Skip to content

Watchlists 2024-09-01 #31040

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
xuhumsft merged 5 commits into from
Oct 23, 2024
Merged

Watchlists 2024-09-01 #31040

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
9289bea
Watchlists 2024-09-01
nbatyrbb Oct 15, 2024
42cfab5
Fix errors
nbatyrbb Oct 16, 2024
924dbd1
prettier run
nbatyrbb Oct 18, 2024
ba51b18
address pr feedback
nbatyrbb Oct 23, 2024
2a5522c
address pr feedback
nbatyrbb Oct 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
115 changes: 106 additions & 9 deletions ...ityinsights/resource-manager/Microsoft.SecurityInsights/stable/2024-09-01/Watchlists.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,18 +155,32 @@
}
],
"responses": {
"200": {
"description": "OK"
"202": {
"description": "OK",
"headers": {
"Azure-AsyncOperation": {
"description": "Contains the status URL on which clients are expected to poll the status of the delete operation.",
"type": "string"
},
"Location": {
"description": "Location URL to poll for result.",
"type": "string"
}
}
},
"204": {
"description": "No Content"
},
"default": {
"description": "Error response describing why the operation failed.",
"schema": {
"$ref": "../../../common/2.0/types.json#/definitions/CloudError"
"$ref": "../../../../../common-types/resource-management/v5/types.json#/definitions/ErrorResponse"
}
}
},
"x-ms-long-running-operation": true,
"x-ms-long-running-operation-options": {
"final-state-via": "azure-async-operation"
}
},
"put": {
Expand Down Expand Up @@ -211,17 +225,27 @@
}
},
"201": {
"description": "Created",
"description": "Created. The response includes the Provisioning State and the Azure-AsyncOperation header. To get the progress of the operation, call GET operation on the URL in Azure-AsyncOperation header field.",
"schema": {
"$ref": "#/definitions/Watchlist"
},
"headers": {
"Azure-AsyncOperation": {
"description": "Contains the status URL on which clients are expected to poll the status of the operation.",
"type": "string"
}
}
},
"default": {
"description": "Error response describing why the operation failed.",
"schema": {
"$ref": "../../../common/2.0/types.json#/definitions/CloudError"
"$ref": "../../../../../common-types/resource-management/v5/types.json#/definitions/ErrorResponse"
}
}
},
"x-ms-long-running-operation": true,
"x-ms-long-running-operation-options": {
"final-state-via": "azure-async-operation"
}
}
},
Expand Down Expand Up @@ -480,9 +504,31 @@
"type": "string"
},
"source": {
"description": "The source of the watchlist. Only accepts \"Local file\" and \"Remote storage\". And it must included in the request.",
"description": "The filename of the watchlist, called 'source'",
"type": "string"
},
"sourceType": {
"description": "The sourceType of the watchlist",
"enum": [
"Local file",
"Remote storage"
],
"type": "string",
"x-ms-enum": {
"modelAsString": true,
"name": "sourceType",
"values": [
{
"description": "The source from local file.",
"value": "Local file"
},
{
"description": "The source from remote storage.",
"value": "Remote storage"
}
]
}
},
"created": {
"description": "The time the watchlist was created",
"format": "date-time",
Expand Down Expand Up @@ -536,25 +582,28 @@
"type": "string"
},
"numberOfLinesToSkip": {
"description": "The number of lines in a csv content to skip before the header",
"description": "The number of lines in a csv/tsv content to skip before the header",
"type": "integer",
"format": "int32"
},
"rawContent": {
"description": "The raw content that represents to watchlist items to create. Example : This line will be skipped\nheader1,header2\nvalue1,value2",
"description": "The raw content that represents to watchlist items to create. In case of csv/tsv content type, it's the content of the file that will parsed by the endpoint",
"type": "string"
},
"itemsSearchKey": {
"description": "The search key is used to optimize query performance when using watchlists for joins with other data. For example, enable a column with IP addresses to be the designated SearchKey field, then use this field as the key field when joining to other event data by IP address.",
"type": "string"
},
"contentType": {
"description": "The content type of the raw content. For now, only text/csv is valid",
"description": "The content type of the raw content. Example : text/csv or text/tsv",
"type": "string"
},
"uploadStatus": {
"description": "The status of the Watchlist upload : New, InProgress or Complete. **Note** : When a Watchlist upload status is InProgress, the Watchlist cannot be deleted",
"type": "string"
},
"provisioningState": {
"$ref": "#/definitions/ProvisioningState"
}
},
"required": [
Expand Down Expand Up @@ -653,6 +702,54 @@
"itemsKeyValue"
],
"type": "object"
},
"ProvisioningState": {
"description": "Describes provisioning state",
"enum": [
"New",
"InProgress",
"Uploading",
"Deleting",
"Succeeded",
"Failed",
"Canceled"
],
"type": "string",
"x-ms-enum": {
"name": "ProvisioningState",
"modelAsString": true,
"values": [
{
"description": "The New provisioning state.",
"value": "New"
},
{
"description": "The InProgress provisioning state.",
"value": "InProgress"
},
{
"description": "The Uploading provisioning state.",
"value": "Uploading"
},
{
"description": "The Deleting provisioning state.",
"value": "Deleting"
},
{
"description": "The Succeeded provisioning state.",
"value": "Succeeded"
},
{
"description": "The Failed provisioning state.",
"value": "Failed"
},
{
"description": "The Canceled provisioning state.",
"value": "Canceled"
}
]
},
"readOnly": true
}
},
"parameters": {
Expand Down
10 changes: 6 additions & 4 deletions ...ger/Microsoft.SecurityInsights/stable/2024-09-01/examples/watchlists/CreateWatchlist.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,8 @@
"etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
"properties": {
"displayName": "High Value Assets Watchlist",
"source": "Local file",
"source": "watchlist.csv",
"sourceType": "Local file",
"provider": "Microsoft",
"description": "Watchlist from CSV content",
"itemsSearchKey": "header1"
Expand All @@ -28,7 +29,8 @@
"watchlistId": "76d5a51f-ba1f-4038-9d22-59fda38dc017",
"displayName": "High Value Assets Watchlist",
"provider": "Microsoft",
"source": "Local file",
"source": "watchlist.csv",
"sourceType": "Local file",
"created": "2020-09-28T00:26:54.7746089+00:00",
"updated": "2020-09-28T00:26:57+00:00",
"createdBy": {
Expand Down Expand Up @@ -60,7 +62,8 @@
"watchlistId": "76d5a51f-ba1f-4038-9d22-59fda38dc017",
"displayName": "High Value Assets Watchlist",
"provider": "Microsoft",
"source": "Local file",
"source": "watchlist.csv",
"sourceType": "Local file",
"created": "2020-09-28T00:26:54.7746089+00:00",
"updated": "2020-09-28T00:26:57+00:00",
"createdBy": {
Expand All @@ -84,4 +87,3 @@
}
}
}

10 changes: 6 additions & 4 deletions ...urityInsights/stable/2024-09-01/examples/watchlists/CreateWatchlistAndWatchlistItems.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,8 @@
"etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
"properties": {
"displayName": "High Value Assets Watchlist",
"source": "Local file",
"source": "watchlist.csv",
"sourceType": "Local file",
"provider": "Microsoft",
"description": "Watchlist from CSV content",
"numberOfLinesToSkip": 1,
Expand All @@ -31,7 +32,8 @@
"watchlistId": "76d5a51f-ba1f-4038-9d22-59fda38dc017",
"displayName": "High Value Assets Watchlist",
"provider": "Microsoft",
"source": "Local file",
"source": "watchlist.csv",
"sourceType": "Local file",
"created": "2020-09-28T00:26:54.7746089+00:00",
"updated": "2020-09-28T00:26:57+00:00",
"createdBy": {
Expand Down Expand Up @@ -63,7 +65,8 @@
"watchlistId": "76d5a51f-ba1f-4038-9d22-59fda38dc017",
"displayName": "High Value Assets Watchlist",
"provider": "Microsoft",
"source": "Local file",
"source": "watchlist.csv",
"sourceType": "Local file",
"created": "2020-09-28T00:26:54.7746089+00:00",
"updated": "2020-09-28T00:26:57+00:00",
"createdBy": {
Expand All @@ -87,4 +90,3 @@
}
}
}

7 changes: 5 additions & 2 deletions ...ger/Microsoft.SecurityInsights/stable/2024-09-01/examples/watchlists/DeleteWatchlist.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,11 @@
"watchlistAlias": "highValueAsset"
},
"responses": {
"200": {},
"202": {
"headers": {
"Azure-AsyncOperation": "https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.SecurityInsights/watchlists/1011-01/watchlistStatuses/00000000-0000-0000-0000-000000000000?api-version=2024-09-01"
}
},
"204": {}
}
}

4 changes: 2 additions & 2 deletions ...Microsoft.SecurityInsights/stable/2024-09-01/examples/watchlists/GetWatchlistByAlias.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,8 @@
"watchlistId": "76d5a51f-ba1f-4038-9d22-59fda38dc017",
"displayName": "High Value Assets Watchlist",
"provider": "Microsoft",
"source": "Local file",
"source": "watchlist.csv",
"sourceType": "Local file",
"created": "2020-09-28T00:26:54.7746089+00:00",
"updated": "2020-09-28T00:26:57+00:00",
"createdBy": {
Expand Down Expand Up @@ -47,4 +48,3 @@
}
}
}

4 changes: 2 additions & 2 deletions ...nager/Microsoft.SecurityInsights/stable/2024-09-01/examples/watchlists/GetWatchlists.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,8 @@
"watchlistId": "76d5a51f-ba1f-4038-9d22-59fda38dc017",
"displayName": "High Value Assets Watchlist",
"provider": "Microsoft",
"source": "Local file",
"source": "watchlist.csv",
"sourceType": "Local file",
"created": "2020-09-28T00:26:54.7746089+00:00",
"updated": "2020-09-28T00:26:57+00:00",
"createdBy": {
Expand Down Expand Up @@ -50,4 +51,3 @@
}
}
}