Add data connector for threat intelligence taxii

custom-words.txt

@@ -1458,6 +1458,7 @@ taskcompletion
 taskcounts
 taskfailure
 tasksuccess
+Taxii
 templated
 templatelink
 templeton

specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/SecurityInsights.json

@@ -1658,6 +1658,9 @@
           "Get a TI data connector.": {
             "$ref": "./examples/dataConnectors/GetThreatIntelligenceById.json"
           },
+          "Get a TI Taxii data connector.": {
+            "$ref": "./examples/dataConnectors/GetThreatIntelligenceTaxiiById.json"
+          },
           "Get a MCAS data connector.": {
             "$ref": "./examples/dataConnectors/GetMicrosoftCloudAppSecurityById.json"
           },
@@ -1825,6 +1828,9 @@
           "Check requirements for TI.": {
             "$ref": "./examples/dataConnectors/CheckRequirementsThreatIntelligence.json"
           },
+          "Check requirements for TI Taxii.": {
+            "$ref": "./examples/dataConnectors/CheckRequirementsThreatIntelligenceTaxii.json"
+          },
           "Check requirements for AAD.": {
             "$ref": "./examples/dataConnectors/CheckRequirementsAzureActiveDirectory.json"
           },
@@ -4048,6 +4054,7 @@
             "AzureSecurityCenter",
             "MicrosoftCloudAppSecurity",
             "ThreatIntelligence",
+            "ThreatIntelligenceTaxii",
             "Office365",
             "AmazonWebServicesCloudTrail",
             "AzureAdvancedThreatProtection",
@@ -4070,6 +4077,9 @@
               {
                 "value": "ThreatIntelligence"
               },
+              {
+                "value": "ThreatIntelligenceTaxii"
+              },
               {
                 "value": "Office365"
               },
@@ -6457,6 +6467,93 @@
         "kind"
       ]
     },
+    "TiTaxiiDataConnector": {
+      "allOf": [
+        {
+          "$ref": "#/definitions/DataConnector"
+        }
+      ],
+      "description": "Represents threat intelligence taxii data connector.",
+      "properties": {
+        "properties": {
+          "$ref": "#/definitions/TiTaxiiDataConnectorProperties",
+          "description": "Threat intelligence taxii client data connector properties.",
+          "x-ms-client-flatten": true
+        }
+      },
+      "type": "object",
+      "x-ms-discriminator-value": "ThreatIntelligenceTaxii"
+    },
+    "TiTaxiiDataConnectorDataTypes": {
+      "description": "The available data types for Threat Intelligence taxii client data connector.",
+      "properties": {
+        "taxiiClient": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/DataConnectorDataTypeCommon"
+            }
+          ],
+          "description": "Data type for taxii client.",
+          "type": "object"
+        }
+      },
+      "type": "object"
+    },
+    "TiTaxiiDataConnectorProperties": {
+      "allOf": [
+        {
+          "$ref": "#/definitions/DataConnectorTenantId"
+        }
+      ],
+      "description": "Threat Intelligence taxii client data connector properties.",
+      "properties": {
+        "workspaceId": {
+          "description": "The workspace id.",
+          "type": "string"
+        },
+        "friendlyName": {
+          "description": "The friendly name for taxii client connector.",
+          "type": "string"
+        },
+        "taxiiServer": {
+          "description": "The API root server for taxii client.",
+          "type": "string"
+        },
+        "collectionId": {
+          "description": "The taxii collection id.",
+          "type": "string"
+        },
+        "userName": {
+          "description": "The taxii server user name.",
+          "type": "string"
+        },
+        "password": {
+          "description": "The taxii server password.",
+          "type": "string"
+        },
+        "dataTypes": {
+          "$ref": "#/definitions/TiTaxiiDataConnectorDataTypes",
+          "description": "The available data types for the connector."
+        }
+      },
+      "type": "object"
+    },
+    "TiTaxiiCheckRequirements": {
+      "allOf": [
+        {
+          "$ref": "#/definitions/DataConnectorsCheckRequirements"
+        },
+        {
+          "$ref": "#/definitions/DataConnectorTenantId"
+        }
+      ],
+      "description": "Ti Taxii (Threat Intelligence Taxii) requirements check properties.",
+      "type": "object",
+      "discriminator": "kind",
+      "required": [
+        "kind"
+      ]
+    },
     "ThreatIntelligence": {
       "description": "ThreatIntelligence property bag.",
       "properties": {

specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/dataConnectors/CheckRequirementsThreatIntelligenceTaxii.json

@@ -0,0 +1,23 @@
+{
+  "parameters": {
+    "api-version": "2019-01-01-preview",
+    "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+    "resourceGroupName": "myRg",
+    "workspaceName": "myWorkspace",
+    "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
+    "DataConnectorsCheckRequirements": {
+      "kind": "ThreatIntelligenceTaxii",
+      "properties": {
+        "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8"
+      }
+    }
+  },
+  "responses": {
+    "200": {
+      "body": {
+        "authorizationState": "Valid",
+        "licenseState": "Valid"
+      }
+    }
+  }
+}

specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/dataConnectors/GetDataConnectors.json

@@ -40,6 +40,27 @@
               }
             }
           },
+          {
+            "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/c39bb458-02a7-4b3f-b0c8-71a1d2692652",
+            "name": "c39bb458-02a7-4b3f-b0c8-71a1d2692652",
+            "type": "Microsoft.SecurityInsights/dataConnectors",
+            "kind": "ThreatIntelligenceTaxii",
+            "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
+            "properties": {
+              "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8",
+              "workspaceId": "8b014a77-4695-4ef4-96bb-6623afb121a2",
+              "friendlyName": "My TI Taxii Connector",
+              "taxiiServer": "https://mytaxiiserver.com/taxiing/v2/api",
+              "collectionId": "e0b1f32d-1188-48f7-a7a3-de71924e4b5e",
+              "userName": "",
+              "password": "",
+              "dataTypes": {
+                "taxiiClient": {
+                  "state": "Enabled"
+                }
+              }
+            }
+          },
           {
             "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/f0cd27d2-5f03-4c06-ba31-d2dc82dcb51d",
             "name": "f0cd27d2-5f03-4c06-ba31-d2dc82dcb51d",

specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview/examples/dataConnectors/GetThreatIntelligenceTaxiiById.json

@@ -0,0 +1,35 @@
+{
+  "parameters": {
+    "api-version": "2019-01-01-preview",
+    "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+    "resourceGroupName": "myRg",
+    "workspaceName": "myWorkspace",
+    "operationalInsightsResourceProvider": "Microsoft.OperationalIinsights",
+    "dataConnectorId": "c39bb458-02a7-4b3f-b0c8-71a1d2692652"
+  },
+  "responses": {
+    "200": {
+      "body": {
+        "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/c39bb458-02a7-4b3f-b0c8-71a1d2692652",
+        "name": "c39bb458-02a7-4b3f-b0c8-71a1d2692652",
+        "type": "Microsoft.SecurityInsights/dataConnectors",
+        "kind": "ThreatIntelligenceTaxii",
+        "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
+        "properties": {
+          "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8",
+          "workspaceId": "8b014a77-4695-4ef4-96bb-6623afb121a2",
+          "friendlyName": "My TI Taxii Connector",
+          "taxiiServer": "https://mytaxiiserver.com/taxiing/v2/api",
+          "collectionId": "e0b1f32d-1188-48f7-a7a3-de71924e4b5e",
+          "userName": "",
+          "password": "",
+          "dataTypes": {
+            "taxiiClient": {
+              "state": "Enabled"
+            }
+          }
+        }
+      }
+    }
+  }
+}