-
Notifications
You must be signed in to change notification settings - Fork 5.9k
Adding kinds for AlertRules endpoints, updating AlertRuleTemplates endpoints #7130
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from 9 commits
Commits
Show all changes
11 commits
Select commit
Hold shift + click to select a range
e00e658
sort definitions and parameters by ABC
yoshkedi 76814a3
adding ResourceWithEtag definition and updating all etag resources to…
yoshkedi 8e90e38
update all AlertRuleTemplate with latest changes
yoshkedi cf9a801
added MicrosoftSecurity and Fusion alert rules arm models
yoshkedi cb61d2e
update examples and enum definitions
yoshkedi a59c140
fix required properties to not include read-only properties
yoshkedi 4fac440
fix template examples and validate all examples
yoshkedi 68f7c01
merge from upstream
yoshkedi a02c11a
fix typo in example names
yoshkedi d4accfc
ARM CR fixes - remove id,name,type from PUT request, add format date …
yoshkedi 9ec455b
fix AlertRuleTemplate examples
yoshkedi File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
356 changes: 232 additions & 124 deletions
356
...ource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/SecurityInsights.json
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
69 changes: 69 additions & 0 deletions
69
...ecurityInsights/preview/2019-01-01-preview/examples/alertRules/CreateFusionAlertRule.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,69 @@ | ||
| { | ||
| "parameters": { | ||
| "api-version": "2019-01-01-preview", | ||
| "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0", | ||
| "resourceGroupName": "myRg", | ||
| "workspaceName": "myWorkspace", | ||
| "operationalInsightsResourceProvider": "Microsoft.OperationalInsights", | ||
| "ruleId": "myFirstFusionRule", | ||
| "alertRule": { | ||
| "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/myFirstFusionRule", | ||
| "name": "myFirstFusionRule", | ||
| "kind": "Fusion", | ||
| "etag": "3d00c3ca-0000-0100-0000-5d42d5010000", | ||
| "type": "Microsoft.SecurityInsights/AlertRules", | ||
| "properties": { | ||
| "enabled": "true", | ||
| "alertRuleTemplateName": "f71aba3d-28fb-450b-b192-4e76a83015c8" | ||
| } | ||
| } | ||
| }, | ||
| "responses": { | ||
| "200": { | ||
| "body": { | ||
| "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/myFirstFusionRule", | ||
| "name": "myFirstFusionRule", | ||
| "etag": "\"260090e2-0000-0d00-0000-5d6fb8670000\"", | ||
| "type": "Microsoft.SecurityInsights/alertRules", | ||
| "kind": "Fusion", | ||
| "properties": { | ||
| "displayName": "Advanced Multi-Stage Attack Detection", | ||
| "description": "In this mode, Sentinel combines low fidelity alerts, which themselves may not be actionable, and events across multiple products, into high fidelity security interesting incidents. The system looks at multiple products to produce actionable incidents. Custom tailored to each tenant, Fusion not only reduces false positive rates but also can detect attacks with limited or missing information. \nIncidents generated by Fusion system will encase two or more alerts. By design, Fusion incidents are low volume, high fidelity and will be high severity, which is why Fusion is turned ON by default in Azure Sentinel.\n\nFor Fusion to work, please configure the following data sources in Data Connectors tab:\nRequired - Azure Active Directory Identity Protection\nRequired - Microsoft Cloud App Security\nIf Available - Palo Alto Network\n\nFor full list of scenarios covered by Fusion, and detail instructions on how to configure the required data sources, go to aka.ms/SentinelFusion", | ||
| "alertRuleTemplateName": "f71aba3d-28fb-450b-b192-4e76a83015c8", | ||
| "tactics": [ | ||
| "Persistence", | ||
| "LateralMovement", | ||
| "Exfiltration", | ||
| "CommandAndControl" | ||
| ], | ||
| "severity": "High", | ||
| "enabled": true, | ||
| "lastModifiedUtc": "2019-09-04T13:13:11.5340061Z" | ||
| } | ||
| } | ||
| }, | ||
| "201": { | ||
| "body": { | ||
| "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/myFirstFusionRule", | ||
| "name": "myFirstFusionRule", | ||
| "etag": "\"260090e2-0000-0d00-0000-5d6fb8670000\"", | ||
| "type": "Microsoft.SecurityInsights/alertRules", | ||
| "kind": "Fusion", | ||
| "properties": { | ||
| "displayName": "Advanced Multi-Stage Attack Detection", | ||
| "description": "In this mode, Sentinel combines low fidelity alerts, which themselves may not be actionable, and events across multiple products, into high fidelity security interesting incidents. The system looks at multiple products to produce actionable incidents. Custom tailored to each tenant, Fusion not only reduces false positive rates but also can detect attacks with limited or missing information. \nIncidents generated by Fusion system will encase two or more alerts. By design, Fusion incidents are low volume, high fidelity and will be high severity, which is why Fusion is turned ON by default in Azure Sentinel.\n\nFor Fusion to work, please configure the following data sources in Data Connectors tab:\nRequired - Azure Active Directory Identity Protection\nRequired - Microsoft Cloud App Security\nIf Available - Palo Alto Network\n\nFor full list of scenarios covered by Fusion, and detail instructions on how to configure the required data sources, go to aka.ms/SentinelFusion", | ||
| "alertRuleTemplateName": "f71aba3d-28fb-450b-b192-4e76a83015c8", | ||
| "tactics": [ | ||
| "Persistence", | ||
| "LateralMovement", | ||
| "Exfiltration", | ||
| "CommandAndControl" | ||
| ], | ||
| "severity": "High", | ||
| "enabled": true, | ||
| "lastModifiedUtc": "2019-09-04T13:13:11.5340061Z" | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } | ||
64 changes: 64 additions & 0 deletions
64
...9-01-01-preview/examples/alertRules/CreateMicrosoftSecurityIncidentCreationAlertRule.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,64 @@ | ||
| { | ||
| "parameters": { | ||
| "api-version": "2019-01-01-preview", | ||
| "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0", | ||
| "resourceGroupName": "myRg", | ||
| "workspaceName": "myWorkspace", | ||
| "operationalInsightsResourceProvider": "Microsoft.OperationalInsights", | ||
| "ruleId": "microsoftSecurityIncidentCreationRuleExample", | ||
| "alertRule": { | ||
| "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/microsoftSecurityIncidentCreationRuleExample", | ||
| "name": "microsoftSecurityIncidentCreationRuleExample", | ||
| "etag": "\"260097e0-0000-0d00-0000-5d6fa88f0000\"", | ||
| "type": "Microsoft.SecurityInsights/alertRules", | ||
| "kind": "MicrosoftSecurityIncidentCreation", | ||
| "properties": { | ||
| "productFilter": "Microsoft Cloud App Security", | ||
| "displayName": "testing displayname", | ||
| "enabled": true | ||
| } | ||
| } | ||
| }, | ||
| "responses": { | ||
| "200": { | ||
| "body": { | ||
| "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/microsoftSecurityIncidentCreationRuleExample", | ||
| "name": "microsoftSecurityIncidentCreationRuleExample", | ||
| "etag": "\"260097e0-0000-0d00-0000-5d6fa88f0000\"", | ||
| "type": "Microsoft.SecurityInsights/alertRules", | ||
| "kind": "MicrosoftSecurityIncidentCreation", | ||
| "properties": { | ||
| "productFilter": "Microsoft Cloud App Security", | ||
| "severitiesFilter": null, | ||
| "displayNamesFilter": null, | ||
| "displayName": "testing displayname", | ||
| "enabled": true, | ||
| "description": null, | ||
| "tactics": [], | ||
| "alertRuleTemplateName": null, | ||
| "lastModifiedUtc": "2019-09-04T12:05:35.7296311Z" | ||
| } | ||
| } | ||
| }, | ||
| "201": { | ||
| "body": { | ||
| "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/microsoftSecurityIncidentCreationRuleExample", | ||
| "name": "microsoftSecurityIncidentCreationRuleExample", | ||
| "etag": "\"260097e0-0000-0d00-0000-5d6fa88f0000\"", | ||
| "type": "Microsoft.SecurityInsights/alertRules", | ||
| "kind": "MicrosoftSecurityIncidentCreation", | ||
| "properties": { | ||
| "productFilter": "Microsoft Cloud App Security", | ||
| "severitiesFilter": null, | ||
| "displayNamesFilter": null, | ||
| "displayName": "testing displayname", | ||
| "enabled": true, | ||
| "description": null, | ||
| "tactics": [], | ||
| "alertRuleTemplateName": null, | ||
| "lastModifiedUtc": "2019-09-04T12:05:35.7296311Z" | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.