {
+            "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
+            "email": "john.doe@contoso.com",
+            "name": "john doe",
+            "userPrincipalName": "john@contoso.com"
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-10-01/examples/automationRules/AutomationRules_List.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-10-01/examples/automationRules/AutomationRules_List.json
new file mode 100644
index 000000000000..b51b48bbf628
--- /dev/null
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-10-01/examples/automationRules/AutomationRules_List.json
@@ -0,0 +1,67 @@
+{
+  "parameters": {
+    "api-version": "2021-10-01-preview",
+    "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+    "resourceGroupName": "myRg",
+    "workspaceName": "myWorkspace"
+  },
+  "responses": {
+    "200": {
+      "body": {
+        "value": [
+          {
+            "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/automationRules/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+            "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
+            "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
+            "type": "Microsoft.SecurityInsights/automationRules",
+            "properties": {
+              "displayName": "High severity incidents escalation",
+              "order": 1,
+              "triggeringLogic": {
+                "isEnabled": true,
+                "triggersOn": "Incidents",
+                "triggersWhen": "Created",
+                "conditions": [
+                  {
+                    "conditionType": "Property",
+                    "conditionProperties": {
+                      "propertyName": "IncidentRelatedAnalyticRuleIds",
+                      "operator": "Contains",
+                      "propertyValues": [
+                        "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/fab3d2d4-747f-46a7-8ef0-9c0be8112bf7",
+                        "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/8deb8303-e94d-46ff-96e0-5fd94b33df1a"
+                      ]
+                    }
+                  }
+                ]
+              },
+              "actions": [
+                {
+                  "order": 1,
+                  "actionType": "ModifyProperties",
+                  "actionConfiguration": {
+                    "severity": "High"
+                  }
+                }
+              ],
+              "lastModifiedTimeUtc": "2019-01-01T13:00:30Z",
+              "createdTimeUtc": "2019-01-01T13:00:00Z",
+              "lastModifiedBy": {
+                "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
+                "email": "john.doe@contoso.com",
+                "name": "john doe",
+                "userPrincipalName": "john@contoso.com"
+              },
+              "createdBy": {
+                "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
+                "email": "john.doe@contoso.com",
+                "name": "john doe",
+                "userPrincipalName": "john@contoso.com"
+              }
+            }
+          }
+        ]
+      }
+    }
+  }
+}
diff --git a/specification/securityinsights/resource-manager/readme.md b/specification/securityinsights/resource-manager/readme.md
index 9950773c5db9..9b854f82c011 100644
--- a/specification/securityinsights/resource-manager/readme.md
+++ b/specification/securityinsights/resource-manager/readme.md
@@ -44,6 +44,7 @@ input-file:
   - Microsoft.SecurityInsights/stable/2021-10-01/AlertRules.json
   - Microsoft.SecurityInsights/stable/2021-10-01/Bookmarks.json
   - Microsoft.SecurityInsights/stable/2021-10-01/DataConnectors.json
+  - Microsoft.SecurityInsights/stable/2021-10-01/AutomationRules.json
 ```
 
 ### Tag: package-2021-04-01-only