From 234bee27cef7304aa3e0e97c337762c68e549656 Mon Sep 17 00:00:00 2001 From: "MIDDLEEAST\\t-nishab" Date: Sun, 10 Mar 2019 17:37:53 +0200 Subject: [PATCH 1/4] Correlation Key property added --- .../preview/2015-06-01-preview/alerts.json | 5 +++++ .../Alerts/GetAlertResourceGroupLocation_example.json | 3 ++- .../Alerts/GetAlertSubscriptionLocation_example.json | 3 ++- .../Alerts/GetAlertsResourceGroupLocation_example.json | 3 ++- .../examples/Alerts/GetAlertsResourceGroup_example.json | 3 ++- .../examples/Alerts/GetAlertsSubscription_example.json | 6 ++++-- .../Alerts/GetAlertsSubscriptionsLocation_example.json | 6 ++++-- .../Microsoft.Security/stable/2019-01-01/alerts.json | 7 ++++++- .../Alerts/GetAlertResourceGroupLocation_example.json | 3 ++- .../Alerts/GetAlertSubscriptionLocation_example.json | 3 ++- .../Alerts/GetAlertsResourceGroupLocation_example.json | 3 ++- .../examples/Alerts/GetAlertsResourceGroup_example.json | 3 ++- .../examples/Alerts/GetAlertsSubscription_example.json | 6 ++++-- .../Alerts/GetAlertsSubscriptionsLocation_example.json | 6 ++++-- 14 files changed, 43 insertions(+), 17 deletions(-) diff --git a/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/alerts.json b/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/alerts.json index 50ba0abd189b..6507d9d5ed69 100644 --- a/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/alerts.json +++ b/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/alerts.json @@ -561,6 +561,11 @@ "readOnly": true, "type": "string", "description": "Azure resource ID of the workspace that the alert was reported to." + }, + "CorrelationKey": { + "readOnly": true, + "type": "string", + "description": "Correlation Key of the alert." } } }, diff --git a/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/examples/Alerts/GetAlertResourceGroupLocation_example.json b/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/examples/Alerts/GetAlertResourceGroupLocation_example.json index 440889fab580..de4fcbecda50 100644 --- a/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/examples/Alerts/GetAlertResourceGroupLocation_example.json +++ b/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/examples/Alerts/GetAlertResourceGroupLocation_example.json @@ -65,7 +65,8 @@ "threatDescription": "In bot armies, the controller is the server machine(s) that gives instructions to the controlled (zombied) hosts that connect to the command and control (C2) network. The controller host is usually running a botnet management application that is sending the commands to the zombied members of the bot army. These commands include, but are not limited to, the following: updating bitcoin wallet information, distributed denial-of-service (DDoS) target listings, updated C2 communication contact lists, and targeting data. C2 servers may be either directly controlled by the malware operators or run on hardware compromised by malware. There are multiple techniques for dynamically changing the control servers so that they are not isolated and brought down. Control servers utilize two general architectures: client-server and peer-to-peer. In a client-server model, all the hosts are controlled by a single server or a few control servers. In a peer-to-peer model, the infected hosts are both clients and servers, and they control other hosts so that instead of isolating the few control servers, all the hosts need to be removed." }], "type": "ip" - }] + }], + "correlationKey": "Rkso6LFWxzCll5tqrk4hnrBJ+MY1BX806W6q6+0s9Jk=" } } } diff --git a/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/examples/Alerts/GetAlertSubscriptionLocation_example.json b/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/examples/Alerts/GetAlertSubscriptionLocation_example.json index 461126f44bf0..5c8733f3c5e9 100644 --- a/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/examples/Alerts/GetAlertSubscriptionLocation_example.json +++ b/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/examples/Alerts/GetAlertSubscriptionLocation_example.json @@ -64,7 +64,8 @@ "threatDescription": "In bot armies, the controller is the server machine(s) that gives instructions to the controlled (zombied) hosts that connect to the command and control (C2) network. The controller host is usually running a botnet management application that is sending the commands to the zombied members of the bot army. These commands include, but are not limited to, the following: updating bitcoin wallet information, distributed denial-of-service (DDoS) target listings, updated C2 communication contact lists, and targeting data. C2 servers may be either directly controlled by the malware operators or run on hardware compromised by malware. There are multiple techniques for dynamically changing the control servers so that they are not isolated and brought down. Control servers utilize two general architectures: client-server and peer-to-peer. In a client-server model, all the hosts are controlled by a single server or a few control servers. In a peer-to-peer model, the infected hosts are both clients and servers, and they control other hosts so that instead of isolating the few control servers, all the hosts need to be removed." }], "type": "ip" - }] + }], + "correlationKey": "Rkso6LFWxzCll5tqrk4hnrBJ+MY1BX806W6q6+0s9Jk=" } } } diff --git a/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/examples/Alerts/GetAlertsResourceGroupLocation_example.json b/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/examples/Alerts/GetAlertsResourceGroupLocation_example.json index b0f23f6f9d0a..eeb2ceb5b449 100644 --- a/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/examples/Alerts/GetAlertsResourceGroupLocation_example.json +++ b/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/examples/Alerts/GetAlertsResourceGroupLocation_example.json @@ -65,7 +65,8 @@ "threatDescription": "In bot armies, the controller is the server machine(s) that gives instructions to the controlled (zombied) hosts that connect to the command and control (C2) network. The controller host is usually running a botnet management application that is sending the commands to the zombied members of the bot army. These commands include, but are not limited to, the following: updating bitcoin wallet information, distributed denial-of-service (DDoS) target listings, updated C2 communication contact lists, and targeting data. C2 servers may be either directly controlled by the malware operators or run on hardware compromised by malware. There are multiple techniques for dynamically changing the control servers so that they are not isolated and brought down. Control servers utilize two general architectures: client-server and peer-to-peer. In a client-server model, all the hosts are controlled by a single server or a few control servers. In a peer-to-peer model, the infected hosts are both clients and servers, and they control other hosts so that instead of isolating the few control servers, all the hosts need to be removed." }], "type": "ip" - }] + }], + "correlationKey": "Rkso6LFWxzCll5tqrk4hnrBJ+MY1BX806W6q6+0s9Jk=" } }] } diff --git a/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/examples/Alerts/GetAlertsResourceGroup_example.json b/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/examples/Alerts/GetAlertsResourceGroup_example.json index 6c7008fd58ba..a9cd699182c2 100644 --- a/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/examples/Alerts/GetAlertsResourceGroup_example.json +++ b/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/examples/Alerts/GetAlertsResourceGroup_example.json @@ -64,7 +64,8 @@ "threatDescription": "In bot armies, the controller is the server machine(s) that gives instructions to the controlled (zombied) hosts that connect to the command and control (C2) network. The controller host is usually running a botnet management application that is sending the commands to the zombied members of the bot army. These commands include, but are not limited to, the following: updating bitcoin wallet information, distributed denial-of-service (DDoS) target listings, updated C2 communication contact lists, and targeting data. C2 servers may be either directly controlled by the malware operators or run on hardware compromised by malware. There are multiple techniques for dynamically changing the control servers so that they are not isolated and brought down. Control servers utilize two general architectures: client-server and peer-to-peer. In a client-server model, all the hosts are controlled by a single server or a few control servers. In a peer-to-peer model, the infected hosts are both clients and servers, and they control other hosts so that instead of isolating the few control servers, all the hosts need to be removed." }], "type": "ip" - }] + }], + "correlationKey": "Rkso6LFWxzCll5tqrk4hnrBJ+MY1BX806W6q6+0s9Jk=" } }] } diff --git a/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/examples/Alerts/GetAlertsSubscription_example.json b/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/examples/Alerts/GetAlertsSubscription_example.json index a9ecacbc0765..0eb1e983812b 100644 --- a/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/examples/Alerts/GetAlertsSubscription_example.json +++ b/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/examples/Alerts/GetAlertsSubscription_example.json @@ -63,7 +63,8 @@ "threatDescription": "In bot armies, the controller is the server machine(s) that gives instructions to the controlled (zombied) hosts that connect to the command and control (C2) network. The controller host is usually running a botnet management application that is sending the commands to the zombied members of the bot army. These commands include, but are not limited to, the following: updating bitcoin wallet information, distributed denial-of-service (DDoS) target listings, updated C2 communication contact lists, and targeting data. C2 servers may be either directly controlled by the malware operators or run on hardware compromised by malware. There are multiple techniques for dynamically changing the control servers so that they are not isolated and brought down. Control servers utilize two general architectures: client-server and peer-to-peer. In a client-server model, all the hosts are controlled by a single server or a few control servers. In a peer-to-peer model, the infected hosts are both clients and servers, and they control other hosts so that instead of isolating the few control servers, all the hosts need to be removed." }], "type": "ip" - }] + }], + "correlationKey": "Rkso6LFWxzCll5tqrk4hnrBJ+MY1BX806W6q6+0s9Jk=" } }, { @@ -141,7 +142,8 @@ "commandLine": "c:\\users\\contosoUser\\scrsave.scr", "creationTimeUtc": "2018-05-07T13:51:45.0045913Z", "type": "process" - }] + }], + "correlationKey": "CCso6LFWxzCll5tqrk4hnrBJ+MY1BX806W6q6+0sWqs=" } } ] diff --git a/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/examples/Alerts/GetAlertsSubscriptionsLocation_example.json b/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/examples/Alerts/GetAlertsSubscriptionsLocation_example.json index d8ea835d6a30..434007f77424 100644 --- a/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/examples/Alerts/GetAlertsSubscriptionsLocation_example.json +++ b/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/examples/Alerts/GetAlertsSubscriptionsLocation_example.json @@ -64,7 +64,8 @@ "threatDescription": "In bot armies, the controller is the server machine(s) that gives instructions to the controlled (zombied) hosts that connect to the command and control (C2) network. The controller host is usually running a botnet management application that is sending the commands to the zombied members of the bot army. These commands include, but are not limited to, the following: updating bitcoin wallet information, distributed denial-of-service (DDoS) target listings, updated C2 communication contact lists, and targeting data. C2 servers may be either directly controlled by the malware operators or run on hardware compromised by malware. There are multiple techniques for dynamically changing the control servers so that they are not isolated and brought down. Control servers utilize two general architectures: client-server and peer-to-peer. In a client-server model, all the hosts are controlled by a single server or a few control servers. In a peer-to-peer model, the infected hosts are both clients and servers, and they control other hosts so that instead of isolating the few control servers, all the hosts need to be removed." }], "type": "ip" - }] + }], + "correlationKey": "Rkso6LFWxzCll5tqrk4hnrBJ+MY1BX806W6q6+0s9Jk=" } }, { @@ -145,7 +146,8 @@ "commandLine": "c:\\users\\contosoUser\\scrsave.scr", "creationTimeUtc": "2018-05-07T13:51:45.0045913Z", "type": "process" - }] + }], + "correlationKey": "6Lso6LFWxzCll5tqrk4hnrBJ+MY1BX806W6q6+0s9MY1" } } ] diff --git a/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/alerts.json b/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/alerts.json index 9daacf4f13eb..44cc6063ab1a 100644 --- a/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/alerts.json +++ b/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/alerts.json @@ -590,7 +590,12 @@ "readOnly": true, "type": "string", "description": "Azure resource ID of the workspace that the alert was reported to." - } + }, + "CorrelationKey": { + "readOnly": true, + "type": "string", + "description": "Correlation Key of the alert." + } } }, "AlertConfidenceReason": { diff --git a/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/examples/Alerts/GetAlertResourceGroupLocation_example.json b/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/examples/Alerts/GetAlertResourceGroupLocation_example.json index 4f151c844069..ae09fc3ec57e 100644 --- a/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/examples/Alerts/GetAlertResourceGroupLocation_example.json +++ b/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/examples/Alerts/GetAlertResourceGroupLocation_example.json @@ -65,7 +65,8 @@ "threatDescription": "In bot armies, the controller is the server machine(s) that gives instructions to the controlled (zombied) hosts that connect to the command and control (C2) network. The controller host is usually running a botnet management application that is sending the commands to the zombied members of the bot army. These commands include, but are not limited to, the following: updating bitcoin wallet information, distributed denial-of-service (DDoS) target listings, updated C2 communication contact lists, and targeting data. C2 servers may be either directly controlled by the malware operators or run on hardware compromised by malware. There are multiple techniques for dynamically changing the control servers so that they are not isolated and brought down. Control servers utilize two general architectures: client-server and peer-to-peer. In a client-server model, all the hosts are controlled by a single server or a few control servers. In a peer-to-peer model, the infected hosts are both clients and servers, and they control other hosts so that instead of isolating the few control servers, all the hosts need to be removed." }], "type": "ip" - }] + }], + "correlationKey": "Rkso6LFWxzCll5tqrk4hnrBJ+MY1BX806W6q6+0s9Jk=" } } } diff --git a/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/examples/Alerts/GetAlertSubscriptionLocation_example.json b/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/examples/Alerts/GetAlertSubscriptionLocation_example.json index a83797038f93..e89d71092139 100644 --- a/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/examples/Alerts/GetAlertSubscriptionLocation_example.json +++ b/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/examples/Alerts/GetAlertSubscriptionLocation_example.json @@ -64,7 +64,8 @@ "threatDescription": "In bot armies, the controller is the server machine(s) that gives instructions to the controlled (zombied) hosts that connect to the command and control (C2) network. The controller host is usually running a botnet management application that is sending the commands to the zombied members of the bot army. These commands include, but are not limited to, the following: updating bitcoin wallet information, distributed denial-of-service (DDoS) target listings, updated C2 communication contact lists, and targeting data. C2 servers may be either directly controlled by the malware operators or run on hardware compromised by malware. There are multiple techniques for dynamically changing the control servers so that they are not isolated and brought down. Control servers utilize two general architectures: client-server and peer-to-peer. In a client-server model, all the hosts are controlled by a single server or a few control servers. In a peer-to-peer model, the infected hosts are both clients and servers, and they control other hosts so that instead of isolating the few control servers, all the hosts need to be removed." }], "type": "ip" - }] + }], + "correlationKey": "Rkso6LFWxzCll5tqrk4hnrBJ+MY1BX806W6q6+0s9Jk=" } } } diff --git a/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/examples/Alerts/GetAlertsResourceGroupLocation_example.json b/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/examples/Alerts/GetAlertsResourceGroupLocation_example.json index 71f6d8ad8def..d6215cb137a4 100644 --- a/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/examples/Alerts/GetAlertsResourceGroupLocation_example.json +++ b/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/examples/Alerts/GetAlertsResourceGroupLocation_example.json @@ -65,7 +65,8 @@ "threatDescription": "In bot armies, the controller is the server machine(s) that gives instructions to the controlled (zombied) hosts that connect to the command and control (C2) network. The controller host is usually running a botnet management application that is sending the commands to the zombied members of the bot army. These commands include, but are not limited to, the following: updating bitcoin wallet information, distributed denial-of-service (DDoS) target listings, updated C2 communication contact lists, and targeting data. C2 servers may be either directly controlled by the malware operators or run on hardware compromised by malware. There are multiple techniques for dynamically changing the control servers so that they are not isolated and brought down. Control servers utilize two general architectures: client-server and peer-to-peer. In a client-server model, all the hosts are controlled by a single server or a few control servers. In a peer-to-peer model, the infected hosts are both clients and servers, and they control other hosts so that instead of isolating the few control servers, all the hosts need to be removed." }], "type": "ip" - }] + }], + "correlationKey": "Rkso6LFWxzCll5tqrk4hnrBJ+MY1BX806W6q6+0s9Jk=" } }] } diff --git a/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/examples/Alerts/GetAlertsResourceGroup_example.json b/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/examples/Alerts/GetAlertsResourceGroup_example.json index c73f61d0b36f..913453136178 100644 --- a/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/examples/Alerts/GetAlertsResourceGroup_example.json +++ b/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/examples/Alerts/GetAlertsResourceGroup_example.json @@ -64,7 +64,8 @@ "threatDescription": "In bot armies, the controller is the server machine(s) that gives instructions to the controlled (zombied) hosts that connect to the command and control (C2) network. The controller host is usually running a botnet management application that is sending the commands to the zombied members of the bot army. These commands include, but are not limited to, the following: updating bitcoin wallet information, distributed denial-of-service (DDoS) target listings, updated C2 communication contact lists, and targeting data. C2 servers may be either directly controlled by the malware operators or run on hardware compromised by malware. There are multiple techniques for dynamically changing the control servers so that they are not isolated and brought down. Control servers utilize two general architectures: client-server and peer-to-peer. In a client-server model, all the hosts are controlled by a single server or a few control servers. In a peer-to-peer model, the infected hosts are both clients and servers, and they control other hosts so that instead of isolating the few control servers, all the hosts need to be removed." }], "type": "ip" - }] + }], + "correlationKey": "Rkso6LFWxzCll5tqrk4hnrBJ+MY1BX806W6q6+0s9Jk=" } }] } diff --git a/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/examples/Alerts/GetAlertsSubscription_example.json b/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/examples/Alerts/GetAlertsSubscription_example.json index 74f1c0e26122..401a68cdb5f7 100644 --- a/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/examples/Alerts/GetAlertsSubscription_example.json +++ b/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/examples/Alerts/GetAlertsSubscription_example.json @@ -63,7 +63,8 @@ "threatDescription": "In bot armies, the controller is the server machine(s) that gives instructions to the controlled (zombied) hosts that connect to the command and control (C2) network. The controller host is usually running a botnet management application that is sending the commands to the zombied members of the bot army. These commands include, but are not limited to, the following: updating bitcoin wallet information, distributed denial-of-service (DDoS) target listings, updated C2 communication contact lists, and targeting data. C2 servers may be either directly controlled by the malware operators or run on hardware compromised by malware. There are multiple techniques for dynamically changing the control servers so that they are not isolated and brought down. Control servers utilize two general architectures: client-server and peer-to-peer. In a client-server model, all the hosts are controlled by a single server or a few control servers. In a peer-to-peer model, the infected hosts are both clients and servers, and they control other hosts so that instead of isolating the few control servers, all the hosts need to be removed." }], "type": "ip" - }] + }], + "correlationKey": "Rkso6LFWxzCll5tqrk4hnrBJ+MY1BX806W6q6+0s9Jk=" } }, { @@ -141,7 +142,8 @@ "commandLine": "c:\\users\\contosoUser\\scrsave.scr", "creationTimeUtc": "2018-05-07T13:51:45.0045913Z", "type": "process" - }] + }], + "correlationKey": "4hnro6LFWxzCll5tqrk4hnrBJ+MY1BX806W6q6+0s96++" } } ] diff --git a/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/examples/Alerts/GetAlertsSubscriptionsLocation_example.json b/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/examples/Alerts/GetAlertsSubscriptionsLocation_example.json index 7eb3c550c3d8..c36b7a987110 100644 --- a/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/examples/Alerts/GetAlertsSubscriptionsLocation_example.json +++ b/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/examples/Alerts/GetAlertsSubscriptionsLocation_example.json @@ -64,7 +64,8 @@ "threatDescription": "In bot armies, the controller is the server machine(s) that gives instructions to the controlled (zombied) hosts that connect to the command and control (C2) network. The controller host is usually running a botnet management application that is sending the commands to the zombied members of the bot army. These commands include, but are not limited to, the following: updating bitcoin wallet information, distributed denial-of-service (DDoS) target listings, updated C2 communication contact lists, and targeting data. C2 servers may be either directly controlled by the malware operators or run on hardware compromised by malware. There are multiple techniques for dynamically changing the control servers so that they are not isolated and brought down. Control servers utilize two general architectures: client-server and peer-to-peer. In a client-server model, all the hosts are controlled by a single server or a few control servers. In a peer-to-peer model, the infected hosts are both clients and servers, and they control other hosts so that instead of isolating the few control servers, all the hosts need to be removed." }], "type": "ip" - }] + }], + "correlationKey": "Rkso6LFWxzCll5tqrk4hnrBJ+MY1BX806W6q6+0s9Jk=" } }, { @@ -145,7 +146,8 @@ "commandLine": "c:\\users\\contosoUser\\scrsave.scr", "creationTimeUtc": "2018-05-07T13:51:45.0045913Z", "type": "process" - }] + }], + "correlationKey": "4hno6LFWxzCll5tqrk4hnrBJ+MY1BX806W6q6+0srk4" } } ] From 566b64da8e05aef201e8e3537edcd0c47530e360 Mon Sep 17 00:00:00 2001 From: "MIDDLEEAST\\t-nishab" Date: Sun, 10 Mar 2019 18:45:36 +0200 Subject: [PATCH 2/4] typo fix --- .../Microsoft.Security/preview/2015-06-01-preview/alerts.json | 2 +- .../Microsoft.Security/stable/2019-01-01/alerts.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/alerts.json b/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/alerts.json index 6507d9d5ed69..f40f4e8af59c 100644 --- a/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/alerts.json +++ b/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/alerts.json @@ -562,7 +562,7 @@ "type": "string", "description": "Azure resource ID of the workspace that the alert was reported to." }, - "CorrelationKey": { + "correlationKey": { "readOnly": true, "type": "string", "description": "Correlation Key of the alert." diff --git a/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/alerts.json b/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/alerts.json index 44cc6063ab1a..3a80f83c7711 100644 --- a/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/alerts.json +++ b/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/alerts.json @@ -591,7 +591,7 @@ "type": "string", "description": "Azure resource ID of the workspace that the alert was reported to." }, - "CorrelationKey": { + "correlationKey": { "readOnly": true, "type": "string", "description": "Correlation Key of the alert." From a5f4de7b7f27c6d6af977511979094cc19575770 Mon Sep 17 00:00:00 2001 From: "MIDDLEEAST\\t-nishab" Date: Tue, 12 Mar 2019 09:42:32 +0200 Subject: [PATCH 3/4] identation fixed --- .../Microsoft.Security/stable/2019-01-01/alerts.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/alerts.json b/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/alerts.json index 3a80f83c7711..6298c97a7d74 100644 --- a/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/alerts.json +++ b/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/alerts.json @@ -592,9 +592,9 @@ "description": "Azure resource ID of the workspace that the alert was reported to." }, "correlationKey": { - "readOnly": true, - "type": "string", - "description": "Correlation Key of the alert." + "readOnly": true, + "type": "string", + "description": "Correlation Key of the alert." } } }, From e620762eee468dab30a0eac68387dbaaed34cdc3 Mon Sep 17 00:00:00 2001 From: "MIDDLEEAST\\t-nishab" Date: Thu, 14 Mar 2019 10:48:57 +0200 Subject: [PATCH 4/4] tabs switched to spaces + description changed to be more informative --- .../preview/2015-06-01-preview/alerts.json | 4 ++-- .../Microsoft.Security/stable/2019-01-01/alerts.json | 10 +++++----- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/alerts.json b/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/alerts.json index f40f4e8af59c..7f52f7dd7f0f 100644 --- a/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/alerts.json +++ b/specification/security/resource-manager/Microsoft.Security/preview/2015-06-01-preview/alerts.json @@ -562,10 +562,10 @@ "type": "string", "description": "Azure resource ID of the workspace that the alert was reported to." }, - "correlationKey": { + "correlationKey": { "readOnly": true, "type": "string", - "description": "Correlation Key of the alert." + "description": "Alerts with the same CorrelationKey will be grouped together in Ibiza." } } }, diff --git a/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/alerts.json b/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/alerts.json index 6298c97a7d74..304d4fd4bb90 100644 --- a/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/alerts.json +++ b/specification/security/resource-manager/Microsoft.Security/stable/2019-01-01/alerts.json @@ -591,11 +591,11 @@ "type": "string", "description": "Azure resource ID of the workspace that the alert was reported to." }, - "correlationKey": { - "readOnly": true, - "type": "string", - "description": "Correlation Key of the alert." - } + "correlationKey": { + "readOnly": true, + "type": "string", + "description": "Alerts with the same CorrelationKey will be grouped together in Ibiza." + } } }, "AlertConfidenceReason": {