[TypeSpec Migration] SecurityInsights 2025-09-01

specification/securityinsights/cspell.yaml

@@ -55,6 +55,13 @@ overrides:
     words:
       - criterias
       - mdti
+      - informations
+  - filename: >-
+      **/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/SecurityInsights/*.tsp
+    words:
+      - criterias
+      - mdti
+      - informations
   - filename: >-
       **/specification/securityinsights/data-plane/ThreatIntelligence/**/*.json
     words:

specification/securityinsights/resource-manager/Microsoft.SecurityInsights/SecurityInsights/ActionResponse.tsp

@@ -0,0 +1,86 @@
+import "@azure-tools/typespec-azure-core";
+import "@azure-tools/typespec-azure-resource-manager";
+import "@typespec/openapi";
+import "@typespec/rest";
+import "./models.tsp";
+import "./AlertRule.tsp";
+
+using TypeSpec.Rest;
+using TypeSpec.Http;
+using Azure.ResourceManager;
+
+namespace Microsoft.SecurityInsights;
+/**
+ * Action for alert rule.
+ */
+@parentResource(AlertRule)
+model ActionResponse
+  is Azure.ResourceManager.ProxyResource<ActionResponseProperties> {
+  ...ResourceNameParameter<
+    Resource = ActionResponse,
+    KeyName = "actionId",
+    SegmentName = "actions",
+    NamePattern = ""
+  >;
+
+  /**
+   * Etag of the action.
+   */
+  #suppress "@azure-tools/typespec-azure-resource-manager/arm-resource-invalid-envelope-property" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  etag?: string;
+}
+
+@armResourceOperations(#{ omitTags: true })
+interface ActionResponses {
+  /**
+   * Gets the action of alert rule.
+   */
+  @tag("Actions")
+  get is Extension.Read<
+    OperationalInsights,
+    ActionResponse,
+    Error = CloudError
+  >;
+
+  /**
+   * Creates or updates the action of alert rule.
+   */
+  // Customized resource creation, since request body isn't the resource itself
+  @autoRoute
+  @put
+  @tag("Actions")
+  createOrUpdate is Azure.ResourceManager.Foundations.ArmCreateOperation<
+    Azure.ResourceManager.Extension.ExtensionInstanceParameters<
+      OperationalInsights,
+      ActionResponse
+    >,
+    ActionRequest,
+    ArmResourceUpdatedResponse<ActionResponse> | ArmResourceCreatedResponse<ActionResponse>,
+    ErrorResponse = CloudError
+  >;
+
+  /**
+   * Delete the action of alert rule.
+   */
+  @tag("Actions")
+  delete is Extension.DeleteSync<
+    OperationalInsights,
+    ActionResponse,
+    Error = CloudError
+  >;
+
+  /**
+   * Gets all actions of alert rule.
+   */
+  @tag("Actions")
+  listByAlertRule is Extension.ListByTarget<
+    OperationalInsights,
+    ActionResponse,
+    Response = ArmResponse<ActionsList>,
+    Error = CloudError
+  >;
+}
+
+@@doc(ActionResponse.name, "Action ID");
+@@doc(ActionResponse.properties, "Action properties for get request");
+@@doc(ActionResponses.createOrUpdate::parameters.resource, "The action");

specification/securityinsights/resource-manager/Microsoft.SecurityInsights/SecurityInsights/AlertRule.tsp

@@ -0,0 +1,77 @@
+import "@azure-tools/typespec-azure-core";
+import "@azure-tools/typespec-azure-resource-manager";
+import "@typespec/openapi";
+import "@typespec/rest";
+import "./models.tsp";
+import "./VirtualResource.tsp";
+
+using TypeSpec.Rest;
+using Azure.ResourceManager;
+using TypeSpec.Http;
+using TypeSpec.OpenAPI;
+
+namespace Microsoft.SecurityInsights;
+
+/**
+ * Alert rule.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@discriminator("kind")
+model AlertRule
+  is Azure.ResourceManager.Legacy.DiscriminatedExtensionResource<AlertRuleKind> {
+  ...ResourceNameParameter<
+    Resource = AlertRule,
+    KeyName = "ruleId",
+    SegmentName = "alertRules",
+    NamePattern = ""
+  >;
+
+  /**
+   * Etag of the azure resource
+   */
+  #suppress "@azure-tools/typespec-azure-resource-manager/arm-resource-invalid-envelope-property" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  etag?: string;
+}
+
+@armResourceOperations(#{ omitTags: true })
+interface AlertRules {
+  /**
+   * Gets the alert rule.
+   */
+  @tag("Alert Rules")
+  get is Extension.Read<OperationalInsights, AlertRule, Error = CloudError>;
+
+  /**
+   * Creates or updates the alert rule.
+   */
+  @tag("Alert Rules")
+  createOrUpdate is Extension.CreateOrReplaceSync<
+    OperationalInsights,
+    AlertRule,
+    Error = CloudError
+  >;
+
+  /**
+   * Delete the alert rule.
+   */
+  @tag("Alert Rules")
+  delete is Extension.DeleteSync<
+    OperationalInsights,
+    AlertRule,
+    Error = CloudError
+  >;
+
+  /**
+   * Gets all alert rules.
+   */
+  @tag("Alert Rules")
+  list is Extension.ListByTarget<
+    OperationalInsights,
+    AlertRule,
+    Response = ArmResponse<AlertRulesList>,
+    Error = CloudError
+  >;
+}
+
+@@doc(AlertRule.name, "Alert rule ID");
+@@doc(AlertRules.createOrUpdate::parameters.resource, "The alert rule");

specification/securityinsights/resource-manager/Microsoft.SecurityInsights/SecurityInsights/AlertRuleTemplate.tsp

@@ -0,0 +1,52 @@
+import "@azure-tools/typespec-azure-core";
+import "@azure-tools/typespec-azure-resource-manager";
+import "@typespec/openapi";
+import "@typespec/rest";
+import "./models.tsp";
+import "./VirtualResource.tsp";
+
+using TypeSpec.Rest;
+using Azure.ResourceManager;
+using TypeSpec.Http;
+using TypeSpec.OpenAPI;
+
+namespace Microsoft.SecurityInsights;
+/**
+ * Alert rule template.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+model AlertRuleTemplate
+  is Azure.ResourceManager.Legacy.DiscriminatedExtensionResource<AlertRuleKind> {
+  ...ResourceNameParameter<
+    Resource = AlertRuleTemplate,
+    KeyName = "alertRuleTemplateId",
+    SegmentName = "alertRuleTemplates",
+    NamePattern = ""
+  >;
+}
+
+@armResourceOperations(#{ omitTags: true })
+interface AlertRuleTemplates {
+  /**
+   * Gets the alert rule template.
+   */
+  @tag("Alert Rule Templates")
+  get is Extension.Read<
+    OperationalInsights,
+    AlertRuleTemplate,
+    Error = CloudError
+  >;
+
+  /**
+   * Gets all alert rule templates.
+   */
+  @tag("Alert Rule Templates")
+  list is Extension.ListByTarget<
+    OperationalInsights,
+    AlertRuleTemplate,
+    Response = ArmResponse<AlertRuleTemplatesList>,
+    Error = CloudError
+  >;
+}
+
+@@doc(AlertRuleTemplate.name, "Alert rule template ID");

specification/securityinsights/resource-manager/Microsoft.SecurityInsights/SecurityInsights/AutomationRule.tsp

@@ -0,0 +1,125 @@
+import "@azure-tools/typespec-azure-core";
+import "@azure-tools/typespec-azure-resource-manager";
+import "@typespec/openapi";
+import "@typespec/rest";
+import "./models.tsp";
+import "./VirtualResource.tsp";
+
+using TypeSpec.Rest;
+using Azure.ResourceManager;
+using TypeSpec.Http;
+using TypeSpec.OpenAPI;
+
+namespace Microsoft.SecurityInsights;
+
+model AutomationRule
+  is Azure.ResourceManager.ProxyResource<AutomationRuleProperties, false> {
+  ...ResourceNameParameter<
+    Resource = AutomationRule,
+    KeyName = "automationRuleId",
+    SegmentName = "automationRules",
+    NamePattern = ""
+  >;
+
+  /**
+   * Etag of the azure resource
+   */
+  #suppress "@azure-tools/typespec-azure-resource-manager/arm-resource-invalid-envelope-property" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  etag?: string;
+}
+
+// Added manually only to fix optional request body
+alias AutomationRuleOps = Azure.ResourceManager.Legacy.ExtensionOperations<
+  {
+    ...ApiVersionParameter;
+    ...SubscriptionIdParameter;
+    ...ResourceGroupParameter;
+
+    /** the provider namespace */
+    @path
+    @segment("providers")
+    @key
+    providerNamespace: "Microsoft.OperationalInsights";
+
+    /**
+     * The name of the workspace.
+     */
+    @segment("workspaces")
+    @key
+    @path
+    @minLength(1)
+    @maxLength(90)
+    @pattern("^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$")
+    workspaceName: string;
+  },
+  {
+    ...Extension.ExtensionProviderNamespace<AutomationRule>;
+  },
+  {
+    ...Extension.ExtensionProviderNamespace<AutomationRule>;
+
+    /**
+     * The automation rule ID.
+     */
+    @path
+    @key
+    @segment("automationRules")
+    automationRuleId: string;
+  }
+>;
+
+@armResourceOperations(#{ omitTags: true })
+interface AutomationRules {
+  /**
+   * Gets the automation rule.
+   */
+  @tag("automationRules")
+  get is Extension.Read<
+    OperationalInsights,
+    AutomationRule,
+    Error = CloudError
+  >;
+
+  /**
+   * Creates or updates the automation rule.
+   */
+  @tag("automationRules")
+  createOrUpdate is AutomationRuleOps.CreateOrUpdateSync<
+    AutomationRule,
+    OptionalRequestBody = true,
+    ErrorType = CloudError
+  >;
+
+  /**
+   * Delete the automation rule.
+   */
+  #suppress "@azure-tools/typespec-azure-resource-manager/no-empty-model" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  #suppress "@azure-tools/typespec-azure-resource-manager/no-response-body" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  #suppress "@azure-tools/typespec-azure-core/response-schema-problem" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  @tag("automationRules")
+  delete is Extension.DeleteSync<
+    OperationalInsights,
+    AutomationRule,
+    Response = ArmResponse<{}> | (NoContentResponse & {
+      @body body: {};
+    }),
+    Error = CloudError
+  >;
+
+  /**
+   * Gets all automation rules.
+   */
+  @tag("automationRules")
+  list is Extension.ListByTarget<
+    OperationalInsights,
+    AutomationRule,
+    Response = ArmResponse<AutomationRulesList>,
+    Error = CloudError
+  >;
+}
+
+@@doc(AutomationRule.name, "Automation rule ID");
+@@doc(AutomationRule.properties, "Automation rule properties");
+@@doc(AutomationRules.createOrUpdate::parameters.resource,
+  "The automation rule"
+);