diff --git a/eng/mgmt/mgmtmetadata/security_resource-manager.txt b/eng/mgmt/mgmtmetadata/security_resource-manager.txt index b032564b2676..a6926e7e6272 100644 --- a/eng/mgmt/mgmtmetadata/security_resource-manager.txt +++ b/eng/mgmt/mgmtmetadata/security_resource-manager.txt @@ -3,13 +3,13 @@ AutoRest installed successfully. Commencing code generation Generating CSharp code Executing AutoRest command -cmd.exe /c autorest.cmd https://github.com/Azure/azure-rest-api-specs/blob/master/specification/security/resource-manager/readme.md --csharp --version=v2 --reflect-api-versions --csharp-sdks-folder=C:\code\azure-sdk-for-net\sdk +cmd.exe /c autorest.cmd https://github.com/Azure/azure-rest-api-specs/blob/main/specification/security/resource-manager/readme.md --csharp --version=2.0.4421 --reflect-api-versions --csharp-sdks-folder=C:\code\azure-sdk-for-net\sdk Autorest CSharp Version: 2.3.82 -2021-08-04 12:00:58 UTC +2022-03-23 15:53:46 UTC Azure-rest-api-specs repository information GitHub fork: Azure -Branch: master -Commit: c981b81aa26ad4d0d156e034e6782853b4e747a1 +Branch: main +Commit: bcec16b1ef77dc266ada0b3eb6d86eae0cdf3b16 AutoRest information -Requested version: v2 +Requested version: 2.0.4421 Bootstrapper version: autorest@2.0.4413 diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AdaptiveApplicationControlsOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AdaptiveApplicationControlsOperations.cs index 524870971a85..d5dee93b4898 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AdaptiveApplicationControlsOperations.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AdaptiveApplicationControlsOperations.cs @@ -252,6 +252,10 @@ internal AdaptiveApplicationControlsOperations(SecurityCenterClient client) /// /// Gets an application control VM/server group. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of an application control machine group /// @@ -276,7 +280,7 @@ internal AdaptiveApplicationControlsOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task> GetWithHttpMessagesAsync(string groupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task> GetWithHttpMessagesAsync(string ascLocation, string groupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -289,9 +293,9 @@ internal AdaptiveApplicationControlsOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } if (groupName == null) { @@ -305,6 +309,7 @@ internal AdaptiveApplicationControlsOperations(SecurityCenterClient client) { _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("groupName", groupName); tracingParameters.Add("apiVersion", apiVersion); tracingParameters.Add("cancellationToken", cancellationToken); @@ -314,7 +319,7 @@ internal AdaptiveApplicationControlsOperations(SecurityCenterClient client) var _baseUrl = Client.BaseUri.AbsoluteUri; var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/providers/Microsoft.Security/locations/{ascLocation}/applicationWhitelistings/{groupName}").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); _url = _url.Replace("{groupName}", System.Uri.EscapeDataString(groupName)); List _queryParameters = new List(); if (apiVersion != null) @@ -449,6 +454,10 @@ internal AdaptiveApplicationControlsOperations(SecurityCenterClient client) /// /// Update an application control machine group /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of an application control machine group /// @@ -475,7 +484,7 @@ internal AdaptiveApplicationControlsOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task> PutWithHttpMessagesAsync(string groupName, AdaptiveApplicationControlGroup body, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task> PutWithHttpMessagesAsync(string ascLocation, string groupName, AdaptiveApplicationControlGroup body, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -488,9 +497,9 @@ internal AdaptiveApplicationControlsOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } if (groupName == null) { @@ -508,6 +517,7 @@ internal AdaptiveApplicationControlsOperations(SecurityCenterClient client) { _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("groupName", groupName); tracingParameters.Add("apiVersion", apiVersion); tracingParameters.Add("body", body); @@ -518,7 +528,7 @@ internal AdaptiveApplicationControlsOperations(SecurityCenterClient client) var _baseUrl = Client.BaseUri.AbsoluteUri; var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/providers/Microsoft.Security/locations/{ascLocation}/applicationWhitelistings/{groupName}").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); _url = _url.Replace("{groupName}", System.Uri.EscapeDataString(groupName)); List _queryParameters = new List(); if (apiVersion != null) @@ -659,6 +669,10 @@ internal AdaptiveApplicationControlsOperations(SecurityCenterClient client) /// /// Delete an application control machine group /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of an application control machine group /// @@ -680,7 +694,7 @@ internal AdaptiveApplicationControlsOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task DeleteWithHttpMessagesAsync(string groupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task DeleteWithHttpMessagesAsync(string ascLocation, string groupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -693,9 +707,9 @@ internal AdaptiveApplicationControlsOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } if (groupName == null) { @@ -709,6 +723,7 @@ internal AdaptiveApplicationControlsOperations(SecurityCenterClient client) { _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("groupName", groupName); tracingParameters.Add("apiVersion", apiVersion); tracingParameters.Add("cancellationToken", cancellationToken); @@ -718,7 +733,7 @@ internal AdaptiveApplicationControlsOperations(SecurityCenterClient client) var _baseUrl = Client.BaseUri.AbsoluteUri; var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/providers/Microsoft.Security/locations/{ascLocation}/applicationWhitelistings/{groupName}").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); _url = _url.Replace("{groupName}", System.Uri.EscapeDataString(groupName)); List _queryParameters = new List(); if (apiVersion != null) diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AdaptiveApplicationControlsOperationsExtensions.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AdaptiveApplicationControlsOperationsExtensions.cs index d43ddfb37085..713a88ea0ac1 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AdaptiveApplicationControlsOperationsExtensions.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AdaptiveApplicationControlsOperationsExtensions.cs @@ -67,12 +67,16 @@ public static partial class AdaptiveApplicationControlsOperationsExtensions /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of an application control machine group /// - public static AdaptiveApplicationControlGroup Get(this IAdaptiveApplicationControlsOperations operations, string groupName) + public static AdaptiveApplicationControlGroup Get(this IAdaptiveApplicationControlsOperations operations, string ascLocation, string groupName) { - return operations.GetAsync(groupName).GetAwaiter().GetResult(); + return operations.GetAsync(ascLocation, groupName).GetAwaiter().GetResult(); } /// @@ -81,15 +85,19 @@ public static AdaptiveApplicationControlGroup Get(this IAdaptiveApplicationContr /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of an application control machine group /// /// /// The cancellation token. /// - public static async Task GetAsync(this IAdaptiveApplicationControlsOperations operations, string groupName, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task GetAsync(this IAdaptiveApplicationControlsOperations operations, string ascLocation, string groupName, CancellationToken cancellationToken = default(CancellationToken)) { - using (var _result = await operations.GetWithHttpMessagesAsync(groupName, null, cancellationToken).ConfigureAwait(false)) + using (var _result = await operations.GetWithHttpMessagesAsync(ascLocation, groupName, null, cancellationToken).ConfigureAwait(false)) { return _result.Body; } @@ -101,14 +109,18 @@ public static AdaptiveApplicationControlGroup Get(this IAdaptiveApplicationContr /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of an application control machine group /// /// /// - public static AdaptiveApplicationControlGroup Put(this IAdaptiveApplicationControlsOperations operations, string groupName, AdaptiveApplicationControlGroup body) + public static AdaptiveApplicationControlGroup Put(this IAdaptiveApplicationControlsOperations operations, string ascLocation, string groupName, AdaptiveApplicationControlGroup body) { - return operations.PutAsync(groupName, body).GetAwaiter().GetResult(); + return operations.PutAsync(ascLocation, groupName, body).GetAwaiter().GetResult(); } /// @@ -117,6 +129,10 @@ public static AdaptiveApplicationControlGroup Put(this IAdaptiveApplicationContr /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of an application control machine group /// @@ -125,9 +141,9 @@ public static AdaptiveApplicationControlGroup Put(this IAdaptiveApplicationContr /// /// The cancellation token. /// - public static async Task PutAsync(this IAdaptiveApplicationControlsOperations operations, string groupName, AdaptiveApplicationControlGroup body, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task PutAsync(this IAdaptiveApplicationControlsOperations operations, string ascLocation, string groupName, AdaptiveApplicationControlGroup body, CancellationToken cancellationToken = default(CancellationToken)) { - using (var _result = await operations.PutWithHttpMessagesAsync(groupName, body, null, cancellationToken).ConfigureAwait(false)) + using (var _result = await operations.PutWithHttpMessagesAsync(ascLocation, groupName, body, null, cancellationToken).ConfigureAwait(false)) { return _result.Body; } @@ -139,12 +155,16 @@ public static AdaptiveApplicationControlGroup Put(this IAdaptiveApplicationContr /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of an application control machine group /// - public static void Delete(this IAdaptiveApplicationControlsOperations operations, string groupName) + public static void Delete(this IAdaptiveApplicationControlsOperations operations, string ascLocation, string groupName) { - operations.DeleteAsync(groupName).GetAwaiter().GetResult(); + operations.DeleteAsync(ascLocation, groupName).GetAwaiter().GetResult(); } /// @@ -153,15 +173,19 @@ public static void Delete(this IAdaptiveApplicationControlsOperations operations /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of an application control machine group /// /// /// The cancellation token. /// - public static async Task DeleteAsync(this IAdaptiveApplicationControlsOperations operations, string groupName, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task DeleteAsync(this IAdaptiveApplicationControlsOperations operations, string ascLocation, string groupName, CancellationToken cancellationToken = default(CancellationToken)) { - (await operations.DeleteWithHttpMessagesAsync(groupName, null, cancellationToken).ConfigureAwait(false)).Dispose(); + (await operations.DeleteWithHttpMessagesAsync(ascLocation, groupName, null, cancellationToken).ConfigureAwait(false)).Dispose(); } } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AlertsOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AlertsOperations.cs index 1bc78bd210d0..40cdcbf4616e 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AlertsOperations.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AlertsOperations.cs @@ -87,7 +87,7 @@ internal AlertsOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); } } - string apiVersion = "2021-01-01"; + string apiVersion = "2021-11-01"; // Tracing bool _shouldTrace = ServiceClientTracing.IsEnabled; string _invocationId = null; @@ -293,7 +293,7 @@ internal AlertsOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$"); } } - string apiVersion = "2021-01-01"; + string apiVersion = "2021-11-01"; // Tracing bool _shouldTrace = ServiceClientTracing.IsEnabled; string _invocationId = null; @@ -445,6 +445,10 @@ internal AlertsOperations(SecurityCenterClient client) /// List all the alerts that are associated with the subscription that are /// stored in a specific location /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Headers that will be added to request. /// @@ -466,7 +470,7 @@ internal AlertsOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task>> ListSubscriptionLevelByRegionWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task>> ListSubscriptionLevelByRegionWithHttpMessagesAsync(string ascLocation, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -479,11 +483,11 @@ internal AlertsOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } - string apiVersion = "2021-01-01"; + string apiVersion = "2021-11-01"; // Tracing bool _shouldTrace = ServiceClientTracing.IsEnabled; string _invocationId = null; @@ -492,6 +496,7 @@ internal AlertsOperations(SecurityCenterClient client) _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); tracingParameters.Add("apiVersion", apiVersion); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("cancellationToken", cancellationToken); ServiceClientTracing.Enter(_invocationId, this, "ListSubscriptionLevelByRegion", tracingParameters); } @@ -499,7 +504,7 @@ internal AlertsOperations(SecurityCenterClient client) var _baseUrl = Client.BaseUri.AbsoluteUri; var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/providers/Microsoft.Security/locations/{ascLocation}/alerts").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); List _queryParameters = new List(); if (apiVersion != null) { @@ -634,6 +639,10 @@ internal AlertsOperations(SecurityCenterClient client) /// List all the alerts that are associated with the resource group that are /// stored in a specific location /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// The name of the resource group within the user's subscription. The name is /// case insensitive. @@ -659,7 +668,7 @@ internal AlertsOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task>> ListResourceGroupLevelByRegionWithHttpMessagesAsync(string resourceGroupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task>> ListResourceGroupLevelByRegionWithHttpMessagesAsync(string ascLocation, string resourceGroupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -672,9 +681,9 @@ internal AlertsOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } if (resourceGroupName == null) { @@ -695,7 +704,7 @@ internal AlertsOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$"); } } - string apiVersion = "2021-01-01"; + string apiVersion = "2021-11-01"; // Tracing bool _shouldTrace = ServiceClientTracing.IsEnabled; string _invocationId = null; @@ -704,6 +713,7 @@ internal AlertsOperations(SecurityCenterClient client) _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); tracingParameters.Add("apiVersion", apiVersion); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("resourceGroupName", resourceGroupName); tracingParameters.Add("cancellationToken", cancellationToken); ServiceClientTracing.Enter(_invocationId, this, "ListResourceGroupLevelByRegion", tracingParameters); @@ -712,7 +722,7 @@ internal AlertsOperations(SecurityCenterClient client) var _baseUrl = Client.BaseUri.AbsoluteUri; var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/locations/{ascLocation}/alerts").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName)); List _queryParameters = new List(); if (apiVersion != null) @@ -847,6 +857,10 @@ internal AlertsOperations(SecurityCenterClient client) /// /// Get an alert that is associated with a subscription /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the alert object /// @@ -871,7 +885,7 @@ internal AlertsOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task> GetSubscriptionLevelWithHttpMessagesAsync(string alertName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task> GetSubscriptionLevelWithHttpMessagesAsync(string ascLocation, string alertName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -884,15 +898,15 @@ internal AlertsOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } if (alertName == null) { throw new ValidationException(ValidationRules.CannotBeNull, "alertName"); } - string apiVersion = "2021-01-01"; + string apiVersion = "2021-11-01"; // Tracing bool _shouldTrace = ServiceClientTracing.IsEnabled; string _invocationId = null; @@ -901,6 +915,7 @@ internal AlertsOperations(SecurityCenterClient client) _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); tracingParameters.Add("apiVersion", apiVersion); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("alertName", alertName); tracingParameters.Add("cancellationToken", cancellationToken); ServiceClientTracing.Enter(_invocationId, this, "GetSubscriptionLevel", tracingParameters); @@ -909,7 +924,7 @@ internal AlertsOperations(SecurityCenterClient client) var _baseUrl = Client.BaseUri.AbsoluteUri; var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/providers/Microsoft.Security/locations/{ascLocation}/alerts/{alertName}").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); _url = _url.Replace("{alertName}", System.Uri.EscapeDataString(alertName)); List _queryParameters = new List(); if (apiVersion != null) @@ -1045,6 +1060,10 @@ internal AlertsOperations(SecurityCenterClient client) /// Get an alert that is associated a resource group or a resource in a /// resource group /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the alert object /// @@ -1073,7 +1092,7 @@ internal AlertsOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task> GetResourceGroupLevelWithHttpMessagesAsync(string alertName, string resourceGroupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task> GetResourceGroupLevelWithHttpMessagesAsync(string ascLocation, string alertName, string resourceGroupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -1086,9 +1105,9 @@ internal AlertsOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } if (alertName == null) { @@ -1113,7 +1132,7 @@ internal AlertsOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$"); } } - string apiVersion = "2021-01-01"; + string apiVersion = "2021-11-01"; // Tracing bool _shouldTrace = ServiceClientTracing.IsEnabled; string _invocationId = null; @@ -1122,6 +1141,7 @@ internal AlertsOperations(SecurityCenterClient client) _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); tracingParameters.Add("apiVersion", apiVersion); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("alertName", alertName); tracingParameters.Add("resourceGroupName", resourceGroupName); tracingParameters.Add("cancellationToken", cancellationToken); @@ -1131,7 +1151,7 @@ internal AlertsOperations(SecurityCenterClient client) var _baseUrl = Client.BaseUri.AbsoluteUri; var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/locations/{ascLocation}/alerts/{alertName}").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); _url = _url.Replace("{alertName}", System.Uri.EscapeDataString(alertName)); _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName)); List _queryParameters = new List(); @@ -1267,6 +1287,10 @@ internal AlertsOperations(SecurityCenterClient client) /// /// Update the alert's state /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the alert object /// @@ -1288,7 +1312,7 @@ internal AlertsOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task UpdateSubscriptionLevelStateToDismissWithHttpMessagesAsync(string alertName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task UpdateSubscriptionLevelStateToDismissWithHttpMessagesAsync(string ascLocation, string alertName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -1301,15 +1325,15 @@ internal AlertsOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } if (alertName == null) { throw new ValidationException(ValidationRules.CannotBeNull, "alertName"); } - string apiVersion = "2021-01-01"; + string apiVersion = "2021-11-01"; // Tracing bool _shouldTrace = ServiceClientTracing.IsEnabled; string _invocationId = null; @@ -1318,6 +1342,7 @@ internal AlertsOperations(SecurityCenterClient client) _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); tracingParameters.Add("apiVersion", apiVersion); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("alertName", alertName); tracingParameters.Add("cancellationToken", cancellationToken); ServiceClientTracing.Enter(_invocationId, this, "UpdateSubscriptionLevelStateToDismiss", tracingParameters); @@ -1326,7 +1351,7 @@ internal AlertsOperations(SecurityCenterClient client) var _baseUrl = Client.BaseUri.AbsoluteUri; var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/providers/Microsoft.Security/locations/{ascLocation}/alerts/{alertName}/dismiss").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); _url = _url.Replace("{alertName}", System.Uri.EscapeDataString(alertName)); List _queryParameters = new List(); if (apiVersion != null) @@ -1443,6 +1468,10 @@ internal AlertsOperations(SecurityCenterClient client) /// /// Update the alert's state /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the alert object /// @@ -1464,7 +1493,7 @@ internal AlertsOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task UpdateSubscriptionLevelStateToResolveWithHttpMessagesAsync(string alertName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task UpdateSubscriptionLevelStateToResolveWithHttpMessagesAsync(string ascLocation, string alertName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -1477,15 +1506,15 @@ internal AlertsOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } if (alertName == null) { throw new ValidationException(ValidationRules.CannotBeNull, "alertName"); } - string apiVersion = "2021-01-01"; + string apiVersion = "2021-11-01"; // Tracing bool _shouldTrace = ServiceClientTracing.IsEnabled; string _invocationId = null; @@ -1494,6 +1523,7 @@ internal AlertsOperations(SecurityCenterClient client) _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); tracingParameters.Add("apiVersion", apiVersion); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("alertName", alertName); tracingParameters.Add("cancellationToken", cancellationToken); ServiceClientTracing.Enter(_invocationId, this, "UpdateSubscriptionLevelStateToResolve", tracingParameters); @@ -1502,7 +1532,7 @@ internal AlertsOperations(SecurityCenterClient client) var _baseUrl = Client.BaseUri.AbsoluteUri; var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/providers/Microsoft.Security/locations/{ascLocation}/alerts/{alertName}/resolve").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); _url = _url.Replace("{alertName}", System.Uri.EscapeDataString(alertName)); List _queryParameters = new List(); if (apiVersion != null) @@ -1619,6 +1649,10 @@ internal AlertsOperations(SecurityCenterClient client) /// /// Update the alert's state /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the alert object /// @@ -1640,7 +1674,7 @@ internal AlertsOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task UpdateSubscriptionLevelStateToActivateWithHttpMessagesAsync(string alertName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task UpdateSubscriptionLevelStateToActivateWithHttpMessagesAsync(string ascLocation, string alertName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -1653,15 +1687,15 @@ internal AlertsOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } if (alertName == null) { throw new ValidationException(ValidationRules.CannotBeNull, "alertName"); } - string apiVersion = "2021-01-01"; + string apiVersion = "2021-11-01"; // Tracing bool _shouldTrace = ServiceClientTracing.IsEnabled; string _invocationId = null; @@ -1670,6 +1704,7 @@ internal AlertsOperations(SecurityCenterClient client) _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); tracingParameters.Add("apiVersion", apiVersion); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("alertName", alertName); tracingParameters.Add("cancellationToken", cancellationToken); ServiceClientTracing.Enter(_invocationId, this, "UpdateSubscriptionLevelStateToActivate", tracingParameters); @@ -1678,7 +1713,7 @@ internal AlertsOperations(SecurityCenterClient client) var _baseUrl = Client.BaseUri.AbsoluteUri; var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/providers/Microsoft.Security/locations/{ascLocation}/alerts/{alertName}/activate").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); _url = _url.Replace("{alertName}", System.Uri.EscapeDataString(alertName)); List _queryParameters = new List(); if (apiVersion != null) @@ -1795,6 +1830,10 @@ internal AlertsOperations(SecurityCenterClient client) /// /// Update the alert's state /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the alert object /// @@ -1820,7 +1859,7 @@ internal AlertsOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task UpdateResourceGroupLevelStateToResolveWithHttpMessagesAsync(string alertName, string resourceGroupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task UpdateResourceGroupLevelStateToResolveWithHttpMessagesAsync(string ascLocation, string alertName, string resourceGroupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -1833,9 +1872,9 @@ internal AlertsOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } if (alertName == null) { @@ -1860,7 +1899,7 @@ internal AlertsOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$"); } } - string apiVersion = "2021-01-01"; + string apiVersion = "2021-11-01"; // Tracing bool _shouldTrace = ServiceClientTracing.IsEnabled; string _invocationId = null; @@ -1869,6 +1908,7 @@ internal AlertsOperations(SecurityCenterClient client) _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); tracingParameters.Add("apiVersion", apiVersion); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("alertName", alertName); tracingParameters.Add("resourceGroupName", resourceGroupName); tracingParameters.Add("cancellationToken", cancellationToken); @@ -1878,7 +1918,7 @@ internal AlertsOperations(SecurityCenterClient client) var _baseUrl = Client.BaseUri.AbsoluteUri; var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/locations/{ascLocation}/alerts/{alertName}/resolve").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); _url = _url.Replace("{alertName}", System.Uri.EscapeDataString(alertName)); _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName)); List _queryParameters = new List(); @@ -1996,6 +2036,10 @@ internal AlertsOperations(SecurityCenterClient client) /// /// Update the alert's state /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the alert object /// @@ -2021,7 +2065,7 @@ internal AlertsOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task UpdateResourceGroupLevelStateToDismissWithHttpMessagesAsync(string alertName, string resourceGroupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task UpdateResourceGroupLevelStateToDismissWithHttpMessagesAsync(string ascLocation, string alertName, string resourceGroupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -2034,9 +2078,9 @@ internal AlertsOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } if (alertName == null) { @@ -2061,7 +2105,7 @@ internal AlertsOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$"); } } - string apiVersion = "2021-01-01"; + string apiVersion = "2021-11-01"; // Tracing bool _shouldTrace = ServiceClientTracing.IsEnabled; string _invocationId = null; @@ -2070,6 +2114,7 @@ internal AlertsOperations(SecurityCenterClient client) _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); tracingParameters.Add("apiVersion", apiVersion); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("alertName", alertName); tracingParameters.Add("resourceGroupName", resourceGroupName); tracingParameters.Add("cancellationToken", cancellationToken); @@ -2079,7 +2124,7 @@ internal AlertsOperations(SecurityCenterClient client) var _baseUrl = Client.BaseUri.AbsoluteUri; var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/locations/{ascLocation}/alerts/{alertName}/dismiss").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); _url = _url.Replace("{alertName}", System.Uri.EscapeDataString(alertName)); _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName)); List _queryParameters = new List(); @@ -2197,6 +2242,10 @@ internal AlertsOperations(SecurityCenterClient client) /// /// Update the alert's state /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the alert object /// @@ -2222,7 +2271,7 @@ internal AlertsOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task UpdateResourceGroupLevelStateToActivateWithHttpMessagesAsync(string alertName, string resourceGroupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task UpdateResourceGroupLevelStateToActivateWithHttpMessagesAsync(string ascLocation, string alertName, string resourceGroupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -2235,9 +2284,9 @@ internal AlertsOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } if (alertName == null) { @@ -2262,7 +2311,7 @@ internal AlertsOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$"); } } - string apiVersion = "2021-01-01"; + string apiVersion = "2021-11-01"; // Tracing bool _shouldTrace = ServiceClientTracing.IsEnabled; string _invocationId = null; @@ -2271,6 +2320,7 @@ internal AlertsOperations(SecurityCenterClient client) _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); tracingParameters.Add("apiVersion", apiVersion); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("alertName", alertName); tracingParameters.Add("resourceGroupName", resourceGroupName); tracingParameters.Add("cancellationToken", cancellationToken); @@ -2280,7 +2330,7 @@ internal AlertsOperations(SecurityCenterClient client) var _baseUrl = Client.BaseUri.AbsoluteUri; var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/locations/{ascLocation}/alerts/{alertName}/activate").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); _url = _url.Replace("{alertName}", System.Uri.EscapeDataString(alertName)); _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName)); List _queryParameters = new List(); @@ -2398,25 +2448,10 @@ internal AlertsOperations(SecurityCenterClient client) /// /// Simulate security alerts /// - /// - /// Alert Simulator request body data. + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations /// - /// - /// The headers that will be added to request. - /// - /// - /// The cancellation token. - /// - public async Task SimulateWithHttpMessagesAsync(AlertSimulatorRequestProperties properties = default(AlertSimulatorRequestProperties), Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) - { - // Send request - AzureOperationResponse _response = await BeginSimulateWithHttpMessagesAsync(properties, customHeaders, cancellationToken).ConfigureAwait(false); - return await Client.GetPostOrDeleteOperationResultAsync(_response, customHeaders, cancellationToken).ConfigureAwait(false); - } - - /// - /// Simulate security alerts - /// /// /// Alert Simulator request body data. /// @@ -2438,7 +2473,7 @@ internal AlertsOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task BeginSimulateWithHttpMessagesAsync(AlertSimulatorRequestProperties properties = default(AlertSimulatorRequestProperties), Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task SimulateWithHttpMessagesAsync(string ascLocation, AlertSimulatorRequestProperties properties = default(AlertSimulatorRequestProperties), Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -2451,11 +2486,11 @@ internal AlertsOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } - string apiVersion = "2021-01-01"; + string apiVersion = "2021-11-01"; AlertSimulatorRequestBody alertSimulatorRequestBody = new AlertSimulatorRequestBody(); if (properties != null) { @@ -2469,15 +2504,16 @@ internal AlertsOperations(SecurityCenterClient client) _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); tracingParameters.Add("apiVersion", apiVersion); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("alertSimulatorRequestBody", alertSimulatorRequestBody); tracingParameters.Add("cancellationToken", cancellationToken); - ServiceClientTracing.Enter(_invocationId, this, "BeginSimulate", tracingParameters); + ServiceClientTracing.Enter(_invocationId, this, "Simulate", tracingParameters); } // Construct URL var _baseUrl = Client.BaseUri.AbsoluteUri; var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/providers/Microsoft.Security/locations/{ascLocation}/alerts/default/simulate").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); List _queryParameters = new List(); if (apiVersion != null) { @@ -2547,7 +2583,7 @@ internal AlertsOperations(SecurityCenterClient client) HttpStatusCode _statusCode = _httpResponse.StatusCode; cancellationToken.ThrowIfCancellationRequested(); string _responseContent = null; - if ((int)_statusCode != 202) + if ((int)_statusCode != 204) { var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode)); try diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AlertsOperationsExtensions.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AlertsOperationsExtensions.cs index df7eed486658..4e0b5edaf6e1 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AlertsOperationsExtensions.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AlertsOperationsExtensions.cs @@ -92,9 +92,13 @@ public static IPage ListByResourceGroup(this IAlertsOperations operations /// /// The operations group for this extension method. /// - public static IPage ListSubscriptionLevelByRegion(this IAlertsOperations operations) + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// + public static IPage ListSubscriptionLevelByRegion(this IAlertsOperations operations, string ascLocation) { - return operations.ListSubscriptionLevelByRegionAsync().GetAwaiter().GetResult(); + return operations.ListSubscriptionLevelByRegionAsync(ascLocation).GetAwaiter().GetResult(); } /// @@ -104,12 +108,16 @@ public static IPage ListSubscriptionLevelByRegion(this IAlertsOperations /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// The cancellation token. /// - public static async Task> ListSubscriptionLevelByRegionAsync(this IAlertsOperations operations, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task> ListSubscriptionLevelByRegionAsync(this IAlertsOperations operations, string ascLocation, CancellationToken cancellationToken = default(CancellationToken)) { - using (var _result = await operations.ListSubscriptionLevelByRegionWithHttpMessagesAsync(null, cancellationToken).ConfigureAwait(false)) + using (var _result = await operations.ListSubscriptionLevelByRegionWithHttpMessagesAsync(ascLocation, null, cancellationToken).ConfigureAwait(false)) { return _result.Body; } @@ -122,13 +130,17 @@ public static IPage ListSubscriptionLevelByRegion(this IAlertsOperations /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// - public static IPage ListResourceGroupLevelByRegion(this IAlertsOperations operations, string resourceGroupName) + public static IPage ListResourceGroupLevelByRegion(this IAlertsOperations operations, string ascLocation, string resourceGroupName) { - return operations.ListResourceGroupLevelByRegionAsync(resourceGroupName).GetAwaiter().GetResult(); + return operations.ListResourceGroupLevelByRegionAsync(ascLocation, resourceGroupName).GetAwaiter().GetResult(); } /// @@ -138,6 +150,10 @@ public static IPage ListResourceGroupLevelByRegion(this IAlertsOperations /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// The name of the resource group within the user's subscription. The name is /// case insensitive. @@ -145,9 +161,9 @@ public static IPage ListResourceGroupLevelByRegion(this IAlertsOperations /// /// The cancellation token. /// - public static async Task> ListResourceGroupLevelByRegionAsync(this IAlertsOperations operations, string resourceGroupName, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task> ListResourceGroupLevelByRegionAsync(this IAlertsOperations operations, string ascLocation, string resourceGroupName, CancellationToken cancellationToken = default(CancellationToken)) { - using (var _result = await operations.ListResourceGroupLevelByRegionWithHttpMessagesAsync(resourceGroupName, null, cancellationToken).ConfigureAwait(false)) + using (var _result = await operations.ListResourceGroupLevelByRegionWithHttpMessagesAsync(ascLocation, resourceGroupName, null, cancellationToken).ConfigureAwait(false)) { return _result.Body; } @@ -159,12 +175,16 @@ public static IPage ListResourceGroupLevelByRegion(this IAlertsOperations /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the alert object /// - public static Alert GetSubscriptionLevel(this IAlertsOperations operations, string alertName) + public static Alert GetSubscriptionLevel(this IAlertsOperations operations, string ascLocation, string alertName) { - return operations.GetSubscriptionLevelAsync(alertName).GetAwaiter().GetResult(); + return operations.GetSubscriptionLevelAsync(ascLocation, alertName).GetAwaiter().GetResult(); } /// @@ -173,15 +193,19 @@ public static Alert GetSubscriptionLevel(this IAlertsOperations operations, stri /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the alert object /// /// /// The cancellation token. /// - public static async Task GetSubscriptionLevelAsync(this IAlertsOperations operations, string alertName, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task GetSubscriptionLevelAsync(this IAlertsOperations operations, string ascLocation, string alertName, CancellationToken cancellationToken = default(CancellationToken)) { - using (var _result = await operations.GetSubscriptionLevelWithHttpMessagesAsync(alertName, null, cancellationToken).ConfigureAwait(false)) + using (var _result = await operations.GetSubscriptionLevelWithHttpMessagesAsync(ascLocation, alertName, null, cancellationToken).ConfigureAwait(false)) { return _result.Body; } @@ -194,6 +218,10 @@ public static Alert GetSubscriptionLevel(this IAlertsOperations operations, stri /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the alert object /// @@ -201,9 +229,9 @@ public static Alert GetSubscriptionLevel(this IAlertsOperations operations, stri /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// - public static Alert GetResourceGroupLevel(this IAlertsOperations operations, string alertName, string resourceGroupName) + public static Alert GetResourceGroupLevel(this IAlertsOperations operations, string ascLocation, string alertName, string resourceGroupName) { - return operations.GetResourceGroupLevelAsync(alertName, resourceGroupName).GetAwaiter().GetResult(); + return operations.GetResourceGroupLevelAsync(ascLocation, alertName, resourceGroupName).GetAwaiter().GetResult(); } /// @@ -213,6 +241,10 @@ public static Alert GetResourceGroupLevel(this IAlertsOperations operations, str /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the alert object /// @@ -223,9 +255,9 @@ public static Alert GetResourceGroupLevel(this IAlertsOperations operations, str /// /// The cancellation token. /// - public static async Task GetResourceGroupLevelAsync(this IAlertsOperations operations, string alertName, string resourceGroupName, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task GetResourceGroupLevelAsync(this IAlertsOperations operations, string ascLocation, string alertName, string resourceGroupName, CancellationToken cancellationToken = default(CancellationToken)) { - using (var _result = await operations.GetResourceGroupLevelWithHttpMessagesAsync(alertName, resourceGroupName, null, cancellationToken).ConfigureAwait(false)) + using (var _result = await operations.GetResourceGroupLevelWithHttpMessagesAsync(ascLocation, alertName, resourceGroupName, null, cancellationToken).ConfigureAwait(false)) { return _result.Body; } @@ -237,12 +269,16 @@ public static Alert GetResourceGroupLevel(this IAlertsOperations operations, str /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the alert object /// - public static void UpdateSubscriptionLevelStateToDismiss(this IAlertsOperations operations, string alertName) + public static void UpdateSubscriptionLevelStateToDismiss(this IAlertsOperations operations, string ascLocation, string alertName) { - operations.UpdateSubscriptionLevelStateToDismissAsync(alertName).GetAwaiter().GetResult(); + operations.UpdateSubscriptionLevelStateToDismissAsync(ascLocation, alertName).GetAwaiter().GetResult(); } /// @@ -251,15 +287,19 @@ public static void UpdateSubscriptionLevelStateToDismiss(this IAlertsOperations /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the alert object /// /// /// The cancellation token. /// - public static async Task UpdateSubscriptionLevelStateToDismissAsync(this IAlertsOperations operations, string alertName, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task UpdateSubscriptionLevelStateToDismissAsync(this IAlertsOperations operations, string ascLocation, string alertName, CancellationToken cancellationToken = default(CancellationToken)) { - (await operations.UpdateSubscriptionLevelStateToDismissWithHttpMessagesAsync(alertName, null, cancellationToken).ConfigureAwait(false)).Dispose(); + (await operations.UpdateSubscriptionLevelStateToDismissWithHttpMessagesAsync(ascLocation, alertName, null, cancellationToken).ConfigureAwait(false)).Dispose(); } /// @@ -268,12 +308,16 @@ public static void UpdateSubscriptionLevelStateToDismiss(this IAlertsOperations /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the alert object /// - public static void UpdateSubscriptionLevelStateToResolve(this IAlertsOperations operations, string alertName) + public static void UpdateSubscriptionLevelStateToResolve(this IAlertsOperations operations, string ascLocation, string alertName) { - operations.UpdateSubscriptionLevelStateToResolveAsync(alertName).GetAwaiter().GetResult(); + operations.UpdateSubscriptionLevelStateToResolveAsync(ascLocation, alertName).GetAwaiter().GetResult(); } /// @@ -282,15 +326,19 @@ public static void UpdateSubscriptionLevelStateToResolve(this IAlertsOperations /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the alert object /// /// /// The cancellation token. /// - public static async Task UpdateSubscriptionLevelStateToResolveAsync(this IAlertsOperations operations, string alertName, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task UpdateSubscriptionLevelStateToResolveAsync(this IAlertsOperations operations, string ascLocation, string alertName, CancellationToken cancellationToken = default(CancellationToken)) { - (await operations.UpdateSubscriptionLevelStateToResolveWithHttpMessagesAsync(alertName, null, cancellationToken).ConfigureAwait(false)).Dispose(); + (await operations.UpdateSubscriptionLevelStateToResolveWithHttpMessagesAsync(ascLocation, alertName, null, cancellationToken).ConfigureAwait(false)).Dispose(); } /// @@ -299,12 +347,16 @@ public static void UpdateSubscriptionLevelStateToResolve(this IAlertsOperations /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the alert object /// - public static void UpdateSubscriptionLevelStateToActivate(this IAlertsOperations operations, string alertName) + public static void UpdateSubscriptionLevelStateToActivate(this IAlertsOperations operations, string ascLocation, string alertName) { - operations.UpdateSubscriptionLevelStateToActivateAsync(alertName).GetAwaiter().GetResult(); + operations.UpdateSubscriptionLevelStateToActivateAsync(ascLocation, alertName).GetAwaiter().GetResult(); } /// @@ -313,15 +365,19 @@ public static void UpdateSubscriptionLevelStateToActivate(this IAlertsOperations /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the alert object /// /// /// The cancellation token. /// - public static async Task UpdateSubscriptionLevelStateToActivateAsync(this IAlertsOperations operations, string alertName, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task UpdateSubscriptionLevelStateToActivateAsync(this IAlertsOperations operations, string ascLocation, string alertName, CancellationToken cancellationToken = default(CancellationToken)) { - (await operations.UpdateSubscriptionLevelStateToActivateWithHttpMessagesAsync(alertName, null, cancellationToken).ConfigureAwait(false)).Dispose(); + (await operations.UpdateSubscriptionLevelStateToActivateWithHttpMessagesAsync(ascLocation, alertName, null, cancellationToken).ConfigureAwait(false)).Dispose(); } /// @@ -330,6 +386,10 @@ public static void UpdateSubscriptionLevelStateToActivate(this IAlertsOperations /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the alert object /// @@ -337,9 +397,9 @@ public static void UpdateSubscriptionLevelStateToActivate(this IAlertsOperations /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// - public static void UpdateResourceGroupLevelStateToResolve(this IAlertsOperations operations, string alertName, string resourceGroupName) + public static void UpdateResourceGroupLevelStateToResolve(this IAlertsOperations operations, string ascLocation, string alertName, string resourceGroupName) { - operations.UpdateResourceGroupLevelStateToResolveAsync(alertName, resourceGroupName).GetAwaiter().GetResult(); + operations.UpdateResourceGroupLevelStateToResolveAsync(ascLocation, alertName, resourceGroupName).GetAwaiter().GetResult(); } /// @@ -348,6 +408,10 @@ public static void UpdateResourceGroupLevelStateToResolve(this IAlertsOperations /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the alert object /// @@ -358,9 +422,9 @@ public static void UpdateResourceGroupLevelStateToResolve(this IAlertsOperations /// /// The cancellation token. /// - public static async Task UpdateResourceGroupLevelStateToResolveAsync(this IAlertsOperations operations, string alertName, string resourceGroupName, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task UpdateResourceGroupLevelStateToResolveAsync(this IAlertsOperations operations, string ascLocation, string alertName, string resourceGroupName, CancellationToken cancellationToken = default(CancellationToken)) { - (await operations.UpdateResourceGroupLevelStateToResolveWithHttpMessagesAsync(alertName, resourceGroupName, null, cancellationToken).ConfigureAwait(false)).Dispose(); + (await operations.UpdateResourceGroupLevelStateToResolveWithHttpMessagesAsync(ascLocation, alertName, resourceGroupName, null, cancellationToken).ConfigureAwait(false)).Dispose(); } /// @@ -369,6 +433,10 @@ public static void UpdateResourceGroupLevelStateToResolve(this IAlertsOperations /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the alert object /// @@ -376,9 +444,9 @@ public static void UpdateResourceGroupLevelStateToResolve(this IAlertsOperations /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// - public static void UpdateResourceGroupLevelStateToDismiss(this IAlertsOperations operations, string alertName, string resourceGroupName) + public static void UpdateResourceGroupLevelStateToDismiss(this IAlertsOperations operations, string ascLocation, string alertName, string resourceGroupName) { - operations.UpdateResourceGroupLevelStateToDismissAsync(alertName, resourceGroupName).GetAwaiter().GetResult(); + operations.UpdateResourceGroupLevelStateToDismissAsync(ascLocation, alertName, resourceGroupName).GetAwaiter().GetResult(); } /// @@ -387,6 +455,10 @@ public static void UpdateResourceGroupLevelStateToDismiss(this IAlertsOperations /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the alert object /// @@ -397,9 +469,9 @@ public static void UpdateResourceGroupLevelStateToDismiss(this IAlertsOperations /// /// The cancellation token. /// - public static async Task UpdateResourceGroupLevelStateToDismissAsync(this IAlertsOperations operations, string alertName, string resourceGroupName, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task UpdateResourceGroupLevelStateToDismissAsync(this IAlertsOperations operations, string ascLocation, string alertName, string resourceGroupName, CancellationToken cancellationToken = default(CancellationToken)) { - (await operations.UpdateResourceGroupLevelStateToDismissWithHttpMessagesAsync(alertName, resourceGroupName, null, cancellationToken).ConfigureAwait(false)).Dispose(); + (await operations.UpdateResourceGroupLevelStateToDismissWithHttpMessagesAsync(ascLocation, alertName, resourceGroupName, null, cancellationToken).ConfigureAwait(false)).Dispose(); } /// @@ -408,6 +480,10 @@ public static void UpdateResourceGroupLevelStateToDismiss(this IAlertsOperations /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the alert object /// @@ -415,9 +491,9 @@ public static void UpdateResourceGroupLevelStateToDismiss(this IAlertsOperations /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// - public static void UpdateResourceGroupLevelStateToActivate(this IAlertsOperations operations, string alertName, string resourceGroupName) + public static void UpdateResourceGroupLevelStateToActivate(this IAlertsOperations operations, string ascLocation, string alertName, string resourceGroupName) { - operations.UpdateResourceGroupLevelStateToActivateAsync(alertName, resourceGroupName).GetAwaiter().GetResult(); + operations.UpdateResourceGroupLevelStateToActivateAsync(ascLocation, alertName, resourceGroupName).GetAwaiter().GetResult(); } /// @@ -426,6 +502,10 @@ public static void UpdateResourceGroupLevelStateToActivate(this IAlertsOperation /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the alert object /// @@ -436,9 +516,9 @@ public static void UpdateResourceGroupLevelStateToActivate(this IAlertsOperation /// /// The cancellation token. /// - public static async Task UpdateResourceGroupLevelStateToActivateAsync(this IAlertsOperations operations, string alertName, string resourceGroupName, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task UpdateResourceGroupLevelStateToActivateAsync(this IAlertsOperations operations, string ascLocation, string alertName, string resourceGroupName, CancellationToken cancellationToken = default(CancellationToken)) { - (await operations.UpdateResourceGroupLevelStateToActivateWithHttpMessagesAsync(alertName, resourceGroupName, null, cancellationToken).ConfigureAwait(false)).Dispose(); + (await operations.UpdateResourceGroupLevelStateToActivateWithHttpMessagesAsync(ascLocation, alertName, resourceGroupName, null, cancellationToken).ConfigureAwait(false)).Dispose(); } /// @@ -447,29 +527,16 @@ public static void UpdateResourceGroupLevelStateToActivate(this IAlertsOperation /// /// The operations group for this extension method. /// - /// - /// Alert Simulator request body data. - /// - public static void Simulate(this IAlertsOperations operations, AlertSimulatorRequestProperties properties = default(AlertSimulatorRequestProperties)) - { - operations.SimulateAsync(properties).GetAwaiter().GetResult(); - } - - /// - /// Simulate security alerts - /// - /// - /// The operations group for this extension method. + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations /// /// /// Alert Simulator request body data. /// - /// - /// The cancellation token. - /// - public static async Task SimulateAsync(this IAlertsOperations operations, AlertSimulatorRequestProperties properties = default(AlertSimulatorRequestProperties), CancellationToken cancellationToken = default(CancellationToken)) + public static void Simulate(this IAlertsOperations operations, string ascLocation, AlertSimulatorRequestProperties properties = default(AlertSimulatorRequestProperties)) { - (await operations.SimulateWithHttpMessagesAsync(properties, null, cancellationToken).ConfigureAwait(false)).Dispose(); + operations.SimulateAsync(ascLocation, properties).GetAwaiter().GetResult(); } /// @@ -478,19 +545,9 @@ public static void UpdateResourceGroupLevelStateToActivate(this IAlertsOperation /// /// The operations group for this extension method. /// - /// - /// Alert Simulator request body data. - /// - public static void BeginSimulate(this IAlertsOperations operations, AlertSimulatorRequestProperties properties = default(AlertSimulatorRequestProperties)) - { - operations.BeginSimulateAsync(properties).GetAwaiter().GetResult(); - } - - /// - /// Simulate security alerts - /// - /// - /// The operations group for this extension method. + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations /// /// /// Alert Simulator request body data. @@ -498,9 +555,9 @@ public static void UpdateResourceGroupLevelStateToActivate(this IAlertsOperation /// /// The cancellation token. /// - public static async Task BeginSimulateAsync(this IAlertsOperations operations, AlertSimulatorRequestProperties properties = default(AlertSimulatorRequestProperties), CancellationToken cancellationToken = default(CancellationToken)) + public static async Task SimulateAsync(this IAlertsOperations operations, string ascLocation, AlertSimulatorRequestProperties properties = default(AlertSimulatorRequestProperties), CancellationToken cancellationToken = default(CancellationToken)) { - (await operations.BeginSimulateWithHttpMessagesAsync(properties, null, cancellationToken).ConfigureAwait(false)).Dispose(); + (await operations.SimulateWithHttpMessagesAsync(ascLocation, properties, null, cancellationToken).ConfigureAwait(false)).Dispose(); } /// diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AllowedConnectionsOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AllowedConnectionsOperations.cs index 683054249d40..fde848f700af 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AllowedConnectionsOperations.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AllowedConnectionsOperations.cs @@ -238,6 +238,10 @@ internal AllowedConnectionsOperations(SecurityCenterClient client) /// Gets the list of all possible traffic between resources for the /// subscription and location. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Headers that will be added to request. /// @@ -259,7 +263,7 @@ internal AllowedConnectionsOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task>> ListByHomeRegionWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task>> ListByHomeRegionWithHttpMessagesAsync(string ascLocation, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -272,9 +276,9 @@ internal AllowedConnectionsOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } string apiVersion = "2020-01-01"; // Tracing @@ -284,6 +288,7 @@ internal AllowedConnectionsOperations(SecurityCenterClient client) { _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("apiVersion", apiVersion); tracingParameters.Add("cancellationToken", cancellationToken); ServiceClientTracing.Enter(_invocationId, this, "ListByHomeRegion", tracingParameters); @@ -292,7 +297,7 @@ internal AllowedConnectionsOperations(SecurityCenterClient client) var _baseUrl = Client.BaseUri.AbsoluteUri; var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/providers/Microsoft.Security/locations/{ascLocation}/allowedConnections").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); List _queryParameters = new List(); if (apiVersion != null) { @@ -431,6 +436,10 @@ internal AllowedConnectionsOperations(SecurityCenterClient client) /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// The type of allowed connections (Internal, External). Possible values /// include: 'Internal', 'External' @@ -456,7 +465,7 @@ internal AllowedConnectionsOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task> GetWithHttpMessagesAsync(string resourceGroupName, string connectionType, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task> GetWithHttpMessagesAsync(string resourceGroupName, string ascLocation, string connectionType, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -488,9 +497,9 @@ internal AllowedConnectionsOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } if (connectionType == null) { @@ -505,6 +514,7 @@ internal AllowedConnectionsOperations(SecurityCenterClient client) _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); tracingParameters.Add("resourceGroupName", resourceGroupName); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("connectionType", connectionType); tracingParameters.Add("apiVersion", apiVersion); tracingParameters.Add("cancellationToken", cancellationToken); @@ -515,7 +525,7 @@ internal AllowedConnectionsOperations(SecurityCenterClient client) var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/locations/{ascLocation}/allowedConnections/{connectionType}").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); _url = _url.Replace("{connectionType}", System.Uri.EscapeDataString(connectionType)); List _queryParameters = new List(); if (apiVersion != null) diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AllowedConnectionsOperationsExtensions.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AllowedConnectionsOperationsExtensions.cs index e28c1214a53d..a2d482642958 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AllowedConnectionsOperationsExtensions.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AllowedConnectionsOperationsExtensions.cs @@ -58,9 +58,13 @@ public static IPage List(this IAllowedConnectionsOpe /// /// The operations group for this extension method. /// - public static IPage ListByHomeRegion(this IAllowedConnectionsOperations operations) + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// + public static IPage ListByHomeRegion(this IAllowedConnectionsOperations operations, string ascLocation) { - return operations.ListByHomeRegionAsync().GetAwaiter().GetResult(); + return operations.ListByHomeRegionAsync(ascLocation).GetAwaiter().GetResult(); } /// @@ -70,12 +74,16 @@ public static IPage ListByHomeRegion(this IAllowedCo /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// The cancellation token. /// - public static async Task> ListByHomeRegionAsync(this IAllowedConnectionsOperations operations, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task> ListByHomeRegionAsync(this IAllowedConnectionsOperations operations, string ascLocation, CancellationToken cancellationToken = default(CancellationToken)) { - using (var _result = await operations.ListByHomeRegionWithHttpMessagesAsync(null, cancellationToken).ConfigureAwait(false)) + using (var _result = await operations.ListByHomeRegionWithHttpMessagesAsync(ascLocation, null, cancellationToken).ConfigureAwait(false)) { return _result.Body; } @@ -92,13 +100,17 @@ public static IPage ListByHomeRegion(this IAllowedCo /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// The type of allowed connections (Internal, External). Possible values /// include: 'Internal', 'External' /// - public static AllowedConnectionsResource Get(this IAllowedConnectionsOperations operations, string resourceGroupName, string connectionType) + public static AllowedConnectionsResource Get(this IAllowedConnectionsOperations operations, string resourceGroupName, string ascLocation, string connectionType) { - return operations.GetAsync(resourceGroupName, connectionType).GetAwaiter().GetResult(); + return operations.GetAsync(resourceGroupName, ascLocation, connectionType).GetAwaiter().GetResult(); } /// @@ -112,6 +124,10 @@ public static AllowedConnectionsResource Get(this IAllowedConnectionsOperations /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// The type of allowed connections (Internal, External). Possible values /// include: 'Internal', 'External' @@ -119,9 +135,9 @@ public static AllowedConnectionsResource Get(this IAllowedConnectionsOperations /// /// The cancellation token. /// - public static async Task GetAsync(this IAllowedConnectionsOperations operations, string resourceGroupName, string connectionType, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task GetAsync(this IAllowedConnectionsOperations operations, string resourceGroupName, string ascLocation, string connectionType, CancellationToken cancellationToken = default(CancellationToken)) { - using (var _result = await operations.GetWithHttpMessagesAsync(resourceGroupName, connectionType, null, cancellationToken).ConfigureAwait(false)) + using (var _result = await operations.GetWithHttpMessagesAsync(resourceGroupName, ascLocation, connectionType, null, cancellationToken).ConfigureAwait(false)) { return _result.Body; } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AssessmentsMetadataOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AssessmentsMetadataOperations.cs index b757fa445559..6b11d7dceecc 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AssessmentsMetadataOperations.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AssessmentsMetadataOperations.cs @@ -68,9 +68,9 @@ internal AssessmentsMetadataOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task>> ListWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task>> ListWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { - string apiVersion = "2020-01-01"; + string apiVersion = "2021-06-01"; // Tracing bool _shouldTrace = ServiceClientTracing.IsEnabled; string _invocationId = null; @@ -183,7 +183,7 @@ internal AssessmentsMetadataOperations(SecurityCenterClient client) throw ex; } // Create Result - var _result = new AzureOperationResponse>(); + var _result = new AzureOperationResponse>(); _result.Request = _httpRequest; _result.Response = _httpResponse; if (_httpResponse.Headers.Contains("x-ms-request-id")) @@ -196,7 +196,7 @@ internal AssessmentsMetadataOperations(SecurityCenterClient client) _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); try { - _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject>(_responseContent, Client.DeserializationSettings); + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject>(_responseContent, Client.DeserializationSettings); } catch (JsonException ex) { @@ -242,13 +242,13 @@ internal AssessmentsMetadataOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task> GetWithHttpMessagesAsync(string assessmentMetadataName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task> GetWithHttpMessagesAsync(string assessmentMetadataName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (assessmentMetadataName == null) { throw new ValidationException(ValidationRules.CannotBeNull, "assessmentMetadataName"); } - string apiVersion = "2020-01-01"; + string apiVersion = "2021-06-01"; // Tracing bool _shouldTrace = ServiceClientTracing.IsEnabled; string _invocationId = null; @@ -363,7 +363,7 @@ internal AssessmentsMetadataOperations(SecurityCenterClient client) throw ex; } // Create Result - var _result = new AzureOperationResponse(); + var _result = new AzureOperationResponse(); _result.Request = _httpRequest; _result.Response = _httpResponse; if (_httpResponse.Headers.Contains("x-ms-request-id")) @@ -376,7 +376,7 @@ internal AssessmentsMetadataOperations(SecurityCenterClient client) _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); try { - _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); } catch (JsonException ex) { @@ -419,7 +419,7 @@ internal AssessmentsMetadataOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task>> ListBySubscriptionWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task>> ListBySubscriptionWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -432,7 +432,7 @@ internal AssessmentsMetadataOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); } } - string apiVersion = "2020-01-01"; + string apiVersion = "2021-06-01"; // Tracing bool _shouldTrace = ServiceClientTracing.IsEnabled; string _invocationId = null; @@ -546,7 +546,7 @@ internal AssessmentsMetadataOperations(SecurityCenterClient client) throw ex; } // Create Result - var _result = new AzureOperationResponse>(); + var _result = new AzureOperationResponse>(); _result.Request = _httpRequest; _result.Response = _httpResponse; if (_httpResponse.Headers.Contains("x-ms-request-id")) @@ -559,7 +559,7 @@ internal AssessmentsMetadataOperations(SecurityCenterClient client) _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); try { - _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject>(_responseContent, Client.DeserializationSettings); + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject>(_responseContent, Client.DeserializationSettings); } catch (JsonException ex) { @@ -605,7 +605,7 @@ internal AssessmentsMetadataOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task> GetInSubscriptionWithHttpMessagesAsync(string assessmentMetadataName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task> GetInSubscriptionWithHttpMessagesAsync(string assessmentMetadataName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (assessmentMetadataName == null) { @@ -622,7 +622,7 @@ internal AssessmentsMetadataOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); } } - string apiVersion = "2020-01-01"; + string apiVersion = "2021-06-01"; // Tracing bool _shouldTrace = ServiceClientTracing.IsEnabled; string _invocationId = null; @@ -738,7 +738,7 @@ internal AssessmentsMetadataOperations(SecurityCenterClient client) throw ex; } // Create Result - var _result = new AzureOperationResponse(); + var _result = new AzureOperationResponse(); _result.Request = _httpRequest; _result.Response = _httpResponse; if (_httpResponse.Headers.Contains("x-ms-request-id")) @@ -751,7 +751,7 @@ internal AssessmentsMetadataOperations(SecurityCenterClient client) _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); try { - _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); } catch (JsonException ex) { @@ -801,7 +801,7 @@ internal AssessmentsMetadataOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task> CreateInSubscriptionWithHttpMessagesAsync(string assessmentMetadataName, SecurityAssessmentMetadata assessmentMetadata, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task> CreateInSubscriptionWithHttpMessagesAsync(string assessmentMetadataName, SecurityAssessmentMetadataResponse assessmentMetadata, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (assessmentMetadataName == null) { @@ -826,7 +826,7 @@ internal AssessmentsMetadataOperations(SecurityCenterClient client) { assessmentMetadata.Validate(); } - string apiVersion = "2020-01-01"; + string apiVersion = "2021-06-01"; // Tracing bool _shouldTrace = ServiceClientTracing.IsEnabled; string _invocationId = null; @@ -949,7 +949,7 @@ internal AssessmentsMetadataOperations(SecurityCenterClient client) throw ex; } // Create Result - var _result = new AzureOperationResponse(); + var _result = new AzureOperationResponse(); _result.Request = _httpRequest; _result.Response = _httpResponse; if (_httpResponse.Headers.Contains("x-ms-request-id")) @@ -962,7 +962,7 @@ internal AssessmentsMetadataOperations(SecurityCenterClient client) _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); try { - _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); } catch (JsonException ex) { @@ -1024,7 +1024,7 @@ internal AssessmentsMetadataOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); } } - string apiVersion = "2020-01-01"; + string apiVersion = "2021-06-01"; // Tracing bool _shouldTrace = ServiceClientTracing.IsEnabled; string _invocationId = null; @@ -1181,7 +1181,7 @@ internal AssessmentsMetadataOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task>> ListNextWithHttpMessagesAsync(string nextPageLink, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task>> ListNextWithHttpMessagesAsync(string nextPageLink, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (nextPageLink == null) { @@ -1295,7 +1295,7 @@ internal AssessmentsMetadataOperations(SecurityCenterClient client) throw ex; } // Create Result - var _result = new AzureOperationResponse>(); + var _result = new AzureOperationResponse>(); _result.Request = _httpRequest; _result.Response = _httpResponse; if (_httpResponse.Headers.Contains("x-ms-request-id")) @@ -1308,7 +1308,7 @@ internal AssessmentsMetadataOperations(SecurityCenterClient client) _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); try { - _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject>(_responseContent, Client.DeserializationSettings); + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject>(_responseContent, Client.DeserializationSettings); } catch (JsonException ex) { @@ -1354,7 +1354,7 @@ internal AssessmentsMetadataOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task>> ListBySubscriptionNextWithHttpMessagesAsync(string nextPageLink, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task>> ListBySubscriptionNextWithHttpMessagesAsync(string nextPageLink, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (nextPageLink == null) { @@ -1468,7 +1468,7 @@ internal AssessmentsMetadataOperations(SecurityCenterClient client) throw ex; } // Create Result - var _result = new AzureOperationResponse>(); + var _result = new AzureOperationResponse>(); _result.Request = _httpRequest; _result.Response = _httpResponse; if (_httpResponse.Headers.Contains("x-ms-request-id")) @@ -1481,7 +1481,7 @@ internal AssessmentsMetadataOperations(SecurityCenterClient client) _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); try { - _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject>(_responseContent, Client.DeserializationSettings); + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject>(_responseContent, Client.DeserializationSettings); } catch (JsonException ex) { diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AssessmentsMetadataOperationsExtensions.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AssessmentsMetadataOperationsExtensions.cs index 107d2e3b56ae..9170cabf9e6d 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AssessmentsMetadataOperationsExtensions.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AssessmentsMetadataOperationsExtensions.cs @@ -27,7 +27,7 @@ public static partial class AssessmentsMetadataOperationsExtensions /// /// The operations group for this extension method. /// - public static IPage List(this IAssessmentsMetadataOperations operations) + public static IPage List(this IAssessmentsMetadataOperations operations) { return operations.ListAsync().GetAwaiter().GetResult(); } @@ -41,7 +41,7 @@ public static IPage List(this IAssessmentsMetadataOp /// /// The cancellation token. /// - public static async Task> ListAsync(this IAssessmentsMetadataOperations operations, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task> ListAsync(this IAssessmentsMetadataOperations operations, CancellationToken cancellationToken = default(CancellationToken)) { using (var _result = await operations.ListWithHttpMessagesAsync(null, cancellationToken).ConfigureAwait(false)) { @@ -58,7 +58,7 @@ public static IPage List(this IAssessmentsMetadataOp /// /// The Assessment Key - Unique key for the assessment type /// - public static SecurityAssessmentMetadata Get(this IAssessmentsMetadataOperations operations, string assessmentMetadataName) + public static SecurityAssessmentMetadataResponse Get(this IAssessmentsMetadataOperations operations, string assessmentMetadataName) { return operations.GetAsync(assessmentMetadataName).GetAwaiter().GetResult(); } @@ -75,7 +75,7 @@ public static SecurityAssessmentMetadata Get(this IAssessmentsMetadataOperations /// /// The cancellation token. /// - public static async Task GetAsync(this IAssessmentsMetadataOperations operations, string assessmentMetadataName, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task GetAsync(this IAssessmentsMetadataOperations operations, string assessmentMetadataName, CancellationToken cancellationToken = default(CancellationToken)) { using (var _result = await operations.GetWithHttpMessagesAsync(assessmentMetadataName, null, cancellationToken).ConfigureAwait(false)) { @@ -89,7 +89,7 @@ public static SecurityAssessmentMetadata Get(this IAssessmentsMetadataOperations /// /// The operations group for this extension method. /// - public static IPage ListBySubscription(this IAssessmentsMetadataOperations operations) + public static IPage ListBySubscription(this IAssessmentsMetadataOperations operations) { return operations.ListBySubscriptionAsync().GetAwaiter().GetResult(); } @@ -103,7 +103,7 @@ public static IPage ListBySubscription(this IAssessm /// /// The cancellation token. /// - public static async Task> ListBySubscriptionAsync(this IAssessmentsMetadataOperations operations, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task> ListBySubscriptionAsync(this IAssessmentsMetadataOperations operations, CancellationToken cancellationToken = default(CancellationToken)) { using (var _result = await operations.ListBySubscriptionWithHttpMessagesAsync(null, cancellationToken).ConfigureAwait(false)) { @@ -120,7 +120,7 @@ public static IPage ListBySubscription(this IAssessm /// /// The Assessment Key - Unique key for the assessment type /// - public static SecurityAssessmentMetadata GetInSubscription(this IAssessmentsMetadataOperations operations, string assessmentMetadataName) + public static SecurityAssessmentMetadataResponse GetInSubscription(this IAssessmentsMetadataOperations operations, string assessmentMetadataName) { return operations.GetInSubscriptionAsync(assessmentMetadataName).GetAwaiter().GetResult(); } @@ -137,7 +137,7 @@ public static SecurityAssessmentMetadata GetInSubscription(this IAssessmentsMeta /// /// The cancellation token. /// - public static async Task GetInSubscriptionAsync(this IAssessmentsMetadataOperations operations, string assessmentMetadataName, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task GetInSubscriptionAsync(this IAssessmentsMetadataOperations operations, string assessmentMetadataName, CancellationToken cancellationToken = default(CancellationToken)) { using (var _result = await operations.GetInSubscriptionWithHttpMessagesAsync(assessmentMetadataName, null, cancellationToken).ConfigureAwait(false)) { @@ -158,7 +158,7 @@ public static SecurityAssessmentMetadata GetInSubscription(this IAssessmentsMeta /// /// AssessmentMetadata object /// - public static SecurityAssessmentMetadata CreateInSubscription(this IAssessmentsMetadataOperations operations, string assessmentMetadataName, SecurityAssessmentMetadata assessmentMetadata) + public static SecurityAssessmentMetadataResponse CreateInSubscription(this IAssessmentsMetadataOperations operations, string assessmentMetadataName, SecurityAssessmentMetadataResponse assessmentMetadata) { return operations.CreateInSubscriptionAsync(assessmentMetadataName, assessmentMetadata).GetAwaiter().GetResult(); } @@ -179,7 +179,7 @@ public static SecurityAssessmentMetadata CreateInSubscription(this IAssessmentsM /// /// The cancellation token. /// - public static async Task CreateInSubscriptionAsync(this IAssessmentsMetadataOperations operations, string assessmentMetadataName, SecurityAssessmentMetadata assessmentMetadata, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task CreateInSubscriptionAsync(this IAssessmentsMetadataOperations operations, string assessmentMetadataName, SecurityAssessmentMetadataResponse assessmentMetadata, CancellationToken cancellationToken = default(CancellationToken)) { using (var _result = await operations.CreateInSubscriptionWithHttpMessagesAsync(assessmentMetadataName, assessmentMetadata, null, cancellationToken).ConfigureAwait(false)) { @@ -231,7 +231,7 @@ public static void DeleteInSubscription(this IAssessmentsMetadataOperations oper /// /// The NextLink from the previous successful call to List operation. /// - public static IPage ListNext(this IAssessmentsMetadataOperations operations, string nextPageLink) + public static IPage ListNext(this IAssessmentsMetadataOperations operations, string nextPageLink) { return operations.ListNextAsync(nextPageLink).GetAwaiter().GetResult(); } @@ -248,7 +248,7 @@ public static IPage ListNext(this IAssessmentsMetada /// /// The cancellation token. /// - public static async Task> ListNextAsync(this IAssessmentsMetadataOperations operations, string nextPageLink, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task> ListNextAsync(this IAssessmentsMetadataOperations operations, string nextPageLink, CancellationToken cancellationToken = default(CancellationToken)) { using (var _result = await operations.ListNextWithHttpMessagesAsync(nextPageLink, null, cancellationToken).ConfigureAwait(false)) { @@ -265,7 +265,7 @@ public static IPage ListNext(this IAssessmentsMetada /// /// The NextLink from the previous successful call to List operation. /// - public static IPage ListBySubscriptionNext(this IAssessmentsMetadataOperations operations, string nextPageLink) + public static IPage ListBySubscriptionNext(this IAssessmentsMetadataOperations operations, string nextPageLink) { return operations.ListBySubscriptionNextAsync(nextPageLink).GetAwaiter().GetResult(); } @@ -282,7 +282,7 @@ public static IPage ListBySubscriptionNext(this IAss /// /// The cancellation token. /// - public static async Task> ListBySubscriptionNextAsync(this IAssessmentsMetadataOperations operations, string nextPageLink, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task> ListBySubscriptionNextAsync(this IAssessmentsMetadataOperations operations, string nextPageLink, CancellationToken cancellationToken = default(CancellationToken)) { using (var _result = await operations.ListBySubscriptionNextWithHttpMessagesAsync(nextPageLink, null, cancellationToken).ConfigureAwait(false)) { diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AssessmentsOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AssessmentsOperations.cs index 1c5f938d1b19..a5585a960fc8 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AssessmentsOperations.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AssessmentsOperations.cs @@ -79,13 +79,13 @@ internal AssessmentsOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task>> ListWithHttpMessagesAsync(string scope, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task>> ListWithHttpMessagesAsync(string scope, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (scope == null) { throw new ValidationException(ValidationRules.CannotBeNull, "scope"); } - string apiVersion = "2020-01-01"; + string apiVersion = "2021-06-01"; // Tracing bool _shouldTrace = ServiceClientTracing.IsEnabled; string _invocationId = null; @@ -200,7 +200,7 @@ internal AssessmentsOperations(SecurityCenterClient client) throw ex; } // Create Result - var _result = new AzureOperationResponse>(); + var _result = new AzureOperationResponse>(); _result.Request = _httpRequest; _result.Response = _httpResponse; if (_httpResponse.Headers.Contains("x-ms-request-id")) @@ -213,7 +213,7 @@ internal AssessmentsOperations(SecurityCenterClient client) _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); try { - _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject>(_responseContent, Client.DeserializationSettings); + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject>(_responseContent, Client.DeserializationSettings); } catch (JsonException ex) { @@ -265,7 +265,7 @@ internal AssessmentsOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task> GetWithHttpMessagesAsync(string resourceId, string assessmentName, string expand = default(string), Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task> GetWithHttpMessagesAsync(string resourceId, string assessmentName, string expand = default(string), Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (resourceId == null) { @@ -275,7 +275,7 @@ internal AssessmentsOperations(SecurityCenterClient client) { throw new ValidationException(ValidationRules.CannotBeNull, "assessmentName"); } - string apiVersion = "2020-01-01"; + string apiVersion = "2021-06-01"; // Tracing bool _shouldTrace = ServiceClientTracing.IsEnabled; string _invocationId = null; @@ -397,7 +397,7 @@ internal AssessmentsOperations(SecurityCenterClient client) throw ex; } // Create Result - var _result = new AzureOperationResponse(); + var _result = new AzureOperationResponse(); _result.Request = _httpRequest; _result.Response = _httpResponse; if (_httpResponse.Headers.Contains("x-ms-request-id")) @@ -410,7 +410,7 @@ internal AssessmentsOperations(SecurityCenterClient client) _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); try { - _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); } catch (JsonException ex) { @@ -464,7 +464,7 @@ internal AssessmentsOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task> CreateOrUpdateWithHttpMessagesAsync(string resourceId, string assessmentName, SecurityAssessment assessment, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task> CreateOrUpdateWithHttpMessagesAsync(string resourceId, string assessmentName, SecurityAssessment assessment, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (resourceId == null) { @@ -482,7 +482,7 @@ internal AssessmentsOperations(SecurityCenterClient client) { assessment.Validate(); } - string apiVersion = "2020-01-01"; + string apiVersion = "2021-06-01"; // Tracing bool _shouldTrace = ServiceClientTracing.IsEnabled; string _invocationId = null; @@ -606,7 +606,7 @@ internal AssessmentsOperations(SecurityCenterClient client) throw ex; } // Create Result - var _result = new AzureOperationResponse(); + var _result = new AzureOperationResponse(); _result.Request = _httpRequest; _result.Response = _httpResponse; if (_httpResponse.Headers.Contains("x-ms-request-id")) @@ -619,7 +619,7 @@ internal AssessmentsOperations(SecurityCenterClient client) _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); try { - _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); } catch (JsonException ex) { @@ -637,7 +637,7 @@ internal AssessmentsOperations(SecurityCenterClient client) _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); try { - _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); } catch (JsonException ex) { @@ -695,7 +695,7 @@ internal AssessmentsOperations(SecurityCenterClient client) { throw new ValidationException(ValidationRules.CannotBeNull, "assessmentName"); } - string apiVersion = "2020-01-01"; + string apiVersion = "2021-06-01"; // Tracing bool _shouldTrace = ServiceClientTracing.IsEnabled; string _invocationId = null; @@ -853,7 +853,7 @@ internal AssessmentsOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task>> ListNextWithHttpMessagesAsync(string nextPageLink, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task>> ListNextWithHttpMessagesAsync(string nextPageLink, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (nextPageLink == null) { @@ -967,7 +967,7 @@ internal AssessmentsOperations(SecurityCenterClient client) throw ex; } // Create Result - var _result = new AzureOperationResponse>(); + var _result = new AzureOperationResponse>(); _result.Request = _httpRequest; _result.Response = _httpResponse; if (_httpResponse.Headers.Contains("x-ms-request-id")) @@ -980,7 +980,7 @@ internal AssessmentsOperations(SecurityCenterClient client) _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); try { - _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject>(_responseContent, Client.DeserializationSettings); + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject>(_responseContent, Client.DeserializationSettings); } catch (JsonException ex) { diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AssessmentsOperationsExtensions.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AssessmentsOperationsExtensions.cs index c2268da5ea28..77157c70c2c3 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AssessmentsOperationsExtensions.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/AssessmentsOperationsExtensions.cs @@ -32,7 +32,7 @@ public static partial class AssessmentsOperationsExtensions /// (/subscriptions/0b06d9ea-afe6-4779-bd59-30e5c2d9d13f) or management group /// (/providers/Microsoft.Management/managementGroups/mgName). /// - public static IPage List(this IAssessmentsOperations operations, string scope) + public static IPage List(this IAssessmentsOperations operations, string scope) { return operations.ListAsync(scope).GetAwaiter().GetResult(); } @@ -51,7 +51,7 @@ public static IPage List(this IAssessmentsOperations operati /// /// The cancellation token. /// - public static async Task> ListAsync(this IAssessmentsOperations operations, string scope, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task> ListAsync(this IAssessmentsOperations operations, string scope, CancellationToken cancellationToken = default(CancellationToken)) { using (var _result = await operations.ListWithHttpMessagesAsync(scope, null, cancellationToken).ConfigureAwait(false)) { @@ -74,7 +74,7 @@ public static IPage List(this IAssessmentsOperations operati /// /// OData expand. Optional. Possible values include: 'links', 'metadata' /// - public static SecurityAssessment Get(this IAssessmentsOperations operations, string resourceId, string assessmentName, string expand = default(string)) + public static SecurityAssessmentResponse Get(this IAssessmentsOperations operations, string resourceId, string assessmentName, string expand = default(string)) { return operations.GetAsync(resourceId, assessmentName, expand).GetAwaiter().GetResult(); } @@ -97,7 +97,7 @@ public static IPage List(this IAssessmentsOperations operati /// /// The cancellation token. /// - public static async Task GetAsync(this IAssessmentsOperations operations, string resourceId, string assessmentName, string expand = default(string), CancellationToken cancellationToken = default(CancellationToken)) + public static async Task GetAsync(this IAssessmentsOperations operations, string resourceId, string assessmentName, string expand = default(string), CancellationToken cancellationToken = default(CancellationToken)) { using (var _result = await operations.GetWithHttpMessagesAsync(resourceId, assessmentName, expand, null, cancellationToken).ConfigureAwait(false)) { @@ -122,7 +122,7 @@ public static IPage List(this IAssessmentsOperations operati /// /// Calculated assessment on a pre-defined assessment metadata /// - public static SecurityAssessment CreateOrUpdate(this IAssessmentsOperations operations, string resourceId, string assessmentName, SecurityAssessment assessment) + public static SecurityAssessmentResponse CreateOrUpdate(this IAssessmentsOperations operations, string resourceId, string assessmentName, SecurityAssessment assessment) { return operations.CreateOrUpdateAsync(resourceId, assessmentName, assessment).GetAwaiter().GetResult(); } @@ -147,7 +147,7 @@ public static SecurityAssessment CreateOrUpdate(this IAssessmentsOperations oper /// /// The cancellation token. /// - public static async Task CreateOrUpdateAsync(this IAssessmentsOperations operations, string resourceId, string assessmentName, SecurityAssessment assessment, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task CreateOrUpdateAsync(this IAssessmentsOperations operations, string resourceId, string assessmentName, SecurityAssessment assessment, CancellationToken cancellationToken = default(CancellationToken)) { using (var _result = await operations.CreateOrUpdateWithHttpMessagesAsync(resourceId, assessmentName, assessment, null, cancellationToken).ConfigureAwait(false)) { @@ -205,7 +205,7 @@ public static void Delete(this IAssessmentsOperations operations, string resourc /// /// The NextLink from the previous successful call to List operation. /// - public static IPage ListNext(this IAssessmentsOperations operations, string nextPageLink) + public static IPage ListNext(this IAssessmentsOperations operations, string nextPageLink) { return operations.ListNextAsync(nextPageLink).GetAwaiter().GetResult(); } @@ -222,7 +222,7 @@ public static IPage ListNext(this IAssessmentsOperations ope /// /// The cancellation token. /// - public static async Task> ListNextAsync(this IAssessmentsOperations operations, string nextPageLink, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task> ListNextAsync(this IAssessmentsOperations operations, string nextPageLink, CancellationToken cancellationToken = default(CancellationToken)) { using (var _result = await operations.ListNextWithHttpMessagesAsync(nextPageLink, null, cancellationToken).ConfigureAwait(false)) { diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/CustomAssessmentAutomationsOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/CustomAssessmentAutomationsOperations.cs new file mode 100644 index 000000000000..61b823a21c5b --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/CustomAssessmentAutomationsOperations.cs @@ -0,0 +1,1479 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security +{ + using Microsoft.Rest; + using Microsoft.Rest.Azure; + using Models; + using Newtonsoft.Json; + using System.Collections; + using System.Collections.Generic; + using System.Linq; + using System.Net; + using System.Net.Http; + using System.Threading; + using System.Threading.Tasks; + + /// + /// CustomAssessmentAutomationsOperations operations. + /// + internal partial class CustomAssessmentAutomationsOperations : IServiceOperations, ICustomAssessmentAutomationsOperations + { + /// + /// Initializes a new instance of the CustomAssessmentAutomationsOperations class. + /// + /// + /// Reference to the service client. + /// + /// + /// Thrown when a required parameter is null + /// + internal CustomAssessmentAutomationsOperations(SecurityCenterClient client) + { + if (client == null) + { + throw new System.ArgumentNullException("client"); + } + Client = client; + } + + /// + /// Gets a reference to the SecurityCenterClient + /// + public SecurityCenterClient Client { get; private set; } + + /// + /// Gets a custom assessment automation + /// + /// + /// Gets a single custom assessment automation by name for the provided + /// subscription and resource group. + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// Name of the Custom Assessment Automation. + /// + /// + /// Headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// A response object containing the response body and response headers. + /// + public async Task> GetWithHttpMessagesAsync(string resourceGroupName, string customAssessmentAutomationName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + { + if (Client.SubscriptionId == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId"); + } + if (Client.SubscriptionId != null) + { + if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$")) + { + throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); + } + } + if (resourceGroupName == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "resourceGroupName"); + } + if (resourceGroupName != null) + { + if (resourceGroupName.Length > 90) + { + throw new ValidationException(ValidationRules.MaxLength, "resourceGroupName", 90); + } + if (resourceGroupName.Length < 1) + { + throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1); + } + if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$")) + { + throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$"); + } + } + if (customAssessmentAutomationName == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "customAssessmentAutomationName"); + } + string apiVersion = "2021-07-01-preview"; + // Tracing + bool _shouldTrace = ServiceClientTracing.IsEnabled; + string _invocationId = null; + if (_shouldTrace) + { + _invocationId = ServiceClientTracing.NextInvocationId.ToString(); + Dictionary tracingParameters = new Dictionary(); + tracingParameters.Add("apiVersion", apiVersion); + tracingParameters.Add("resourceGroupName", resourceGroupName); + tracingParameters.Add("customAssessmentAutomationName", customAssessmentAutomationName); + tracingParameters.Add("cancellationToken", cancellationToken); + ServiceClientTracing.Enter(_invocationId, this, "Get", tracingParameters); + } + // Construct URL + var _baseUrl = Client.BaseUri.AbsoluteUri; + var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.Security/customAssessmentAutomations/{customAssessmentAutomationName}").ToString(); + _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); + _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName)); + _url = _url.Replace("{customAssessmentAutomationName}", System.Uri.EscapeDataString(customAssessmentAutomationName)); + List _queryParameters = new List(); + if (apiVersion != null) + { + _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(apiVersion))); + } + if (_queryParameters.Count > 0) + { + _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters); + } + // Create HTTP transport objects + var _httpRequest = new HttpRequestMessage(); + HttpResponseMessage _httpResponse = null; + _httpRequest.Method = new HttpMethod("GET"); + _httpRequest.RequestUri = new System.Uri(_url); + // Set Headers + if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value) + { + _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString()); + } + if (Client.AcceptLanguage != null) + { + if (_httpRequest.Headers.Contains("accept-language")) + { + _httpRequest.Headers.Remove("accept-language"); + } + _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage); + } + + + if (customHeaders != null) + { + foreach(var _header in customHeaders) + { + if (_httpRequest.Headers.Contains(_header.Key)) + { + _httpRequest.Headers.Remove(_header.Key); + } + _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value); + } + } + + // Serialize Request + string _requestContent = null; + // Set Credentials + if (Client.Credentials != null) + { + cancellationToken.ThrowIfCancellationRequested(); + await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + } + // Send Request + if (_shouldTrace) + { + ServiceClientTracing.SendRequest(_invocationId, _httpRequest); + } + cancellationToken.ThrowIfCancellationRequested(); + _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + if (_shouldTrace) + { + ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse); + } + HttpStatusCode _statusCode = _httpResponse.StatusCode; + cancellationToken.ThrowIfCancellationRequested(); + string _responseContent = null; + if ((int)_statusCode != 200) + { + var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode)); + try + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + CloudError _errorBody = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + if (_errorBody != null) + { + ex = new CloudException(_errorBody.Message); + ex.Body = _errorBody; + } + } + catch (JsonException) + { + // Ignore the exception + } + ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent); + ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent); + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + if (_shouldTrace) + { + ServiceClientTracing.Error(_invocationId, ex); + } + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw ex; + } + // Create Result + var _result = new AzureOperationResponse(); + _result.Request = _httpRequest; + _result.Response = _httpResponse; + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + // Deserialize Response + if ((int)_statusCode == 200) + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + try + { + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + } + catch (JsonException ex) + { + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw new SerializationException("Unable to deserialize the response.", _responseContent, ex); + } + } + if (_shouldTrace) + { + ServiceClientTracing.Exit(_invocationId, _result); + } + return _result; + } + + /// + /// Creates a custom assessment automation + /// + /// + /// Creates or updates a custom assessment automation for the provided + /// subscription. Please note that providing an existing custom assessment + /// automation will replace the existing record. + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// Name of the Custom Assessment Automation. + /// + /// + /// Custom Assessment Automation body + /// + /// + /// Headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// A response object containing the response body and response headers. + /// + public async Task> CreateWithHttpMessagesAsync(string resourceGroupName, string customAssessmentAutomationName, CustomAssessmentAutomationRequest customAssessmentAutomationBody, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + { + if (Client.SubscriptionId == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId"); + } + if (Client.SubscriptionId != null) + { + if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$")) + { + throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); + } + } + if (resourceGroupName == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "resourceGroupName"); + } + if (resourceGroupName != null) + { + if (resourceGroupName.Length > 90) + { + throw new ValidationException(ValidationRules.MaxLength, "resourceGroupName", 90); + } + if (resourceGroupName.Length < 1) + { + throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1); + } + if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$")) + { + throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$"); + } + } + if (customAssessmentAutomationName == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "customAssessmentAutomationName"); + } + if (customAssessmentAutomationBody == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "customAssessmentAutomationBody"); + } + string apiVersion = "2021-07-01-preview"; + // Tracing + bool _shouldTrace = ServiceClientTracing.IsEnabled; + string _invocationId = null; + if (_shouldTrace) + { + _invocationId = ServiceClientTracing.NextInvocationId.ToString(); + Dictionary tracingParameters = new Dictionary(); + tracingParameters.Add("apiVersion", apiVersion); + tracingParameters.Add("resourceGroupName", resourceGroupName); + tracingParameters.Add("customAssessmentAutomationName", customAssessmentAutomationName); + tracingParameters.Add("customAssessmentAutomationBody", customAssessmentAutomationBody); + tracingParameters.Add("cancellationToken", cancellationToken); + ServiceClientTracing.Enter(_invocationId, this, "Create", tracingParameters); + } + // Construct URL + var _baseUrl = Client.BaseUri.AbsoluteUri; + var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.Security/customAssessmentAutomations/{customAssessmentAutomationName}").ToString(); + _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); + _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName)); + _url = _url.Replace("{customAssessmentAutomationName}", System.Uri.EscapeDataString(customAssessmentAutomationName)); + List _queryParameters = new List(); + if (apiVersion != null) + { + _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(apiVersion))); + } + if (_queryParameters.Count > 0) + { + _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters); + } + // Create HTTP transport objects + var _httpRequest = new HttpRequestMessage(); + HttpResponseMessage _httpResponse = null; + _httpRequest.Method = new HttpMethod("PUT"); + _httpRequest.RequestUri = new System.Uri(_url); + // Set Headers + if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value) + { + _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString()); + } + if (Client.AcceptLanguage != null) + { + if (_httpRequest.Headers.Contains("accept-language")) + { + _httpRequest.Headers.Remove("accept-language"); + } + _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage); + } + + + if (customHeaders != null) + { + foreach(var _header in customHeaders) + { + if (_httpRequest.Headers.Contains(_header.Key)) + { + _httpRequest.Headers.Remove(_header.Key); + } + _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value); + } + } + + // Serialize Request + string _requestContent = null; + if(customAssessmentAutomationBody != null) + { + _requestContent = Rest.Serialization.SafeJsonConvert.SerializeObject(customAssessmentAutomationBody, Client.SerializationSettings); + _httpRequest.Content = new StringContent(_requestContent, System.Text.Encoding.UTF8); + _httpRequest.Content.Headers.ContentType =System.Net.Http.Headers.MediaTypeHeaderValue.Parse("application/json; charset=utf-8"); + } + // Set Credentials + if (Client.Credentials != null) + { + cancellationToken.ThrowIfCancellationRequested(); + await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + } + // Send Request + if (_shouldTrace) + { + ServiceClientTracing.SendRequest(_invocationId, _httpRequest); + } + cancellationToken.ThrowIfCancellationRequested(); + _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + if (_shouldTrace) + { + ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse); + } + HttpStatusCode _statusCode = _httpResponse.StatusCode; + cancellationToken.ThrowIfCancellationRequested(); + string _responseContent = null; + if ((int)_statusCode != 200 && (int)_statusCode != 201) + { + var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode)); + try + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + CloudError _errorBody = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + if (_errorBody != null) + { + ex = new CloudException(_errorBody.Message); + ex.Body = _errorBody; + } + } + catch (JsonException) + { + // Ignore the exception + } + ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent); + ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent); + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + if (_shouldTrace) + { + ServiceClientTracing.Error(_invocationId, ex); + } + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw ex; + } + // Create Result + var _result = new AzureOperationResponse(); + _result.Request = _httpRequest; + _result.Response = _httpResponse; + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + // Deserialize Response + if ((int)_statusCode == 200) + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + try + { + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + } + catch (JsonException ex) + { + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw new SerializationException("Unable to deserialize the response.", _responseContent, ex); + } + } + // Deserialize Response + if ((int)_statusCode == 201) + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + try + { + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + } + catch (JsonException ex) + { + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw new SerializationException("Unable to deserialize the response.", _responseContent, ex); + } + } + if (_shouldTrace) + { + ServiceClientTracing.Exit(_invocationId, _result); + } + return _result; + } + + /// + /// Deletes a custom assessment automation + /// + /// + /// Deletes a custom assessment automation by name for a provided subscription + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// Name of the Custom Assessment Automation. + /// + /// + /// Headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// A response object containing the response body and response headers. + /// + public async Task DeleteWithHttpMessagesAsync(string resourceGroupName, string customAssessmentAutomationName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + { + if (Client.SubscriptionId == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId"); + } + if (Client.SubscriptionId != null) + { + if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$")) + { + throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); + } + } + if (resourceGroupName == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "resourceGroupName"); + } + if (resourceGroupName != null) + { + if (resourceGroupName.Length > 90) + { + throw new ValidationException(ValidationRules.MaxLength, "resourceGroupName", 90); + } + if (resourceGroupName.Length < 1) + { + throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1); + } + if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$")) + { + throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$"); + } + } + if (customAssessmentAutomationName == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "customAssessmentAutomationName"); + } + string apiVersion = "2021-07-01-preview"; + // Tracing + bool _shouldTrace = ServiceClientTracing.IsEnabled; + string _invocationId = null; + if (_shouldTrace) + { + _invocationId = ServiceClientTracing.NextInvocationId.ToString(); + Dictionary tracingParameters = new Dictionary(); + tracingParameters.Add("apiVersion", apiVersion); + tracingParameters.Add("resourceGroupName", resourceGroupName); + tracingParameters.Add("customAssessmentAutomationName", customAssessmentAutomationName); + tracingParameters.Add("cancellationToken", cancellationToken); + ServiceClientTracing.Enter(_invocationId, this, "Delete", tracingParameters); + } + // Construct URL + var _baseUrl = Client.BaseUri.AbsoluteUri; + var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.Security/customAssessmentAutomations/{customAssessmentAutomationName}").ToString(); + _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); + _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName)); + _url = _url.Replace("{customAssessmentAutomationName}", System.Uri.EscapeDataString(customAssessmentAutomationName)); + List _queryParameters = new List(); + if (apiVersion != null) + { + _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(apiVersion))); + } + if (_queryParameters.Count > 0) + { + _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters); + } + // Create HTTP transport objects + var _httpRequest = new HttpRequestMessage(); + HttpResponseMessage _httpResponse = null; + _httpRequest.Method = new HttpMethod("DELETE"); + _httpRequest.RequestUri = new System.Uri(_url); + // Set Headers + if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value) + { + _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString()); + } + if (Client.AcceptLanguage != null) + { + if (_httpRequest.Headers.Contains("accept-language")) + { + _httpRequest.Headers.Remove("accept-language"); + } + _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage); + } + + + if (customHeaders != null) + { + foreach(var _header in customHeaders) + { + if (_httpRequest.Headers.Contains(_header.Key)) + { + _httpRequest.Headers.Remove(_header.Key); + } + _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value); + } + } + + // Serialize Request + string _requestContent = null; + // Set Credentials + if (Client.Credentials != null) + { + cancellationToken.ThrowIfCancellationRequested(); + await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + } + // Send Request + if (_shouldTrace) + { + ServiceClientTracing.SendRequest(_invocationId, _httpRequest); + } + cancellationToken.ThrowIfCancellationRequested(); + _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + if (_shouldTrace) + { + ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse); + } + HttpStatusCode _statusCode = _httpResponse.StatusCode; + cancellationToken.ThrowIfCancellationRequested(); + string _responseContent = null; + if ((int)_statusCode != 200 && (int)_statusCode != 204) + { + var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode)); + try + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + CloudError _errorBody = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + if (_errorBody != null) + { + ex = new CloudException(_errorBody.Message); + ex.Body = _errorBody; + } + } + catch (JsonException) + { + // Ignore the exception + } + ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent); + ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent); + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + if (_shouldTrace) + { + ServiceClientTracing.Error(_invocationId, ex); + } + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw ex; + } + // Create Result + var _result = new AzureOperationResponse(); + _result.Request = _httpRequest; + _result.Response = _httpResponse; + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + if (_shouldTrace) + { + ServiceClientTracing.Exit(_invocationId, _result); + } + return _result; + } + + /// + /// List custom assessment automations in a subscription and a resource group + /// + /// + /// List custom assessment automations by provided subscription and resource + /// group + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// Headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// A response object containing the response body and response headers. + /// + public async Task>> ListByResourceGroupWithHttpMessagesAsync(string resourceGroupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + { + if (Client.SubscriptionId == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId"); + } + if (Client.SubscriptionId != null) + { + if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$")) + { + throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); + } + } + if (resourceGroupName == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "resourceGroupName"); + } + if (resourceGroupName != null) + { + if (resourceGroupName.Length > 90) + { + throw new ValidationException(ValidationRules.MaxLength, "resourceGroupName", 90); + } + if (resourceGroupName.Length < 1) + { + throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1); + } + if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$")) + { + throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$"); + } + } + string apiVersion = "2021-07-01-preview"; + // Tracing + bool _shouldTrace = ServiceClientTracing.IsEnabled; + string _invocationId = null; + if (_shouldTrace) + { + _invocationId = ServiceClientTracing.NextInvocationId.ToString(); + Dictionary tracingParameters = new Dictionary(); + tracingParameters.Add("apiVersion", apiVersion); + tracingParameters.Add("resourceGroupName", resourceGroupName); + tracingParameters.Add("cancellationToken", cancellationToken); + ServiceClientTracing.Enter(_invocationId, this, "ListByResourceGroup", tracingParameters); + } + // Construct URL + var _baseUrl = Client.BaseUri.AbsoluteUri; + var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.Security/customAssessmentAutomations").ToString(); + _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); + _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName)); + List _queryParameters = new List(); + if (apiVersion != null) + { + _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(apiVersion))); + } + if (_queryParameters.Count > 0) + { + _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters); + } + // Create HTTP transport objects + var _httpRequest = new HttpRequestMessage(); + HttpResponseMessage _httpResponse = null; + _httpRequest.Method = new HttpMethod("GET"); + _httpRequest.RequestUri = new System.Uri(_url); + // Set Headers + if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value) + { + _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString()); + } + if (Client.AcceptLanguage != null) + { + if (_httpRequest.Headers.Contains("accept-language")) + { + _httpRequest.Headers.Remove("accept-language"); + } + _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage); + } + + + if (customHeaders != null) + { + foreach(var _header in customHeaders) + { + if (_httpRequest.Headers.Contains(_header.Key)) + { + _httpRequest.Headers.Remove(_header.Key); + } + _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value); + } + } + + // Serialize Request + string _requestContent = null; + // Set Credentials + if (Client.Credentials != null) + { + cancellationToken.ThrowIfCancellationRequested(); + await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + } + // Send Request + if (_shouldTrace) + { + ServiceClientTracing.SendRequest(_invocationId, _httpRequest); + } + cancellationToken.ThrowIfCancellationRequested(); + _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + if (_shouldTrace) + { + ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse); + } + HttpStatusCode _statusCode = _httpResponse.StatusCode; + cancellationToken.ThrowIfCancellationRequested(); + string _responseContent = null; + if ((int)_statusCode != 200) + { + var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode)); + try + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + CloudError _errorBody = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + if (_errorBody != null) + { + ex = new CloudException(_errorBody.Message); + ex.Body = _errorBody; + } + } + catch (JsonException) + { + // Ignore the exception + } + ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent); + ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent); + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + if (_shouldTrace) + { + ServiceClientTracing.Error(_invocationId, ex); + } + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw ex; + } + // Create Result + var _result = new AzureOperationResponse>(); + _result.Request = _httpRequest; + _result.Response = _httpResponse; + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + // Deserialize Response + if ((int)_statusCode == 200) + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + try + { + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject>(_responseContent, Client.DeserializationSettings); + } + catch (JsonException ex) + { + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw new SerializationException("Unable to deserialize the response.", _responseContent, ex); + } + } + if (_shouldTrace) + { + ServiceClientTracing.Exit(_invocationId, _result); + } + return _result; + } + + /// + /// List custom assessment automations in a subscription + /// + /// + /// List custom assessment automations by provided subscription + /// + /// + /// Headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// A response object containing the response body and response headers. + /// + public async Task>> ListBySubscriptionWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + { + if (Client.SubscriptionId == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId"); + } + if (Client.SubscriptionId != null) + { + if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$")) + { + throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); + } + } + string apiVersion = "2021-07-01-preview"; + // Tracing + bool _shouldTrace = ServiceClientTracing.IsEnabled; + string _invocationId = null; + if (_shouldTrace) + { + _invocationId = ServiceClientTracing.NextInvocationId.ToString(); + Dictionary tracingParameters = new Dictionary(); + tracingParameters.Add("apiVersion", apiVersion); + tracingParameters.Add("cancellationToken", cancellationToken); + ServiceClientTracing.Enter(_invocationId, this, "ListBySubscription", tracingParameters); + } + // Construct URL + var _baseUrl = Client.BaseUri.AbsoluteUri; + var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/providers/Microsoft.Security/customAssessmentAutomations").ToString(); + _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); + List _queryParameters = new List(); + if (apiVersion != null) + { + _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(apiVersion))); + } + if (_queryParameters.Count > 0) + { + _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters); + } + // Create HTTP transport objects + var _httpRequest = new HttpRequestMessage(); + HttpResponseMessage _httpResponse = null; + _httpRequest.Method = new HttpMethod("GET"); + _httpRequest.RequestUri = new System.Uri(_url); + // Set Headers + if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value) + { + _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString()); + } + if (Client.AcceptLanguage != null) + { + if (_httpRequest.Headers.Contains("accept-language")) + { + _httpRequest.Headers.Remove("accept-language"); + } + _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage); + } + + + if (customHeaders != null) + { + foreach(var _header in customHeaders) + { + if (_httpRequest.Headers.Contains(_header.Key)) + { + _httpRequest.Headers.Remove(_header.Key); + } + _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value); + } + } + + // Serialize Request + string _requestContent = null; + // Set Credentials + if (Client.Credentials != null) + { + cancellationToken.ThrowIfCancellationRequested(); + await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + } + // Send Request + if (_shouldTrace) + { + ServiceClientTracing.SendRequest(_invocationId, _httpRequest); + } + cancellationToken.ThrowIfCancellationRequested(); + _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + if (_shouldTrace) + { + ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse); + } + HttpStatusCode _statusCode = _httpResponse.StatusCode; + cancellationToken.ThrowIfCancellationRequested(); + string _responseContent = null; + if ((int)_statusCode != 200) + { + var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode)); + try + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + CloudError _errorBody = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + if (_errorBody != null) + { + ex = new CloudException(_errorBody.Message); + ex.Body = _errorBody; + } + } + catch (JsonException) + { + // Ignore the exception + } + ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent); + ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent); + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + if (_shouldTrace) + { + ServiceClientTracing.Error(_invocationId, ex); + } + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw ex; + } + // Create Result + var _result = new AzureOperationResponse>(); + _result.Request = _httpRequest; + _result.Response = _httpResponse; + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + // Deserialize Response + if ((int)_statusCode == 200) + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + try + { + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject>(_responseContent, Client.DeserializationSettings); + } + catch (JsonException ex) + { + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw new SerializationException("Unable to deserialize the response.", _responseContent, ex); + } + } + if (_shouldTrace) + { + ServiceClientTracing.Exit(_invocationId, _result); + } + return _result; + } + + /// + /// List custom assessment automations in a subscription and a resource group + /// + /// + /// List custom assessment automations by provided subscription and resource + /// group + /// + /// + /// The NextLink from the previous successful call to List operation. + /// + /// + /// Headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// A response object containing the response body and response headers. + /// + public async Task>> ListByResourceGroupNextWithHttpMessagesAsync(string nextPageLink, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + { + if (nextPageLink == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "nextPageLink"); + } + // Tracing + bool _shouldTrace = ServiceClientTracing.IsEnabled; + string _invocationId = null; + if (_shouldTrace) + { + _invocationId = ServiceClientTracing.NextInvocationId.ToString(); + Dictionary tracingParameters = new Dictionary(); + tracingParameters.Add("nextPageLink", nextPageLink); + tracingParameters.Add("cancellationToken", cancellationToken); + ServiceClientTracing.Enter(_invocationId, this, "ListByResourceGroupNext", tracingParameters); + } + // Construct URL + string _url = "{nextLink}"; + _url = _url.Replace("{nextLink}", nextPageLink); + List _queryParameters = new List(); + if (_queryParameters.Count > 0) + { + _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters); + } + // Create HTTP transport objects + var _httpRequest = new HttpRequestMessage(); + HttpResponseMessage _httpResponse = null; + _httpRequest.Method = new HttpMethod("GET"); + _httpRequest.RequestUri = new System.Uri(_url); + // Set Headers + if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value) + { + _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString()); + } + if (Client.AcceptLanguage != null) + { + if (_httpRequest.Headers.Contains("accept-language")) + { + _httpRequest.Headers.Remove("accept-language"); + } + _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage); + } + + + if (customHeaders != null) + { + foreach(var _header in customHeaders) + { + if (_httpRequest.Headers.Contains(_header.Key)) + { + _httpRequest.Headers.Remove(_header.Key); + } + _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value); + } + } + + // Serialize Request + string _requestContent = null; + // Set Credentials + if (Client.Credentials != null) + { + cancellationToken.ThrowIfCancellationRequested(); + await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + } + // Send Request + if (_shouldTrace) + { + ServiceClientTracing.SendRequest(_invocationId, _httpRequest); + } + cancellationToken.ThrowIfCancellationRequested(); + _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + if (_shouldTrace) + { + ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse); + } + HttpStatusCode _statusCode = _httpResponse.StatusCode; + cancellationToken.ThrowIfCancellationRequested(); + string _responseContent = null; + if ((int)_statusCode != 200) + { + var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode)); + try + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + CloudError _errorBody = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + if (_errorBody != null) + { + ex = new CloudException(_errorBody.Message); + ex.Body = _errorBody; + } + } + catch (JsonException) + { + // Ignore the exception + } + ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent); + ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent); + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + if (_shouldTrace) + { + ServiceClientTracing.Error(_invocationId, ex); + } + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw ex; + } + // Create Result + var _result = new AzureOperationResponse>(); + _result.Request = _httpRequest; + _result.Response = _httpResponse; + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + // Deserialize Response + if ((int)_statusCode == 200) + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + try + { + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject>(_responseContent, Client.DeserializationSettings); + } + catch (JsonException ex) + { + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw new SerializationException("Unable to deserialize the response.", _responseContent, ex); + } + } + if (_shouldTrace) + { + ServiceClientTracing.Exit(_invocationId, _result); + } + return _result; + } + + /// + /// List custom assessment automations in a subscription + /// + /// + /// List custom assessment automations by provided subscription + /// + /// + /// The NextLink from the previous successful call to List operation. + /// + /// + /// Headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// A response object containing the response body and response headers. + /// + public async Task>> ListBySubscriptionNextWithHttpMessagesAsync(string nextPageLink, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + { + if (nextPageLink == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "nextPageLink"); + } + // Tracing + bool _shouldTrace = ServiceClientTracing.IsEnabled; + string _invocationId = null; + if (_shouldTrace) + { + _invocationId = ServiceClientTracing.NextInvocationId.ToString(); + Dictionary tracingParameters = new Dictionary(); + tracingParameters.Add("nextPageLink", nextPageLink); + tracingParameters.Add("cancellationToken", cancellationToken); + ServiceClientTracing.Enter(_invocationId, this, "ListBySubscriptionNext", tracingParameters); + } + // Construct URL + string _url = "{nextLink}"; + _url = _url.Replace("{nextLink}", nextPageLink); + List _queryParameters = new List(); + if (_queryParameters.Count > 0) + { + _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters); + } + // Create HTTP transport objects + var _httpRequest = new HttpRequestMessage(); + HttpResponseMessage _httpResponse = null; + _httpRequest.Method = new HttpMethod("GET"); + _httpRequest.RequestUri = new System.Uri(_url); + // Set Headers + if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value) + { + _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString()); + } + if (Client.AcceptLanguage != null) + { + if (_httpRequest.Headers.Contains("accept-language")) + { + _httpRequest.Headers.Remove("accept-language"); + } + _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage); + } + + + if (customHeaders != null) + { + foreach(var _header in customHeaders) + { + if (_httpRequest.Headers.Contains(_header.Key)) + { + _httpRequest.Headers.Remove(_header.Key); + } + _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value); + } + } + + // Serialize Request + string _requestContent = null; + // Set Credentials + if (Client.Credentials != null) + { + cancellationToken.ThrowIfCancellationRequested(); + await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + } + // Send Request + if (_shouldTrace) + { + ServiceClientTracing.SendRequest(_invocationId, _httpRequest); + } + cancellationToken.ThrowIfCancellationRequested(); + _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + if (_shouldTrace) + { + ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse); + } + HttpStatusCode _statusCode = _httpResponse.StatusCode; + cancellationToken.ThrowIfCancellationRequested(); + string _responseContent = null; + if ((int)_statusCode != 200) + { + var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode)); + try + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + CloudError _errorBody = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + if (_errorBody != null) + { + ex = new CloudException(_errorBody.Message); + ex.Body = _errorBody; + } + } + catch (JsonException) + { + // Ignore the exception + } + ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent); + ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent); + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + if (_shouldTrace) + { + ServiceClientTracing.Error(_invocationId, ex); + } + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw ex; + } + // Create Result + var _result = new AzureOperationResponse>(); + _result.Request = _httpRequest; + _result.Response = _httpResponse; + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + // Deserialize Response + if ((int)_statusCode == 200) + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + try + { + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject>(_responseContent, Client.DeserializationSettings); + } + catch (JsonException ex) + { + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw new SerializationException("Unable to deserialize the response.", _responseContent, ex); + } + } + if (_shouldTrace) + { + ServiceClientTracing.Exit(_invocationId, _result); + } + return _result; + } + + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/CustomAssessmentAutomationsOperationsExtensions.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/CustomAssessmentAutomationsOperationsExtensions.cs new file mode 100644 index 000000000000..4db8866287f7 --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/CustomAssessmentAutomationsOperationsExtensions.cs @@ -0,0 +1,338 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security +{ + using Microsoft.Rest; + using Microsoft.Rest.Azure; + using Models; + using System.Threading; + using System.Threading.Tasks; + + /// + /// Extension methods for CustomAssessmentAutomationsOperations. + /// + public static partial class CustomAssessmentAutomationsOperationsExtensions + { + /// + /// Gets a custom assessment automation + /// + /// + /// Gets a single custom assessment automation by name for the provided + /// subscription and resource group. + /// + /// + /// The operations group for this extension method. + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// Name of the Custom Assessment Automation. + /// + public static CustomAssessmentAutomation Get(this ICustomAssessmentAutomationsOperations operations, string resourceGroupName, string customAssessmentAutomationName) + { + return operations.GetAsync(resourceGroupName, customAssessmentAutomationName).GetAwaiter().GetResult(); + } + + /// + /// Gets a custom assessment automation + /// + /// + /// Gets a single custom assessment automation by name for the provided + /// subscription and resource group. + /// + /// + /// The operations group for this extension method. + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// Name of the Custom Assessment Automation. + /// + /// + /// The cancellation token. + /// + public static async Task GetAsync(this ICustomAssessmentAutomationsOperations operations, string resourceGroupName, string customAssessmentAutomationName, CancellationToken cancellationToken = default(CancellationToken)) + { + using (var _result = await operations.GetWithHttpMessagesAsync(resourceGroupName, customAssessmentAutomationName, null, cancellationToken).ConfigureAwait(false)) + { + return _result.Body; + } + } + + /// + /// Creates a custom assessment automation + /// + /// + /// Creates or updates a custom assessment automation for the provided + /// subscription. Please note that providing an existing custom assessment + /// automation will replace the existing record. + /// + /// + /// The operations group for this extension method. + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// Name of the Custom Assessment Automation. + /// + /// + /// Custom Assessment Automation body + /// + public static CustomAssessmentAutomation Create(this ICustomAssessmentAutomationsOperations operations, string resourceGroupName, string customAssessmentAutomationName, CustomAssessmentAutomationRequest customAssessmentAutomationBody) + { + return operations.CreateAsync(resourceGroupName, customAssessmentAutomationName, customAssessmentAutomationBody).GetAwaiter().GetResult(); + } + + /// + /// Creates a custom assessment automation + /// + /// + /// Creates or updates a custom assessment automation for the provided + /// subscription. Please note that providing an existing custom assessment + /// automation will replace the existing record. + /// + /// + /// The operations group for this extension method. + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// Name of the Custom Assessment Automation. + /// + /// + /// Custom Assessment Automation body + /// + /// + /// The cancellation token. + /// + public static async Task CreateAsync(this ICustomAssessmentAutomationsOperations operations, string resourceGroupName, string customAssessmentAutomationName, CustomAssessmentAutomationRequest customAssessmentAutomationBody, CancellationToken cancellationToken = default(CancellationToken)) + { + using (var _result = await operations.CreateWithHttpMessagesAsync(resourceGroupName, customAssessmentAutomationName, customAssessmentAutomationBody, null, cancellationToken).ConfigureAwait(false)) + { + return _result.Body; + } + } + + /// + /// Deletes a custom assessment automation + /// + /// + /// Deletes a custom assessment automation by name for a provided subscription + /// + /// + /// The operations group for this extension method. + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// Name of the Custom Assessment Automation. + /// + public static void Delete(this ICustomAssessmentAutomationsOperations operations, string resourceGroupName, string customAssessmentAutomationName) + { + operations.DeleteAsync(resourceGroupName, customAssessmentAutomationName).GetAwaiter().GetResult(); + } + + /// + /// Deletes a custom assessment automation + /// + /// + /// Deletes a custom assessment automation by name for a provided subscription + /// + /// + /// The operations group for this extension method. + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// Name of the Custom Assessment Automation. + /// + /// + /// The cancellation token. + /// + public static async Task DeleteAsync(this ICustomAssessmentAutomationsOperations operations, string resourceGroupName, string customAssessmentAutomationName, CancellationToken cancellationToken = default(CancellationToken)) + { + (await operations.DeleteWithHttpMessagesAsync(resourceGroupName, customAssessmentAutomationName, null, cancellationToken).ConfigureAwait(false)).Dispose(); + } + + /// + /// List custom assessment automations in a subscription and a resource group + /// + /// + /// List custom assessment automations by provided subscription and resource + /// group + /// + /// + /// The operations group for this extension method. + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + public static IPage ListByResourceGroup(this ICustomAssessmentAutomationsOperations operations, string resourceGroupName) + { + return operations.ListByResourceGroupAsync(resourceGroupName).GetAwaiter().GetResult(); + } + + /// + /// List custom assessment automations in a subscription and a resource group + /// + /// + /// List custom assessment automations by provided subscription and resource + /// group + /// + /// + /// The operations group for this extension method. + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// The cancellation token. + /// + public static async Task> ListByResourceGroupAsync(this ICustomAssessmentAutomationsOperations operations, string resourceGroupName, CancellationToken cancellationToken = default(CancellationToken)) + { + using (var _result = await operations.ListByResourceGroupWithHttpMessagesAsync(resourceGroupName, null, cancellationToken).ConfigureAwait(false)) + { + return _result.Body; + } + } + + /// + /// List custom assessment automations in a subscription + /// + /// + /// List custom assessment automations by provided subscription + /// + /// + /// The operations group for this extension method. + /// + public static IPage ListBySubscription(this ICustomAssessmentAutomationsOperations operations) + { + return operations.ListBySubscriptionAsync().GetAwaiter().GetResult(); + } + + /// + /// List custom assessment automations in a subscription + /// + /// + /// List custom assessment automations by provided subscription + /// + /// + /// The operations group for this extension method. + /// + /// + /// The cancellation token. + /// + public static async Task> ListBySubscriptionAsync(this ICustomAssessmentAutomationsOperations operations, CancellationToken cancellationToken = default(CancellationToken)) + { + using (var _result = await operations.ListBySubscriptionWithHttpMessagesAsync(null, cancellationToken).ConfigureAwait(false)) + { + return _result.Body; + } + } + + /// + /// List custom assessment automations in a subscription and a resource group + /// + /// + /// List custom assessment automations by provided subscription and resource + /// group + /// + /// + /// The operations group for this extension method. + /// + /// + /// The NextLink from the previous successful call to List operation. + /// + public static IPage ListByResourceGroupNext(this ICustomAssessmentAutomationsOperations operations, string nextPageLink) + { + return operations.ListByResourceGroupNextAsync(nextPageLink).GetAwaiter().GetResult(); + } + + /// + /// List custom assessment automations in a subscription and a resource group + /// + /// + /// List custom assessment automations by provided subscription and resource + /// group + /// + /// + /// The operations group for this extension method. + /// + /// + /// The NextLink from the previous successful call to List operation. + /// + /// + /// The cancellation token. + /// + public static async Task> ListByResourceGroupNextAsync(this ICustomAssessmentAutomationsOperations operations, string nextPageLink, CancellationToken cancellationToken = default(CancellationToken)) + { + using (var _result = await operations.ListByResourceGroupNextWithHttpMessagesAsync(nextPageLink, null, cancellationToken).ConfigureAwait(false)) + { + return _result.Body; + } + } + + /// + /// List custom assessment automations in a subscription + /// + /// + /// List custom assessment automations by provided subscription + /// + /// + /// The operations group for this extension method. + /// + /// + /// The NextLink from the previous successful call to List operation. + /// + public static IPage ListBySubscriptionNext(this ICustomAssessmentAutomationsOperations operations, string nextPageLink) + { + return operations.ListBySubscriptionNextAsync(nextPageLink).GetAwaiter().GetResult(); + } + + /// + /// List custom assessment automations in a subscription + /// + /// + /// List custom assessment automations by provided subscription + /// + /// + /// The operations group for this extension method. + /// + /// + /// The NextLink from the previous successful call to List operation. + /// + /// + /// The cancellation token. + /// + public static async Task> ListBySubscriptionNextAsync(this ICustomAssessmentAutomationsOperations operations, string nextPageLink, CancellationToken cancellationToken = default(CancellationToken)) + { + using (var _result = await operations.ListBySubscriptionNextWithHttpMessagesAsync(nextPageLink, null, cancellationToken).ConfigureAwait(false)) + { + return _result.Body; + } + } + + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/CustomEntityStoreAssignmentsOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/CustomEntityStoreAssignmentsOperations.cs new file mode 100644 index 000000000000..0ce546b4ce83 --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/CustomEntityStoreAssignmentsOperations.cs @@ -0,0 +1,1481 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security +{ + using Microsoft.Rest; + using Microsoft.Rest.Azure; + using Models; + using Newtonsoft.Json; + using System.Collections; + using System.Collections.Generic; + using System.Linq; + using System.Net; + using System.Net.Http; + using System.Threading; + using System.Threading.Tasks; + + /// + /// CustomEntityStoreAssignmentsOperations operations. + /// + internal partial class CustomEntityStoreAssignmentsOperations : IServiceOperations, ICustomEntityStoreAssignmentsOperations + { + /// + /// Initializes a new instance of the CustomEntityStoreAssignmentsOperations class. + /// + /// + /// Reference to the service client. + /// + /// + /// Thrown when a required parameter is null + /// + internal CustomEntityStoreAssignmentsOperations(SecurityCenterClient client) + { + if (client == null) + { + throw new System.ArgumentNullException("client"); + } + Client = client; + } + + /// + /// Gets a reference to the SecurityCenterClient + /// + public SecurityCenterClient Client { get; private set; } + + /// + /// Gets a custom entity store assignment + /// + /// + /// Gets a single custom entity store assignment by name for the provided + /// subscription and resource group. + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// Name of the custom entity store assignment. Generated name is GUID. + /// + /// + /// Headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// A response object containing the response body and response headers. + /// + public async Task> GetWithHttpMessagesAsync(string resourceGroupName, string customEntityStoreAssignmentName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + { + if (Client.SubscriptionId == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId"); + } + if (Client.SubscriptionId != null) + { + if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$")) + { + throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); + } + } + if (resourceGroupName == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "resourceGroupName"); + } + if (resourceGroupName != null) + { + if (resourceGroupName.Length > 90) + { + throw new ValidationException(ValidationRules.MaxLength, "resourceGroupName", 90); + } + if (resourceGroupName.Length < 1) + { + throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1); + } + if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$")) + { + throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$"); + } + } + if (customEntityStoreAssignmentName == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "customEntityStoreAssignmentName"); + } + string apiVersion = "2021-07-01-preview"; + // Tracing + bool _shouldTrace = ServiceClientTracing.IsEnabled; + string _invocationId = null; + if (_shouldTrace) + { + _invocationId = ServiceClientTracing.NextInvocationId.ToString(); + Dictionary tracingParameters = new Dictionary(); + tracingParameters.Add("apiVersion", apiVersion); + tracingParameters.Add("resourceGroupName", resourceGroupName); + tracingParameters.Add("customEntityStoreAssignmentName", customEntityStoreAssignmentName); + tracingParameters.Add("cancellationToken", cancellationToken); + ServiceClientTracing.Enter(_invocationId, this, "Get", tracingParameters); + } + // Construct URL + var _baseUrl = Client.BaseUri.AbsoluteUri; + var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.Security/customEntityStoreAssignments/{customEntityStoreAssignmentName}").ToString(); + _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); + _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName)); + _url = _url.Replace("{customEntityStoreAssignmentName}", System.Uri.EscapeDataString(customEntityStoreAssignmentName)); + List _queryParameters = new List(); + if (apiVersion != null) + { + _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(apiVersion))); + } + if (_queryParameters.Count > 0) + { + _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters); + } + // Create HTTP transport objects + var _httpRequest = new HttpRequestMessage(); + HttpResponseMessage _httpResponse = null; + _httpRequest.Method = new HttpMethod("GET"); + _httpRequest.RequestUri = new System.Uri(_url); + // Set Headers + if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value) + { + _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString()); + } + if (Client.AcceptLanguage != null) + { + if (_httpRequest.Headers.Contains("accept-language")) + { + _httpRequest.Headers.Remove("accept-language"); + } + _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage); + } + + + if (customHeaders != null) + { + foreach(var _header in customHeaders) + { + if (_httpRequest.Headers.Contains(_header.Key)) + { + _httpRequest.Headers.Remove(_header.Key); + } + _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value); + } + } + + // Serialize Request + string _requestContent = null; + // Set Credentials + if (Client.Credentials != null) + { + cancellationToken.ThrowIfCancellationRequested(); + await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + } + // Send Request + if (_shouldTrace) + { + ServiceClientTracing.SendRequest(_invocationId, _httpRequest); + } + cancellationToken.ThrowIfCancellationRequested(); + _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + if (_shouldTrace) + { + ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse); + } + HttpStatusCode _statusCode = _httpResponse.StatusCode; + cancellationToken.ThrowIfCancellationRequested(); + string _responseContent = null; + if ((int)_statusCode != 200) + { + var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode)); + try + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + CloudError _errorBody = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + if (_errorBody != null) + { + ex = new CloudException(_errorBody.Message); + ex.Body = _errorBody; + } + } + catch (JsonException) + { + // Ignore the exception + } + ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent); + ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent); + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + if (_shouldTrace) + { + ServiceClientTracing.Error(_invocationId, ex); + } + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw ex; + } + // Create Result + var _result = new AzureOperationResponse(); + _result.Request = _httpRequest; + _result.Response = _httpResponse; + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + // Deserialize Response + if ((int)_statusCode == 200) + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + try + { + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + } + catch (JsonException ex) + { + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw new SerializationException("Unable to deserialize the response.", _responseContent, ex); + } + } + if (_shouldTrace) + { + ServiceClientTracing.Exit(_invocationId, _result); + } + return _result; + } + + /// + /// Creates a custom entity store assignment + /// + /// + /// Creates a custom entity store assignment for the provided subscription, if + /// not already exists. + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// Name of the custom entity store assignment. Generated name is GUID. + /// + /// + /// The principal assigned with entity store. If not provided, will use caller + /// principal. Format of principal is: [AAD + /// type]=[PrincipalObjectId];[TenantId] + /// + /// + /// Headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// A response object containing the response body and response headers. + /// + public async Task> CreateWithHttpMessagesAsync(string resourceGroupName, string customEntityStoreAssignmentName, string principal = default(string), Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + { + if (Client.SubscriptionId == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId"); + } + if (Client.SubscriptionId != null) + { + if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$")) + { + throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); + } + } + if (resourceGroupName == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "resourceGroupName"); + } + if (resourceGroupName != null) + { + if (resourceGroupName.Length > 90) + { + throw new ValidationException(ValidationRules.MaxLength, "resourceGroupName", 90); + } + if (resourceGroupName.Length < 1) + { + throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1); + } + if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$")) + { + throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$"); + } + } + if (customEntityStoreAssignmentName == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "customEntityStoreAssignmentName"); + } + string apiVersion = "2021-07-01-preview"; + CustomEntityStoreAssignmentRequest customEntityStoreAssignmentRequestBody = new CustomEntityStoreAssignmentRequest(); + if (principal != null) + { + customEntityStoreAssignmentRequestBody.Principal = principal; + } + // Tracing + bool _shouldTrace = ServiceClientTracing.IsEnabled; + string _invocationId = null; + if (_shouldTrace) + { + _invocationId = ServiceClientTracing.NextInvocationId.ToString(); + Dictionary tracingParameters = new Dictionary(); + tracingParameters.Add("apiVersion", apiVersion); + tracingParameters.Add("resourceGroupName", resourceGroupName); + tracingParameters.Add("customEntityStoreAssignmentName", customEntityStoreAssignmentName); + tracingParameters.Add("customEntityStoreAssignmentRequestBody", customEntityStoreAssignmentRequestBody); + tracingParameters.Add("cancellationToken", cancellationToken); + ServiceClientTracing.Enter(_invocationId, this, "Create", tracingParameters); + } + // Construct URL + var _baseUrl = Client.BaseUri.AbsoluteUri; + var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.Security/customEntityStoreAssignments/{customEntityStoreAssignmentName}").ToString(); + _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); + _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName)); + _url = _url.Replace("{customEntityStoreAssignmentName}", System.Uri.EscapeDataString(customEntityStoreAssignmentName)); + List _queryParameters = new List(); + if (apiVersion != null) + { + _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(apiVersion))); + } + if (_queryParameters.Count > 0) + { + _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters); + } + // Create HTTP transport objects + var _httpRequest = new HttpRequestMessage(); + HttpResponseMessage _httpResponse = null; + _httpRequest.Method = new HttpMethod("PUT"); + _httpRequest.RequestUri = new System.Uri(_url); + // Set Headers + if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value) + { + _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString()); + } + if (Client.AcceptLanguage != null) + { + if (_httpRequest.Headers.Contains("accept-language")) + { + _httpRequest.Headers.Remove("accept-language"); + } + _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage); + } + + + if (customHeaders != null) + { + foreach(var _header in customHeaders) + { + if (_httpRequest.Headers.Contains(_header.Key)) + { + _httpRequest.Headers.Remove(_header.Key); + } + _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value); + } + } + + // Serialize Request + string _requestContent = null; + if(customEntityStoreAssignmentRequestBody != null) + { + _requestContent = Rest.Serialization.SafeJsonConvert.SerializeObject(customEntityStoreAssignmentRequestBody, Client.SerializationSettings); + _httpRequest.Content = new StringContent(_requestContent, System.Text.Encoding.UTF8); + _httpRequest.Content.Headers.ContentType =System.Net.Http.Headers.MediaTypeHeaderValue.Parse("application/json; charset=utf-8"); + } + // Set Credentials + if (Client.Credentials != null) + { + cancellationToken.ThrowIfCancellationRequested(); + await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + } + // Send Request + if (_shouldTrace) + { + ServiceClientTracing.SendRequest(_invocationId, _httpRequest); + } + cancellationToken.ThrowIfCancellationRequested(); + _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + if (_shouldTrace) + { + ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse); + } + HttpStatusCode _statusCode = _httpResponse.StatusCode; + cancellationToken.ThrowIfCancellationRequested(); + string _responseContent = null; + if ((int)_statusCode != 200 && (int)_statusCode != 201) + { + var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode)); + try + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + CloudError _errorBody = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + if (_errorBody != null) + { + ex = new CloudException(_errorBody.Message); + ex.Body = _errorBody; + } + } + catch (JsonException) + { + // Ignore the exception + } + ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent); + ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent); + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + if (_shouldTrace) + { + ServiceClientTracing.Error(_invocationId, ex); + } + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw ex; + } + // Create Result + var _result = new AzureOperationResponse(); + _result.Request = _httpRequest; + _result.Response = _httpResponse; + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + // Deserialize Response + if ((int)_statusCode == 200) + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + try + { + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + } + catch (JsonException ex) + { + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw new SerializationException("Unable to deserialize the response.", _responseContent, ex); + } + } + // Deserialize Response + if ((int)_statusCode == 201) + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + try + { + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + } + catch (JsonException ex) + { + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw new SerializationException("Unable to deserialize the response.", _responseContent, ex); + } + } + if (_shouldTrace) + { + ServiceClientTracing.Exit(_invocationId, _result); + } + return _result; + } + + /// + /// Deleted a custom entity store assignment + /// + /// + /// Delete a custom entity store assignment by name for a provided subscription + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// Name of the custom entity store assignment. Generated name is GUID. + /// + /// + /// Headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// A response object containing the response body and response headers. + /// + public async Task DeleteWithHttpMessagesAsync(string resourceGroupName, string customEntityStoreAssignmentName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + { + if (Client.SubscriptionId == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId"); + } + if (Client.SubscriptionId != null) + { + if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$")) + { + throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); + } + } + if (resourceGroupName == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "resourceGroupName"); + } + if (resourceGroupName != null) + { + if (resourceGroupName.Length > 90) + { + throw new ValidationException(ValidationRules.MaxLength, "resourceGroupName", 90); + } + if (resourceGroupName.Length < 1) + { + throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1); + } + if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$")) + { + throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$"); + } + } + if (customEntityStoreAssignmentName == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "customEntityStoreAssignmentName"); + } + string apiVersion = "2021-07-01-preview"; + // Tracing + bool _shouldTrace = ServiceClientTracing.IsEnabled; + string _invocationId = null; + if (_shouldTrace) + { + _invocationId = ServiceClientTracing.NextInvocationId.ToString(); + Dictionary tracingParameters = new Dictionary(); + tracingParameters.Add("apiVersion", apiVersion); + tracingParameters.Add("resourceGroupName", resourceGroupName); + tracingParameters.Add("customEntityStoreAssignmentName", customEntityStoreAssignmentName); + tracingParameters.Add("cancellationToken", cancellationToken); + ServiceClientTracing.Enter(_invocationId, this, "Delete", tracingParameters); + } + // Construct URL + var _baseUrl = Client.BaseUri.AbsoluteUri; + var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.Security/customEntityStoreAssignments/{customEntityStoreAssignmentName}").ToString(); + _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); + _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName)); + _url = _url.Replace("{customEntityStoreAssignmentName}", System.Uri.EscapeDataString(customEntityStoreAssignmentName)); + List _queryParameters = new List(); + if (apiVersion != null) + { + _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(apiVersion))); + } + if (_queryParameters.Count > 0) + { + _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters); + } + // Create HTTP transport objects + var _httpRequest = new HttpRequestMessage(); + HttpResponseMessage _httpResponse = null; + _httpRequest.Method = new HttpMethod("DELETE"); + _httpRequest.RequestUri = new System.Uri(_url); + // Set Headers + if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value) + { + _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString()); + } + if (Client.AcceptLanguage != null) + { + if (_httpRequest.Headers.Contains("accept-language")) + { + _httpRequest.Headers.Remove("accept-language"); + } + _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage); + } + + + if (customHeaders != null) + { + foreach(var _header in customHeaders) + { + if (_httpRequest.Headers.Contains(_header.Key)) + { + _httpRequest.Headers.Remove(_header.Key); + } + _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value); + } + } + + // Serialize Request + string _requestContent = null; + // Set Credentials + if (Client.Credentials != null) + { + cancellationToken.ThrowIfCancellationRequested(); + await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + } + // Send Request + if (_shouldTrace) + { + ServiceClientTracing.SendRequest(_invocationId, _httpRequest); + } + cancellationToken.ThrowIfCancellationRequested(); + _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + if (_shouldTrace) + { + ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse); + } + HttpStatusCode _statusCode = _httpResponse.StatusCode; + cancellationToken.ThrowIfCancellationRequested(); + string _responseContent = null; + if ((int)_statusCode != 200 && (int)_statusCode != 204) + { + var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode)); + try + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + CloudError _errorBody = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + if (_errorBody != null) + { + ex = new CloudException(_errorBody.Message); + ex.Body = _errorBody; + } + } + catch (JsonException) + { + // Ignore the exception + } + ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent); + ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent); + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + if (_shouldTrace) + { + ServiceClientTracing.Error(_invocationId, ex); + } + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw ex; + } + // Create Result + var _result = new AzureOperationResponse(); + _result.Request = _httpRequest; + _result.Response = _httpResponse; + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + if (_shouldTrace) + { + ServiceClientTracing.Exit(_invocationId, _result); + } + return _result; + } + + /// + /// List custom entity store assignments in a subscription and a resource group + /// + /// + /// List custom entity store assignments by a provided subscription and + /// resource group + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// Headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// A response object containing the response body and response headers. + /// + public async Task>> ListByResourceGroupWithHttpMessagesAsync(string resourceGroupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + { + if (Client.SubscriptionId == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId"); + } + if (Client.SubscriptionId != null) + { + if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$")) + { + throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); + } + } + if (resourceGroupName == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "resourceGroupName"); + } + if (resourceGroupName != null) + { + if (resourceGroupName.Length > 90) + { + throw new ValidationException(ValidationRules.MaxLength, "resourceGroupName", 90); + } + if (resourceGroupName.Length < 1) + { + throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1); + } + if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$")) + { + throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$"); + } + } + string apiVersion = "2021-07-01-preview"; + // Tracing + bool _shouldTrace = ServiceClientTracing.IsEnabled; + string _invocationId = null; + if (_shouldTrace) + { + _invocationId = ServiceClientTracing.NextInvocationId.ToString(); + Dictionary tracingParameters = new Dictionary(); + tracingParameters.Add("apiVersion", apiVersion); + tracingParameters.Add("resourceGroupName", resourceGroupName); + tracingParameters.Add("cancellationToken", cancellationToken); + ServiceClientTracing.Enter(_invocationId, this, "ListByResourceGroup", tracingParameters); + } + // Construct URL + var _baseUrl = Client.BaseUri.AbsoluteUri; + var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.Security/customEntityStoreAssignments").ToString(); + _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); + _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName)); + List _queryParameters = new List(); + if (apiVersion != null) + { + _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(apiVersion))); + } + if (_queryParameters.Count > 0) + { + _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters); + } + // Create HTTP transport objects + var _httpRequest = new HttpRequestMessage(); + HttpResponseMessage _httpResponse = null; + _httpRequest.Method = new HttpMethod("GET"); + _httpRequest.RequestUri = new System.Uri(_url); + // Set Headers + if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value) + { + _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString()); + } + if (Client.AcceptLanguage != null) + { + if (_httpRequest.Headers.Contains("accept-language")) + { + _httpRequest.Headers.Remove("accept-language"); + } + _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage); + } + + + if (customHeaders != null) + { + foreach(var _header in customHeaders) + { + if (_httpRequest.Headers.Contains(_header.Key)) + { + _httpRequest.Headers.Remove(_header.Key); + } + _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value); + } + } + + // Serialize Request + string _requestContent = null; + // Set Credentials + if (Client.Credentials != null) + { + cancellationToken.ThrowIfCancellationRequested(); + await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + } + // Send Request + if (_shouldTrace) + { + ServiceClientTracing.SendRequest(_invocationId, _httpRequest); + } + cancellationToken.ThrowIfCancellationRequested(); + _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + if (_shouldTrace) + { + ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse); + } + HttpStatusCode _statusCode = _httpResponse.StatusCode; + cancellationToken.ThrowIfCancellationRequested(); + string _responseContent = null; + if ((int)_statusCode != 200) + { + var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode)); + try + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + CloudError _errorBody = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + if (_errorBody != null) + { + ex = new CloudException(_errorBody.Message); + ex.Body = _errorBody; + } + } + catch (JsonException) + { + // Ignore the exception + } + ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent); + ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent); + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + if (_shouldTrace) + { + ServiceClientTracing.Error(_invocationId, ex); + } + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw ex; + } + // Create Result + var _result = new AzureOperationResponse>(); + _result.Request = _httpRequest; + _result.Response = _httpResponse; + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + // Deserialize Response + if ((int)_statusCode == 200) + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + try + { + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject>(_responseContent, Client.DeserializationSettings); + } + catch (JsonException ex) + { + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw new SerializationException("Unable to deserialize the response.", _responseContent, ex); + } + } + if (_shouldTrace) + { + ServiceClientTracing.Exit(_invocationId, _result); + } + return _result; + } + + /// + /// List custom entity store assignments in a subscription + /// + /// + /// List custom entity store assignments by provided subscription + /// + /// + /// Headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// A response object containing the response body and response headers. + /// + public async Task>> ListBySubscriptionWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + { + if (Client.SubscriptionId == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId"); + } + if (Client.SubscriptionId != null) + { + if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$")) + { + throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); + } + } + string apiVersion = "2021-07-01-preview"; + // Tracing + bool _shouldTrace = ServiceClientTracing.IsEnabled; + string _invocationId = null; + if (_shouldTrace) + { + _invocationId = ServiceClientTracing.NextInvocationId.ToString(); + Dictionary tracingParameters = new Dictionary(); + tracingParameters.Add("apiVersion", apiVersion); + tracingParameters.Add("cancellationToken", cancellationToken); + ServiceClientTracing.Enter(_invocationId, this, "ListBySubscription", tracingParameters); + } + // Construct URL + var _baseUrl = Client.BaseUri.AbsoluteUri; + var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/providers/Microsoft.Security/customEntityStoreAssignments").ToString(); + _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); + List _queryParameters = new List(); + if (apiVersion != null) + { + _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(apiVersion))); + } + if (_queryParameters.Count > 0) + { + _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters); + } + // Create HTTP transport objects + var _httpRequest = new HttpRequestMessage(); + HttpResponseMessage _httpResponse = null; + _httpRequest.Method = new HttpMethod("GET"); + _httpRequest.RequestUri = new System.Uri(_url); + // Set Headers + if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value) + { + _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString()); + } + if (Client.AcceptLanguage != null) + { + if (_httpRequest.Headers.Contains("accept-language")) + { + _httpRequest.Headers.Remove("accept-language"); + } + _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage); + } + + + if (customHeaders != null) + { + foreach(var _header in customHeaders) + { + if (_httpRequest.Headers.Contains(_header.Key)) + { + _httpRequest.Headers.Remove(_header.Key); + } + _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value); + } + } + + // Serialize Request + string _requestContent = null; + // Set Credentials + if (Client.Credentials != null) + { + cancellationToken.ThrowIfCancellationRequested(); + await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + } + // Send Request + if (_shouldTrace) + { + ServiceClientTracing.SendRequest(_invocationId, _httpRequest); + } + cancellationToken.ThrowIfCancellationRequested(); + _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + if (_shouldTrace) + { + ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse); + } + HttpStatusCode _statusCode = _httpResponse.StatusCode; + cancellationToken.ThrowIfCancellationRequested(); + string _responseContent = null; + if ((int)_statusCode != 200) + { + var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode)); + try + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + CloudError _errorBody = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + if (_errorBody != null) + { + ex = new CloudException(_errorBody.Message); + ex.Body = _errorBody; + } + } + catch (JsonException) + { + // Ignore the exception + } + ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent); + ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent); + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + if (_shouldTrace) + { + ServiceClientTracing.Error(_invocationId, ex); + } + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw ex; + } + // Create Result + var _result = new AzureOperationResponse>(); + _result.Request = _httpRequest; + _result.Response = _httpResponse; + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + // Deserialize Response + if ((int)_statusCode == 200) + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + try + { + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject>(_responseContent, Client.DeserializationSettings); + } + catch (JsonException ex) + { + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw new SerializationException("Unable to deserialize the response.", _responseContent, ex); + } + } + if (_shouldTrace) + { + ServiceClientTracing.Exit(_invocationId, _result); + } + return _result; + } + + /// + /// List custom entity store assignments in a subscription and a resource group + /// + /// + /// List custom entity store assignments by a provided subscription and + /// resource group + /// + /// + /// The NextLink from the previous successful call to List operation. + /// + /// + /// Headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// A response object containing the response body and response headers. + /// + public async Task>> ListByResourceGroupNextWithHttpMessagesAsync(string nextPageLink, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + { + if (nextPageLink == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "nextPageLink"); + } + // Tracing + bool _shouldTrace = ServiceClientTracing.IsEnabled; + string _invocationId = null; + if (_shouldTrace) + { + _invocationId = ServiceClientTracing.NextInvocationId.ToString(); + Dictionary tracingParameters = new Dictionary(); + tracingParameters.Add("nextPageLink", nextPageLink); + tracingParameters.Add("cancellationToken", cancellationToken); + ServiceClientTracing.Enter(_invocationId, this, "ListByResourceGroupNext", tracingParameters); + } + // Construct URL + string _url = "{nextLink}"; + _url = _url.Replace("{nextLink}", nextPageLink); + List _queryParameters = new List(); + if (_queryParameters.Count > 0) + { + _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters); + } + // Create HTTP transport objects + var _httpRequest = new HttpRequestMessage(); + HttpResponseMessage _httpResponse = null; + _httpRequest.Method = new HttpMethod("GET"); + _httpRequest.RequestUri = new System.Uri(_url); + // Set Headers + if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value) + { + _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString()); + } + if (Client.AcceptLanguage != null) + { + if (_httpRequest.Headers.Contains("accept-language")) + { + _httpRequest.Headers.Remove("accept-language"); + } + _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage); + } + + + if (customHeaders != null) + { + foreach(var _header in customHeaders) + { + if (_httpRequest.Headers.Contains(_header.Key)) + { + _httpRequest.Headers.Remove(_header.Key); + } + _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value); + } + } + + // Serialize Request + string _requestContent = null; + // Set Credentials + if (Client.Credentials != null) + { + cancellationToken.ThrowIfCancellationRequested(); + await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + } + // Send Request + if (_shouldTrace) + { + ServiceClientTracing.SendRequest(_invocationId, _httpRequest); + } + cancellationToken.ThrowIfCancellationRequested(); + _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + if (_shouldTrace) + { + ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse); + } + HttpStatusCode _statusCode = _httpResponse.StatusCode; + cancellationToken.ThrowIfCancellationRequested(); + string _responseContent = null; + if ((int)_statusCode != 200) + { + var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode)); + try + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + CloudError _errorBody = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + if (_errorBody != null) + { + ex = new CloudException(_errorBody.Message); + ex.Body = _errorBody; + } + } + catch (JsonException) + { + // Ignore the exception + } + ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent); + ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent); + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + if (_shouldTrace) + { + ServiceClientTracing.Error(_invocationId, ex); + } + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw ex; + } + // Create Result + var _result = new AzureOperationResponse>(); + _result.Request = _httpRequest; + _result.Response = _httpResponse; + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + // Deserialize Response + if ((int)_statusCode == 200) + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + try + { + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject>(_responseContent, Client.DeserializationSettings); + } + catch (JsonException ex) + { + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw new SerializationException("Unable to deserialize the response.", _responseContent, ex); + } + } + if (_shouldTrace) + { + ServiceClientTracing.Exit(_invocationId, _result); + } + return _result; + } + + /// + /// List custom entity store assignments in a subscription + /// + /// + /// List custom entity store assignments by provided subscription + /// + /// + /// The NextLink from the previous successful call to List operation. + /// + /// + /// Headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// A response object containing the response body and response headers. + /// + public async Task>> ListBySubscriptionNextWithHttpMessagesAsync(string nextPageLink, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + { + if (nextPageLink == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "nextPageLink"); + } + // Tracing + bool _shouldTrace = ServiceClientTracing.IsEnabled; + string _invocationId = null; + if (_shouldTrace) + { + _invocationId = ServiceClientTracing.NextInvocationId.ToString(); + Dictionary tracingParameters = new Dictionary(); + tracingParameters.Add("nextPageLink", nextPageLink); + tracingParameters.Add("cancellationToken", cancellationToken); + ServiceClientTracing.Enter(_invocationId, this, "ListBySubscriptionNext", tracingParameters); + } + // Construct URL + string _url = "{nextLink}"; + _url = _url.Replace("{nextLink}", nextPageLink); + List _queryParameters = new List(); + if (_queryParameters.Count > 0) + { + _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters); + } + // Create HTTP transport objects + var _httpRequest = new HttpRequestMessage(); + HttpResponseMessage _httpResponse = null; + _httpRequest.Method = new HttpMethod("GET"); + _httpRequest.RequestUri = new System.Uri(_url); + // Set Headers + if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value) + { + _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString()); + } + if (Client.AcceptLanguage != null) + { + if (_httpRequest.Headers.Contains("accept-language")) + { + _httpRequest.Headers.Remove("accept-language"); + } + _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage); + } + + + if (customHeaders != null) + { + foreach(var _header in customHeaders) + { + if (_httpRequest.Headers.Contains(_header.Key)) + { + _httpRequest.Headers.Remove(_header.Key); + } + _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value); + } + } + + // Serialize Request + string _requestContent = null; + // Set Credentials + if (Client.Credentials != null) + { + cancellationToken.ThrowIfCancellationRequested(); + await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + } + // Send Request + if (_shouldTrace) + { + ServiceClientTracing.SendRequest(_invocationId, _httpRequest); + } + cancellationToken.ThrowIfCancellationRequested(); + _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + if (_shouldTrace) + { + ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse); + } + HttpStatusCode _statusCode = _httpResponse.StatusCode; + cancellationToken.ThrowIfCancellationRequested(); + string _responseContent = null; + if ((int)_statusCode != 200) + { + var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode)); + try + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + CloudError _errorBody = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + if (_errorBody != null) + { + ex = new CloudException(_errorBody.Message); + ex.Body = _errorBody; + } + } + catch (JsonException) + { + // Ignore the exception + } + ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent); + ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent); + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + if (_shouldTrace) + { + ServiceClientTracing.Error(_invocationId, ex); + } + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw ex; + } + // Create Result + var _result = new AzureOperationResponse>(); + _result.Request = _httpRequest; + _result.Response = _httpResponse; + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + // Deserialize Response + if ((int)_statusCode == 200) + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + try + { + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject>(_responseContent, Client.DeserializationSettings); + } + catch (JsonException ex) + { + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw new SerializationException("Unable to deserialize the response.", _responseContent, ex); + } + } + if (_shouldTrace) + { + ServiceClientTracing.Exit(_invocationId, _result); + } + return _result; + } + + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/CustomEntityStoreAssignmentsOperationsExtensions.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/CustomEntityStoreAssignmentsOperationsExtensions.cs new file mode 100644 index 000000000000..d5149fa00e0e --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/CustomEntityStoreAssignmentsOperationsExtensions.cs @@ -0,0 +1,340 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security +{ + using Microsoft.Rest; + using Microsoft.Rest.Azure; + using Models; + using System.Threading; + using System.Threading.Tasks; + + /// + /// Extension methods for CustomEntityStoreAssignmentsOperations. + /// + public static partial class CustomEntityStoreAssignmentsOperationsExtensions + { + /// + /// Gets a custom entity store assignment + /// + /// + /// Gets a single custom entity store assignment by name for the provided + /// subscription and resource group. + /// + /// + /// The operations group for this extension method. + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// Name of the custom entity store assignment. Generated name is GUID. + /// + public static CustomEntityStoreAssignment Get(this ICustomEntityStoreAssignmentsOperations operations, string resourceGroupName, string customEntityStoreAssignmentName) + { + return operations.GetAsync(resourceGroupName, customEntityStoreAssignmentName).GetAwaiter().GetResult(); + } + + /// + /// Gets a custom entity store assignment + /// + /// + /// Gets a single custom entity store assignment by name for the provided + /// subscription and resource group. + /// + /// + /// The operations group for this extension method. + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// Name of the custom entity store assignment. Generated name is GUID. + /// + /// + /// The cancellation token. + /// + public static async Task GetAsync(this ICustomEntityStoreAssignmentsOperations operations, string resourceGroupName, string customEntityStoreAssignmentName, CancellationToken cancellationToken = default(CancellationToken)) + { + using (var _result = await operations.GetWithHttpMessagesAsync(resourceGroupName, customEntityStoreAssignmentName, null, cancellationToken).ConfigureAwait(false)) + { + return _result.Body; + } + } + + /// + /// Creates a custom entity store assignment + /// + /// + /// Creates a custom entity store assignment for the provided subscription, if + /// not already exists. + /// + /// + /// The operations group for this extension method. + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// Name of the custom entity store assignment. Generated name is GUID. + /// + /// + /// The principal assigned with entity store. If not provided, will use caller + /// principal. Format of principal is: [AAD + /// type]=[PrincipalObjectId];[TenantId] + /// + public static CustomEntityStoreAssignment Create(this ICustomEntityStoreAssignmentsOperations operations, string resourceGroupName, string customEntityStoreAssignmentName, string principal = default(string)) + { + return operations.CreateAsync(resourceGroupName, customEntityStoreAssignmentName, principal).GetAwaiter().GetResult(); + } + + /// + /// Creates a custom entity store assignment + /// + /// + /// Creates a custom entity store assignment for the provided subscription, if + /// not already exists. + /// + /// + /// The operations group for this extension method. + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// Name of the custom entity store assignment. Generated name is GUID. + /// + /// + /// The principal assigned with entity store. If not provided, will use caller + /// principal. Format of principal is: [AAD + /// type]=[PrincipalObjectId];[TenantId] + /// + /// + /// The cancellation token. + /// + public static async Task CreateAsync(this ICustomEntityStoreAssignmentsOperations operations, string resourceGroupName, string customEntityStoreAssignmentName, string principal = default(string), CancellationToken cancellationToken = default(CancellationToken)) + { + using (var _result = await operations.CreateWithHttpMessagesAsync(resourceGroupName, customEntityStoreAssignmentName, principal, null, cancellationToken).ConfigureAwait(false)) + { + return _result.Body; + } + } + + /// + /// Deleted a custom entity store assignment + /// + /// + /// Delete a custom entity store assignment by name for a provided subscription + /// + /// + /// The operations group for this extension method. + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// Name of the custom entity store assignment. Generated name is GUID. + /// + public static void Delete(this ICustomEntityStoreAssignmentsOperations operations, string resourceGroupName, string customEntityStoreAssignmentName) + { + operations.DeleteAsync(resourceGroupName, customEntityStoreAssignmentName).GetAwaiter().GetResult(); + } + + /// + /// Deleted a custom entity store assignment + /// + /// + /// Delete a custom entity store assignment by name for a provided subscription + /// + /// + /// The operations group for this extension method. + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// Name of the custom entity store assignment. Generated name is GUID. + /// + /// + /// The cancellation token. + /// + public static async Task DeleteAsync(this ICustomEntityStoreAssignmentsOperations operations, string resourceGroupName, string customEntityStoreAssignmentName, CancellationToken cancellationToken = default(CancellationToken)) + { + (await operations.DeleteWithHttpMessagesAsync(resourceGroupName, customEntityStoreAssignmentName, null, cancellationToken).ConfigureAwait(false)).Dispose(); + } + + /// + /// List custom entity store assignments in a subscription and a resource group + /// + /// + /// List custom entity store assignments by a provided subscription and + /// resource group + /// + /// + /// The operations group for this extension method. + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + public static IPage ListByResourceGroup(this ICustomEntityStoreAssignmentsOperations operations, string resourceGroupName) + { + return operations.ListByResourceGroupAsync(resourceGroupName).GetAwaiter().GetResult(); + } + + /// + /// List custom entity store assignments in a subscription and a resource group + /// + /// + /// List custom entity store assignments by a provided subscription and + /// resource group + /// + /// + /// The operations group for this extension method. + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// The cancellation token. + /// + public static async Task> ListByResourceGroupAsync(this ICustomEntityStoreAssignmentsOperations operations, string resourceGroupName, CancellationToken cancellationToken = default(CancellationToken)) + { + using (var _result = await operations.ListByResourceGroupWithHttpMessagesAsync(resourceGroupName, null, cancellationToken).ConfigureAwait(false)) + { + return _result.Body; + } + } + + /// + /// List custom entity store assignments in a subscription + /// + /// + /// List custom entity store assignments by provided subscription + /// + /// + /// The operations group for this extension method. + /// + public static IPage ListBySubscription(this ICustomEntityStoreAssignmentsOperations operations) + { + return operations.ListBySubscriptionAsync().GetAwaiter().GetResult(); + } + + /// + /// List custom entity store assignments in a subscription + /// + /// + /// List custom entity store assignments by provided subscription + /// + /// + /// The operations group for this extension method. + /// + /// + /// The cancellation token. + /// + public static async Task> ListBySubscriptionAsync(this ICustomEntityStoreAssignmentsOperations operations, CancellationToken cancellationToken = default(CancellationToken)) + { + using (var _result = await operations.ListBySubscriptionWithHttpMessagesAsync(null, cancellationToken).ConfigureAwait(false)) + { + return _result.Body; + } + } + + /// + /// List custom entity store assignments in a subscription and a resource group + /// + /// + /// List custom entity store assignments by a provided subscription and + /// resource group + /// + /// + /// The operations group for this extension method. + /// + /// + /// The NextLink from the previous successful call to List operation. + /// + public static IPage ListByResourceGroupNext(this ICustomEntityStoreAssignmentsOperations operations, string nextPageLink) + { + return operations.ListByResourceGroupNextAsync(nextPageLink).GetAwaiter().GetResult(); + } + + /// + /// List custom entity store assignments in a subscription and a resource group + /// + /// + /// List custom entity store assignments by a provided subscription and + /// resource group + /// + /// + /// The operations group for this extension method. + /// + /// + /// The NextLink from the previous successful call to List operation. + /// + /// + /// The cancellation token. + /// + public static async Task> ListByResourceGroupNextAsync(this ICustomEntityStoreAssignmentsOperations operations, string nextPageLink, CancellationToken cancellationToken = default(CancellationToken)) + { + using (var _result = await operations.ListByResourceGroupNextWithHttpMessagesAsync(nextPageLink, null, cancellationToken).ConfigureAwait(false)) + { + return _result.Body; + } + } + + /// + /// List custom entity store assignments in a subscription + /// + /// + /// List custom entity store assignments by provided subscription + /// + /// + /// The operations group for this extension method. + /// + /// + /// The NextLink from the previous successful call to List operation. + /// + public static IPage ListBySubscriptionNext(this ICustomEntityStoreAssignmentsOperations operations, string nextPageLink) + { + return operations.ListBySubscriptionNextAsync(nextPageLink).GetAwaiter().GetResult(); + } + + /// + /// List custom entity store assignments in a subscription + /// + /// + /// List custom entity store assignments by provided subscription + /// + /// + /// The operations group for this extension method. + /// + /// + /// The NextLink from the previous successful call to List operation. + /// + /// + /// The cancellation token. + /// + public static async Task> ListBySubscriptionNextAsync(this ICustomEntityStoreAssignmentsOperations operations, string nextPageLink, CancellationToken cancellationToken = default(CancellationToken)) + { + using (var _result = await operations.ListBySubscriptionNextWithHttpMessagesAsync(nextPageLink, null, cancellationToken).ConfigureAwait(false)) + { + return _result.Body; + } + } + + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/DiscoveredSecuritySolutionsOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/DiscoveredSecuritySolutionsOperations.cs index 986b60e872f0..d120ef66b055 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/DiscoveredSecuritySolutionsOperations.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/DiscoveredSecuritySolutionsOperations.cs @@ -237,6 +237,10 @@ internal DiscoveredSecuritySolutionsOperations(SecurityCenterClient client) /// Gets a list of discovered Security Solutions for the subscription and /// location. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Headers that will be added to request. /// @@ -258,7 +262,7 @@ internal DiscoveredSecuritySolutionsOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task>> ListByHomeRegionWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task>> ListByHomeRegionWithHttpMessagesAsync(string ascLocation, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -271,9 +275,9 @@ internal DiscoveredSecuritySolutionsOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } string apiVersion = "2020-01-01"; // Tracing @@ -283,6 +287,7 @@ internal DiscoveredSecuritySolutionsOperations(SecurityCenterClient client) { _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("apiVersion", apiVersion); tracingParameters.Add("cancellationToken", cancellationToken); ServiceClientTracing.Enter(_invocationId, this, "ListByHomeRegion", tracingParameters); @@ -291,7 +296,7 @@ internal DiscoveredSecuritySolutionsOperations(SecurityCenterClient client) var _baseUrl = Client.BaseUri.AbsoluteUri; var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/providers/Microsoft.Security/locations/{ascLocation}/discoveredSecuritySolutions").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); List _queryParameters = new List(); if (apiVersion != null) { @@ -429,6 +434,10 @@ internal DiscoveredSecuritySolutionsOperations(SecurityCenterClient client) /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of a discovered security solution. /// @@ -453,7 +462,7 @@ internal DiscoveredSecuritySolutionsOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task> GetWithHttpMessagesAsync(string resourceGroupName, string discoveredSecuritySolutionName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task> GetWithHttpMessagesAsync(string resourceGroupName, string ascLocation, string discoveredSecuritySolutionName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -485,9 +494,9 @@ internal DiscoveredSecuritySolutionsOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } if (discoveredSecuritySolutionName == null) { @@ -502,6 +511,7 @@ internal DiscoveredSecuritySolutionsOperations(SecurityCenterClient client) _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); tracingParameters.Add("resourceGroupName", resourceGroupName); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("discoveredSecuritySolutionName", discoveredSecuritySolutionName); tracingParameters.Add("apiVersion", apiVersion); tracingParameters.Add("cancellationToken", cancellationToken); @@ -512,7 +522,7 @@ internal DiscoveredSecuritySolutionsOperations(SecurityCenterClient client) var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/locations/{ascLocation}/discoveredSecuritySolutions/{discoveredSecuritySolutionName}").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); _url = _url.Replace("{discoveredSecuritySolutionName}", System.Uri.EscapeDataString(discoveredSecuritySolutionName)); List _queryParameters = new List(); if (apiVersion != null) diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/DiscoveredSecuritySolutionsOperationsExtensions.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/DiscoveredSecuritySolutionsOperationsExtensions.cs index 33eab088f695..76ac6002e113 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/DiscoveredSecuritySolutionsOperationsExtensions.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/DiscoveredSecuritySolutionsOperationsExtensions.cs @@ -56,9 +56,13 @@ public static IPage List(this IDiscoveredSecuritySol /// /// The operations group for this extension method. /// - public static IPage ListByHomeRegion(this IDiscoveredSecuritySolutionsOperations operations) + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// + public static IPage ListByHomeRegion(this IDiscoveredSecuritySolutionsOperations operations, string ascLocation) { - return operations.ListByHomeRegionAsync().GetAwaiter().GetResult(); + return operations.ListByHomeRegionAsync(ascLocation).GetAwaiter().GetResult(); } /// @@ -68,12 +72,16 @@ public static IPage ListByHomeRegion(this IDiscovere /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// The cancellation token. /// - public static async Task> ListByHomeRegionAsync(this IDiscoveredSecuritySolutionsOperations operations, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task> ListByHomeRegionAsync(this IDiscoveredSecuritySolutionsOperations operations, string ascLocation, CancellationToken cancellationToken = default(CancellationToken)) { - using (var _result = await operations.ListByHomeRegionWithHttpMessagesAsync(null, cancellationToken).ConfigureAwait(false)) + using (var _result = await operations.ListByHomeRegionWithHttpMessagesAsync(ascLocation, null, cancellationToken).ConfigureAwait(false)) { return _result.Body; } @@ -89,12 +97,16 @@ public static IPage ListByHomeRegion(this IDiscovere /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of a discovered security solution. /// - public static DiscoveredSecuritySolution Get(this IDiscoveredSecuritySolutionsOperations operations, string resourceGroupName, string discoveredSecuritySolutionName) + public static DiscoveredSecuritySolution Get(this IDiscoveredSecuritySolutionsOperations operations, string resourceGroupName, string ascLocation, string discoveredSecuritySolutionName) { - return operations.GetAsync(resourceGroupName, discoveredSecuritySolutionName).GetAwaiter().GetResult(); + return operations.GetAsync(resourceGroupName, ascLocation, discoveredSecuritySolutionName).GetAwaiter().GetResult(); } /// @@ -107,15 +119,19 @@ public static DiscoveredSecuritySolution Get(this IDiscoveredSecuritySolutionsOp /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of a discovered security solution. /// /// /// The cancellation token. /// - public static async Task GetAsync(this IDiscoveredSecuritySolutionsOperations operations, string resourceGroupName, string discoveredSecuritySolutionName, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task GetAsync(this IDiscoveredSecuritySolutionsOperations operations, string resourceGroupName, string ascLocation, string discoveredSecuritySolutionName, CancellationToken cancellationToken = default(CancellationToken)) { - using (var _result = await operations.GetWithHttpMessagesAsync(resourceGroupName, discoveredSecuritySolutionName, null, cancellationToken).ConfigureAwait(false)) + using (var _result = await operations.GetWithHttpMessagesAsync(resourceGroupName, ascLocation, discoveredSecuritySolutionName, null, cancellationToken).ConfigureAwait(false)) { return _result.Body; } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ExternalSecuritySolutionsOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ExternalSecuritySolutionsOperations.cs index 436163ba715f..6f9acc246c13 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ExternalSecuritySolutionsOperations.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ExternalSecuritySolutionsOperations.cs @@ -237,6 +237,10 @@ internal ExternalSecuritySolutionsOperations(SecurityCenterClient client) /// Gets a list of external Security Solutions for the subscription and /// location. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Headers that will be added to request. /// @@ -258,7 +262,7 @@ internal ExternalSecuritySolutionsOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task>> ListByHomeRegionWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task>> ListByHomeRegionWithHttpMessagesAsync(string ascLocation, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -271,9 +275,9 @@ internal ExternalSecuritySolutionsOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } string apiVersion = "2020-01-01"; // Tracing @@ -283,6 +287,7 @@ internal ExternalSecuritySolutionsOperations(SecurityCenterClient client) { _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("apiVersion", apiVersion); tracingParameters.Add("cancellationToken", cancellationToken); ServiceClientTracing.Enter(_invocationId, this, "ListByHomeRegion", tracingParameters); @@ -291,7 +296,7 @@ internal ExternalSecuritySolutionsOperations(SecurityCenterClient client) var _baseUrl = Client.BaseUri.AbsoluteUri; var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/providers/Microsoft.Security/locations/{ascLocation}/ExternalSecuritySolutions").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); List _queryParameters = new List(); if (apiVersion != null) { @@ -429,6 +434,10 @@ internal ExternalSecuritySolutionsOperations(SecurityCenterClient client) /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of an external security solution. /// @@ -453,7 +462,7 @@ internal ExternalSecuritySolutionsOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task> GetWithHttpMessagesAsync(string resourceGroupName, string externalSecuritySolutionsName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task> GetWithHttpMessagesAsync(string resourceGroupName, string ascLocation, string externalSecuritySolutionsName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -485,9 +494,9 @@ internal ExternalSecuritySolutionsOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } if (externalSecuritySolutionsName == null) { @@ -502,6 +511,7 @@ internal ExternalSecuritySolutionsOperations(SecurityCenterClient client) _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); tracingParameters.Add("resourceGroupName", resourceGroupName); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("externalSecuritySolutionsName", externalSecuritySolutionsName); tracingParameters.Add("apiVersion", apiVersion); tracingParameters.Add("cancellationToken", cancellationToken); @@ -512,7 +522,7 @@ internal ExternalSecuritySolutionsOperations(SecurityCenterClient client) var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/locations/{ascLocation}/ExternalSecuritySolutions/{externalSecuritySolutionsName}").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); _url = _url.Replace("{externalSecuritySolutionsName}", System.Uri.EscapeDataString(externalSecuritySolutionsName)); List _queryParameters = new List(); if (apiVersion != null) diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ExternalSecuritySolutionsOperationsExtensions.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ExternalSecuritySolutionsOperationsExtensions.cs index 49c9f429e7b9..b7fa81ade9e0 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ExternalSecuritySolutionsOperationsExtensions.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ExternalSecuritySolutionsOperationsExtensions.cs @@ -56,9 +56,13 @@ public static IPage List(this IExternalSecuritySolutio /// /// The operations group for this extension method. /// - public static IPage ListByHomeRegion(this IExternalSecuritySolutionsOperations operations) + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// + public static IPage ListByHomeRegion(this IExternalSecuritySolutionsOperations operations, string ascLocation) { - return operations.ListByHomeRegionAsync().GetAwaiter().GetResult(); + return operations.ListByHomeRegionAsync(ascLocation).GetAwaiter().GetResult(); } /// @@ -68,12 +72,16 @@ public static IPage ListByHomeRegion(this IExternalSec /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// The cancellation token. /// - public static async Task> ListByHomeRegionAsync(this IExternalSecuritySolutionsOperations operations, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task> ListByHomeRegionAsync(this IExternalSecuritySolutionsOperations operations, string ascLocation, CancellationToken cancellationToken = default(CancellationToken)) { - using (var _result = await operations.ListByHomeRegionWithHttpMessagesAsync(null, cancellationToken).ConfigureAwait(false)) + using (var _result = await operations.ListByHomeRegionWithHttpMessagesAsync(ascLocation, null, cancellationToken).ConfigureAwait(false)) { return _result.Body; } @@ -89,12 +97,16 @@ public static IPage ListByHomeRegion(this IExternalSec /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of an external security solution. /// - public static ExternalSecuritySolution Get(this IExternalSecuritySolutionsOperations operations, string resourceGroupName, string externalSecuritySolutionsName) + public static ExternalSecuritySolution Get(this IExternalSecuritySolutionsOperations operations, string resourceGroupName, string ascLocation, string externalSecuritySolutionsName) { - return operations.GetAsync(resourceGroupName, externalSecuritySolutionsName).GetAwaiter().GetResult(); + return operations.GetAsync(resourceGroupName, ascLocation, externalSecuritySolutionsName).GetAwaiter().GetResult(); } /// @@ -107,15 +119,19 @@ public static ExternalSecuritySolution Get(this IExternalSecuritySolutionsOperat /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of an external security solution. /// /// /// The cancellation token. /// - public static async Task GetAsync(this IExternalSecuritySolutionsOperations operations, string resourceGroupName, string externalSecuritySolutionsName, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task GetAsync(this IExternalSecuritySolutionsOperations operations, string resourceGroupName, string ascLocation, string externalSecuritySolutionsName, CancellationToken cancellationToken = default(CancellationToken)) { - using (var _result = await operations.GetWithHttpMessagesAsync(resourceGroupName, externalSecuritySolutionsName, null, cancellationToken).ConfigureAwait(false)) + using (var _result = await operations.GetWithHttpMessagesAsync(resourceGroupName, ascLocation, externalSecuritySolutionsName, null, cancellationToken).ConfigureAwait(false)) { return _result.Body; } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IAdaptiveApplicationControlsOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IAdaptiveApplicationControlsOperations.cs index 695e503a7b24..f52571fef922 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IAdaptiveApplicationControlsOperations.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IAdaptiveApplicationControlsOperations.cs @@ -52,6 +52,10 @@ public partial interface IAdaptiveApplicationControlsOperations /// /// Gets an application control VM/server group. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of an application control machine group /// @@ -70,10 +74,14 @@ public partial interface IAdaptiveApplicationControlsOperations /// /// Thrown when a required parameter is null /// - Task> GetWithHttpMessagesAsync(string groupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task> GetWithHttpMessagesAsync(string ascLocation, string groupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Update an application control machine group /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of an application control machine group /// @@ -94,10 +102,14 @@ public partial interface IAdaptiveApplicationControlsOperations /// /// Thrown when a required parameter is null /// - Task> PutWithHttpMessagesAsync(string groupName, AdaptiveApplicationControlGroup body, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task> PutWithHttpMessagesAsync(string ascLocation, string groupName, AdaptiveApplicationControlGroup body, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Delete an application control machine group /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of an application control machine group /// @@ -113,6 +125,6 @@ public partial interface IAdaptiveApplicationControlsOperations /// /// Thrown when a required parameter is null /// - Task DeleteWithHttpMessagesAsync(string groupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task DeleteWithHttpMessagesAsync(string ascLocation, string groupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); } } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IAlertsOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IAlertsOperations.cs index 2e56aeefc2b3..654fda3c04fe 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IAlertsOperations.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IAlertsOperations.cs @@ -69,6 +69,10 @@ public partial interface IAlertsOperations /// List all the alerts that are associated with the subscription that /// are stored in a specific location /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// The headers that will be added to request. /// @@ -84,11 +88,15 @@ public partial interface IAlertsOperations /// /// Thrown when a required parameter is null /// - Task>> ListSubscriptionLevelByRegionWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task>> ListSubscriptionLevelByRegionWithHttpMessagesAsync(string ascLocation, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// List all the alerts that are associated with the resource group /// that are stored in a specific location /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// The name of the resource group within the user's subscription. The /// name is case insensitive. @@ -108,10 +116,14 @@ public partial interface IAlertsOperations /// /// Thrown when a required parameter is null /// - Task>> ListResourceGroupLevelByRegionWithHttpMessagesAsync(string resourceGroupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task>> ListResourceGroupLevelByRegionWithHttpMessagesAsync(string ascLocation, string resourceGroupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Get an alert that is associated with a subscription /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the alert object /// @@ -130,11 +142,15 @@ public partial interface IAlertsOperations /// /// Thrown when a required parameter is null /// - Task> GetSubscriptionLevelWithHttpMessagesAsync(string alertName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task> GetSubscriptionLevelWithHttpMessagesAsync(string ascLocation, string alertName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Get an alert that is associated a resource group or a resource in a /// resource group /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the alert object /// @@ -157,10 +173,14 @@ public partial interface IAlertsOperations /// /// Thrown when a required parameter is null /// - Task> GetResourceGroupLevelWithHttpMessagesAsync(string alertName, string resourceGroupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task> GetResourceGroupLevelWithHttpMessagesAsync(string ascLocation, string alertName, string resourceGroupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Update the alert's state /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the alert object /// @@ -176,10 +196,14 @@ public partial interface IAlertsOperations /// /// Thrown when a required parameter is null /// - Task UpdateSubscriptionLevelStateToDismissWithHttpMessagesAsync(string alertName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task UpdateSubscriptionLevelStateToDismissWithHttpMessagesAsync(string ascLocation, string alertName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Update the alert's state /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the alert object /// @@ -195,10 +219,14 @@ public partial interface IAlertsOperations /// /// Thrown when a required parameter is null /// - Task UpdateSubscriptionLevelStateToResolveWithHttpMessagesAsync(string alertName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task UpdateSubscriptionLevelStateToResolveWithHttpMessagesAsync(string ascLocation, string alertName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Update the alert's state /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the alert object /// @@ -214,10 +242,14 @@ public partial interface IAlertsOperations /// /// Thrown when a required parameter is null /// - Task UpdateSubscriptionLevelStateToActivateWithHttpMessagesAsync(string alertName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task UpdateSubscriptionLevelStateToActivateWithHttpMessagesAsync(string ascLocation, string alertName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Update the alert's state /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the alert object /// @@ -237,10 +269,14 @@ public partial interface IAlertsOperations /// /// Thrown when a required parameter is null /// - Task UpdateResourceGroupLevelStateToResolveWithHttpMessagesAsync(string alertName, string resourceGroupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task UpdateResourceGroupLevelStateToResolveWithHttpMessagesAsync(string ascLocation, string alertName, string resourceGroupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Update the alert's state /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the alert object /// @@ -260,10 +296,14 @@ public partial interface IAlertsOperations /// /// Thrown when a required parameter is null /// - Task UpdateResourceGroupLevelStateToDismissWithHttpMessagesAsync(string alertName, string resourceGroupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task UpdateResourceGroupLevelStateToDismissWithHttpMessagesAsync(string ascLocation, string alertName, string resourceGroupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Update the alert's state /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the alert object /// @@ -283,29 +323,14 @@ public partial interface IAlertsOperations /// /// Thrown when a required parameter is null /// - Task UpdateResourceGroupLevelStateToActivateWithHttpMessagesAsync(string alertName, string resourceGroupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task UpdateResourceGroupLevelStateToActivateWithHttpMessagesAsync(string ascLocation, string alertName, string resourceGroupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Simulate security alerts /// - /// - /// Alert Simulator request body data. + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations /// - /// - /// The headers that will be added to request. - /// - /// - /// The cancellation token. - /// - /// - /// Thrown when the operation returned an invalid status code - /// - /// - /// Thrown when a required parameter is null - /// - Task SimulateWithHttpMessagesAsync(AlertSimulatorRequestProperties properties = default(AlertSimulatorRequestProperties), Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); - /// - /// Simulate security alerts - /// /// /// Alert Simulator request body data. /// @@ -321,7 +346,7 @@ public partial interface IAlertsOperations /// /// Thrown when a required parameter is null /// - Task BeginSimulateWithHttpMessagesAsync(AlertSimulatorRequestProperties properties = default(AlertSimulatorRequestProperties), Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task SimulateWithHttpMessagesAsync(string ascLocation, AlertSimulatorRequestProperties properties = default(AlertSimulatorRequestProperties), Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// List all the alerts that are associated with the subscription /// diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IAllowedConnectionsOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IAllowedConnectionsOperations.cs index 3dbfd8bc6b6f..367f5aae83f4 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IAllowedConnectionsOperations.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IAllowedConnectionsOperations.cs @@ -47,6 +47,10 @@ public partial interface IAllowedConnectionsOperations /// Gets the list of all possible traffic between resources for the /// subscription and location. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// The headers that will be added to request. /// @@ -62,7 +66,7 @@ public partial interface IAllowedConnectionsOperations /// /// Thrown when a required parameter is null /// - Task>> ListByHomeRegionWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task>> ListByHomeRegionWithHttpMessagesAsync(string ascLocation, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Gets the list of all possible traffic between resources for the /// subscription and location, based on connection type. @@ -71,6 +75,10 @@ public partial interface IAllowedConnectionsOperations /// The name of the resource group within the user's subscription. The /// name is case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// The type of allowed connections (Internal, External). Possible /// values include: 'Internal', 'External' @@ -90,7 +98,7 @@ public partial interface IAllowedConnectionsOperations /// /// Thrown when a required parameter is null /// - Task> GetWithHttpMessagesAsync(string resourceGroupName, string connectionType, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task> GetWithHttpMessagesAsync(string resourceGroupName, string ascLocation, string connectionType, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Gets the list of all possible traffic between resources for the /// subscription diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IAssessmentsMetadataOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IAssessmentsMetadataOperations.cs index 36485bc2cfda..71304eab8ddc 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IAssessmentsMetadataOperations.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IAssessmentsMetadataOperations.cs @@ -41,7 +41,7 @@ public partial interface IAssessmentsMetadataOperations /// /// Thrown when a required parameter is null /// - Task>> ListWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task>> ListWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Get metadata information on an assessment type /// @@ -63,7 +63,7 @@ public partial interface IAssessmentsMetadataOperations /// /// Thrown when a required parameter is null /// - Task> GetWithHttpMessagesAsync(string assessmentMetadataName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task> GetWithHttpMessagesAsync(string assessmentMetadataName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Get metadata information on all assessment types in a specific /// subscription @@ -83,7 +83,7 @@ public partial interface IAssessmentsMetadataOperations /// /// Thrown when a required parameter is null /// - Task>> ListBySubscriptionWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task>> ListBySubscriptionWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Get metadata information on an assessment type in a specific /// subscription @@ -106,7 +106,7 @@ public partial interface IAssessmentsMetadataOperations /// /// Thrown when a required parameter is null /// - Task> GetInSubscriptionWithHttpMessagesAsync(string assessmentMetadataName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task> GetInSubscriptionWithHttpMessagesAsync(string assessmentMetadataName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Create metadata information on an assessment type in a specific /// subscription @@ -132,7 +132,7 @@ public partial interface IAssessmentsMetadataOperations /// /// Thrown when a required parameter is null /// - Task> CreateInSubscriptionWithHttpMessagesAsync(string assessmentMetadataName, SecurityAssessmentMetadata assessmentMetadata, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task> CreateInSubscriptionWithHttpMessagesAsync(string assessmentMetadataName, SecurityAssessmentMetadataResponse assessmentMetadata, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Delete metadata information on an assessment type in a specific /// subscription, will cause the deletion of all the assessments of @@ -175,7 +175,7 @@ public partial interface IAssessmentsMetadataOperations /// /// Thrown when a required parameter is null /// - Task>> ListNextWithHttpMessagesAsync(string nextPageLink, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task>> ListNextWithHttpMessagesAsync(string nextPageLink, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Get metadata information on all assessment types in a specific /// subscription @@ -198,6 +198,6 @@ public partial interface IAssessmentsMetadataOperations /// /// Thrown when a required parameter is null /// - Task>> ListBySubscriptionNextWithHttpMessagesAsync(string nextPageLink, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task>> ListBySubscriptionNextWithHttpMessagesAsync(string nextPageLink, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); } } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IAssessmentsOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IAssessmentsOperations.cs index fd75194c9865..bf1a399b1507 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IAssessmentsOperations.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IAssessmentsOperations.cs @@ -47,7 +47,7 @@ public partial interface IAssessmentsOperations /// /// Thrown when a required parameter is null /// - Task>> ListWithHttpMessagesAsync(string scope, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task>> ListWithHttpMessagesAsync(string scope, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Get a security assessment on your scanned resource /// @@ -76,7 +76,7 @@ public partial interface IAssessmentsOperations /// /// Thrown when a required parameter is null /// - Task> GetWithHttpMessagesAsync(string resourceId, string assessmentName, string expand = default(string), Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task> GetWithHttpMessagesAsync(string resourceId, string assessmentName, string expand = default(string), Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Create a security assessment on your resource. An assessment /// metadata that describes this assessment must be predefined with the @@ -106,7 +106,7 @@ public partial interface IAssessmentsOperations /// /// Thrown when a required parameter is null /// - Task> CreateOrUpdateWithHttpMessagesAsync(string resourceId, string assessmentName, SecurityAssessment assessment, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task> CreateOrUpdateWithHttpMessagesAsync(string resourceId, string assessmentName, SecurityAssessment assessment, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Delete a security assessment on your resource. An assessment /// metadata that describes this assessment must be predefined with the @@ -153,6 +153,6 @@ public partial interface IAssessmentsOperations /// /// Thrown when a required parameter is null /// - Task>> ListNextWithHttpMessagesAsync(string nextPageLink, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task>> ListNextWithHttpMessagesAsync(string nextPageLink, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); } } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ICustomAssessmentAutomationsOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ICustomAssessmentAutomationsOperations.cs new file mode 100644 index 000000000000..da6733283a0e --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ICustomAssessmentAutomationsOperations.cs @@ -0,0 +1,220 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security +{ + using Microsoft.Rest; + using Microsoft.Rest.Azure; + using Models; + using System.Collections; + using System.Collections.Generic; + using System.Threading; + using System.Threading.Tasks; + + /// + /// CustomAssessmentAutomationsOperations operations. + /// + public partial interface ICustomAssessmentAutomationsOperations + { + /// + /// Gets a custom assessment automation + /// + /// + /// Gets a single custom assessment automation by name for the provided + /// subscription and resource group. + /// + /// + /// The name of the resource group within the user's subscription. The + /// name is case insensitive. + /// + /// + /// Name of the Custom Assessment Automation. + /// + /// + /// The headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + Task> GetWithHttpMessagesAsync(string resourceGroupName, string customAssessmentAutomationName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + /// + /// Creates a custom assessment automation + /// + /// + /// Creates or updates a custom assessment automation for the provided + /// subscription. Please note that providing an existing custom + /// assessment automation will replace the existing record. + /// + /// + /// The name of the resource group within the user's subscription. The + /// name is case insensitive. + /// + /// + /// Name of the Custom Assessment Automation. + /// + /// + /// Custom Assessment Automation body + /// + /// + /// The headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + Task> CreateWithHttpMessagesAsync(string resourceGroupName, string customAssessmentAutomationName, CustomAssessmentAutomationRequest customAssessmentAutomationBody, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + /// + /// Deletes a custom assessment automation + /// + /// + /// Deletes a custom assessment automation by name for a provided + /// subscription + /// + /// + /// The name of the resource group within the user's subscription. The + /// name is case insensitive. + /// + /// + /// Name of the Custom Assessment Automation. + /// + /// + /// The headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when a required parameter is null + /// + Task DeleteWithHttpMessagesAsync(string resourceGroupName, string customAssessmentAutomationName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + /// + /// List custom assessment automations in a subscription and a resource + /// group + /// + /// + /// List custom assessment automations by provided subscription and + /// resource group + /// + /// + /// The name of the resource group within the user's subscription. The + /// name is case insensitive. + /// + /// + /// The headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + Task>> ListByResourceGroupWithHttpMessagesAsync(string resourceGroupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + /// + /// List custom assessment automations in a subscription + /// + /// + /// List custom assessment automations by provided subscription + /// + /// + /// The headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + Task>> ListBySubscriptionWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + /// + /// List custom assessment automations in a subscription and a resource + /// group + /// + /// + /// List custom assessment automations by provided subscription and + /// resource group + /// + /// + /// The NextLink from the previous successful call to List operation. + /// + /// + /// The headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + Task>> ListByResourceGroupNextWithHttpMessagesAsync(string nextPageLink, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + /// + /// List custom assessment automations in a subscription + /// + /// + /// List custom assessment automations by provided subscription + /// + /// + /// The NextLink from the previous successful call to List operation. + /// + /// + /// The headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + Task>> ListBySubscriptionNextWithHttpMessagesAsync(string nextPageLink, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ICustomEntityStoreAssignmentsOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ICustomEntityStoreAssignmentsOperations.cs new file mode 100644 index 000000000000..9235180f0e65 --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ICustomEntityStoreAssignmentsOperations.cs @@ -0,0 +1,221 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security +{ + using Microsoft.Rest; + using Microsoft.Rest.Azure; + using Models; + using System.Collections; + using System.Collections.Generic; + using System.Threading; + using System.Threading.Tasks; + + /// + /// CustomEntityStoreAssignmentsOperations operations. + /// + public partial interface ICustomEntityStoreAssignmentsOperations + { + /// + /// Gets a custom entity store assignment + /// + /// + /// Gets a single custom entity store assignment by name for the + /// provided subscription and resource group. + /// + /// + /// The name of the resource group within the user's subscription. The + /// name is case insensitive. + /// + /// + /// Name of the custom entity store assignment. Generated name is GUID. + /// + /// + /// The headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + Task> GetWithHttpMessagesAsync(string resourceGroupName, string customEntityStoreAssignmentName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + /// + /// Creates a custom entity store assignment + /// + /// + /// Creates a custom entity store assignment for the provided + /// subscription, if not already exists. + /// + /// + /// The name of the resource group within the user's subscription. The + /// name is case insensitive. + /// + /// + /// Name of the custom entity store assignment. Generated name is GUID. + /// + /// + /// The principal assigned with entity store. If not provided, will use + /// caller principal. Format of principal is: [AAD + /// type]=[PrincipalObjectId];[TenantId] + /// + /// + /// The headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + Task> CreateWithHttpMessagesAsync(string resourceGroupName, string customEntityStoreAssignmentName, string principal = default(string), Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + /// + /// Deleted a custom entity store assignment + /// + /// + /// Delete a custom entity store assignment by name for a provided + /// subscription + /// + /// + /// The name of the resource group within the user's subscription. The + /// name is case insensitive. + /// + /// + /// Name of the custom entity store assignment. Generated name is GUID. + /// + /// + /// The headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when a required parameter is null + /// + Task DeleteWithHttpMessagesAsync(string resourceGroupName, string customEntityStoreAssignmentName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + /// + /// List custom entity store assignments in a subscription and a + /// resource group + /// + /// + /// List custom entity store assignments by a provided subscription and + /// resource group + /// + /// + /// The name of the resource group within the user's subscription. The + /// name is case insensitive. + /// + /// + /// The headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + Task>> ListByResourceGroupWithHttpMessagesAsync(string resourceGroupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + /// + /// List custom entity store assignments in a subscription + /// + /// + /// List custom entity store assignments by provided subscription + /// + /// + /// The headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + Task>> ListBySubscriptionWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + /// + /// List custom entity store assignments in a subscription and a + /// resource group + /// + /// + /// List custom entity store assignments by a provided subscription and + /// resource group + /// + /// + /// The NextLink from the previous successful call to List operation. + /// + /// + /// The headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + Task>> ListByResourceGroupNextWithHttpMessagesAsync(string nextPageLink, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + /// + /// List custom entity store assignments in a subscription + /// + /// + /// List custom entity store assignments by provided subscription + /// + /// + /// The NextLink from the previous successful call to List operation. + /// + /// + /// The headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + Task>> ListBySubscriptionNextWithHttpMessagesAsync(string nextPageLink, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IDiscoveredSecuritySolutionsOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IDiscoveredSecuritySolutionsOperations.cs index 729cbdd31541..48e9dc6bbd60 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IDiscoveredSecuritySolutionsOperations.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IDiscoveredSecuritySolutionsOperations.cs @@ -46,6 +46,10 @@ public partial interface IDiscoveredSecuritySolutionsOperations /// Gets a list of discovered Security Solutions for the subscription /// and location. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// The headers that will be added to request. /// @@ -61,7 +65,7 @@ public partial interface IDiscoveredSecuritySolutionsOperations /// /// Thrown when a required parameter is null /// - Task>> ListByHomeRegionWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task>> ListByHomeRegionWithHttpMessagesAsync(string ascLocation, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Gets a specific discovered Security Solution. /// @@ -69,6 +73,10 @@ public partial interface IDiscoveredSecuritySolutionsOperations /// The name of the resource group within the user's subscription. The /// name is case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of a discovered security solution. /// @@ -87,7 +95,7 @@ public partial interface IDiscoveredSecuritySolutionsOperations /// /// Thrown when a required parameter is null /// - Task> GetWithHttpMessagesAsync(string resourceGroupName, string discoveredSecuritySolutionName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task> GetWithHttpMessagesAsync(string resourceGroupName, string ascLocation, string discoveredSecuritySolutionName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Gets a list of discovered Security Solutions for the subscription. /// diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IExternalSecuritySolutionsOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IExternalSecuritySolutionsOperations.cs index f258aaadccdb..36962de0143c 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IExternalSecuritySolutionsOperations.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IExternalSecuritySolutionsOperations.cs @@ -46,6 +46,10 @@ public partial interface IExternalSecuritySolutionsOperations /// Gets a list of external Security Solutions for the subscription and /// location. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// The headers that will be added to request. /// @@ -61,7 +65,7 @@ public partial interface IExternalSecuritySolutionsOperations /// /// Thrown when a required parameter is null /// - Task>> ListByHomeRegionWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task>> ListByHomeRegionWithHttpMessagesAsync(string ascLocation, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Gets a specific external Security Solution. /// @@ -69,6 +73,10 @@ public partial interface IExternalSecuritySolutionsOperations /// The name of the resource group within the user's subscription. The /// name is case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of an external security solution. /// @@ -87,7 +95,7 @@ public partial interface IExternalSecuritySolutionsOperations /// /// Thrown when a required parameter is null /// - Task> GetWithHttpMessagesAsync(string resourceGroupName, string externalSecuritySolutionsName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task> GetWithHttpMessagesAsync(string resourceGroupName, string ascLocation, string externalSecuritySolutionsName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Gets a list of external security solutions for the subscription. /// diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IJitNetworkAccessPoliciesOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IJitNetworkAccessPoliciesOperations.cs index 189cf30a96de..10f353d3a750 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IJitNetworkAccessPoliciesOperations.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IJitNetworkAccessPoliciesOperations.cs @@ -47,6 +47,10 @@ public partial interface IJitNetworkAccessPoliciesOperations /// Policies for protecting resources using Just-in-Time access control /// for the subscription, location /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// The headers that will be added to request. /// @@ -62,7 +66,7 @@ public partial interface IJitNetworkAccessPoliciesOperations /// /// Thrown when a required parameter is null /// - Task>> ListByRegionWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task>> ListByRegionWithHttpMessagesAsync(string ascLocation, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Policies for protecting resources using Just-in-Time access control /// for the subscription, location @@ -95,6 +99,10 @@ public partial interface IJitNetworkAccessPoliciesOperations /// The name of the resource group within the user's subscription. The /// name is case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// The headers that will be added to request. /// @@ -110,7 +118,7 @@ public partial interface IJitNetworkAccessPoliciesOperations /// /// Thrown when a required parameter is null /// - Task>> ListByResourceGroupAndRegionWithHttpMessagesAsync(string resourceGroupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task>> ListByResourceGroupAndRegionWithHttpMessagesAsync(string resourceGroupName, string ascLocation, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Policies for protecting resources using Just-in-Time access control /// for the subscription, location @@ -119,6 +127,10 @@ public partial interface IJitNetworkAccessPoliciesOperations /// The name of the resource group within the user's subscription. The /// name is case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of a Just-in-Time access configuration policy. /// @@ -137,7 +149,7 @@ public partial interface IJitNetworkAccessPoliciesOperations /// /// Thrown when a required parameter is null /// - Task> GetWithHttpMessagesAsync(string resourceGroupName, string jitNetworkAccessPolicyName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task> GetWithHttpMessagesAsync(string resourceGroupName, string ascLocation, string jitNetworkAccessPolicyName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Create a policy for protecting resources using Just-in-Time access /// control @@ -146,6 +158,10 @@ public partial interface IJitNetworkAccessPoliciesOperations /// The name of the resource group within the user's subscription. The /// name is case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of a Just-in-Time access configuration policy. /// @@ -166,7 +182,7 @@ public partial interface IJitNetworkAccessPoliciesOperations /// /// Thrown when a required parameter is null /// - Task> CreateOrUpdateWithHttpMessagesAsync(string resourceGroupName, string jitNetworkAccessPolicyName, JitNetworkAccessPolicy body, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task> CreateOrUpdateWithHttpMessagesAsync(string resourceGroupName, string ascLocation, string jitNetworkAccessPolicyName, JitNetworkAccessPolicy body, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Delete a Just-in-Time access control policy. /// @@ -174,6 +190,10 @@ public partial interface IJitNetworkAccessPoliciesOperations /// The name of the resource group within the user's subscription. The /// name is case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of a Just-in-Time access configuration policy. /// @@ -189,7 +209,7 @@ public partial interface IJitNetworkAccessPoliciesOperations /// /// Thrown when a required parameter is null /// - Task DeleteWithHttpMessagesAsync(string resourceGroupName, string jitNetworkAccessPolicyName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task DeleteWithHttpMessagesAsync(string resourceGroupName, string ascLocation, string jitNetworkAccessPolicyName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Initiate a JIT access from a specific Just-in-Time policy /// configuration. @@ -198,6 +218,10 @@ public partial interface IJitNetworkAccessPoliciesOperations /// The name of the resource group within the user's subscription. The /// name is case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of a Just-in-Time access configuration policy. /// @@ -222,7 +246,7 @@ public partial interface IJitNetworkAccessPoliciesOperations /// /// Thrown when a required parameter is null /// - Task> InitiateWithHttpMessagesAsync(string resourceGroupName, string jitNetworkAccessPolicyName, IList virtualMachines, string justification = default(string), Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task> InitiateWithHttpMessagesAsync(string resourceGroupName, string ascLocation, string jitNetworkAccessPolicyName, IList virtualMachines, string justification = default(string), Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Policies for protecting resources using Just-in-Time access /// control. diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ILocationsOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ILocationsOperations.cs index f8aa5ec2d81e..53ab92670f24 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ILocationsOperations.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ILocationsOperations.cs @@ -48,6 +48,10 @@ public partial interface ILocationsOperations /// /// Details of a specific location /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// The headers that will be added to request. /// @@ -63,7 +67,7 @@ public partial interface ILocationsOperations /// /// Thrown when a required parameter is null /// - Task> GetWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task> GetWithHttpMessagesAsync(string ascLocation, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// The location of the responsible ASC of the specific subscription /// (home region). For each subscription there is only one responsible diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IMdeOnboardingsOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IMdeOnboardingsOperations.cs new file mode 100644 index 000000000000..a3a4e1af5336 --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IMdeOnboardingsOperations.cs @@ -0,0 +1,66 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security +{ + using Microsoft.Rest; + using Microsoft.Rest.Azure; + using Models; + using System.Collections; + using System.Collections.Generic; + using System.Threading; + using System.Threading.Tasks; + + /// + /// MdeOnboardingsOperations operations. + /// + public partial interface IMdeOnboardingsOperations + { + /// + /// The configuration or data needed to onboard the machine to MDE + /// + /// + /// The headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + Task> ListWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + /// + /// The default configuration or data needed to onboard the machine to + /// MDE + /// + /// + /// The headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + Task> GetWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IPricingsOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IPricingsOperations.cs index a243ffff64a8..9197985da499 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IPricingsOperations.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/IPricingsOperations.cs @@ -79,6 +79,11 @@ public partial interface IPricingsOperations /// capabilities, while the free tier offers basic security features. /// Possible values include: 'Free', 'Standard' /// + /// + /// The sub-plan selected for a Standard pricing configuration, when + /// more than one sub-plan is available. Each sub-plan enables a set of + /// security features. When not specified, full plan is applied. + /// /// /// The headers that will be added to request. /// @@ -94,6 +99,6 @@ public partial interface IPricingsOperations /// /// Thrown when a required parameter is null /// - Task> UpdateWithHttpMessagesAsync(string pricingName, string pricingTier, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task> UpdateWithHttpMessagesAsync(string pricingName, string pricingTier, string subPlan = default(string), Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); } } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ISecurityCenterClient.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ISecurityCenterClient.cs index 67c8d9b90101..04d5e2f4a574 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ISecurityCenterClient.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ISecurityCenterClient.cs @@ -46,12 +46,6 @@ public partial interface ISecurityCenterClient : System.IDisposable /// string SubscriptionId { get; set; } - /// - /// The location where ASC stores the data of the subscription. can be - /// retrieved from Get locations - /// - string AscLocation { get; set; } - /// /// The preferred language for the response. /// @@ -71,6 +65,21 @@ public partial interface ISecurityCenterClient : System.IDisposable bool? GenerateClientRequestId { get; set; } + /// + /// Gets the IMdeOnboardingsOperations. + /// + IMdeOnboardingsOperations MdeOnboardings { get; } + + /// + /// Gets the ICustomAssessmentAutomationsOperations. + /// + ICustomAssessmentAutomationsOperations CustomAssessmentAutomations { get; } + + /// + /// Gets the ICustomEntityStoreAssignmentsOperations. + /// + ICustomEntityStoreAssignmentsOperations CustomEntityStoreAssignments { get; } + /// /// Gets the IComplianceResultsOperations. /// @@ -296,5 +305,10 @@ public partial interface ISecurityCenterClient : System.IDisposable /// ISoftwareInventoriesOperations SoftwareInventories { get; } + /// + /// Gets the ISecurityConnectorsOperations. + /// + ISecurityConnectorsOperations SecurityConnectors { get; } + } } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ISecurityConnectorsOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ISecurityConnectorsOperations.cs new file mode 100644 index 000000000000..b42ea2c24a69 --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ISecurityConnectorsOperations.cs @@ -0,0 +1,230 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security +{ + using Microsoft.Rest; + using Microsoft.Rest.Azure; + using Models; + using System.Collections; + using System.Collections.Generic; + using System.Threading; + using System.Threading.Tasks; + + /// + /// SecurityConnectorsOperations operations. + /// + public partial interface ISecurityConnectorsOperations + { + /// + /// Lists all the security connectors in the specified subscription. + /// Use the 'nextLink' property in the response to get the next page of + /// security connectors for the specified subscription. + /// + /// + /// The headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + Task>> ListWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + /// + /// Lists all the security connectors in the specified resource group. + /// Use the 'nextLink' property in the response to get the next page of + /// security connectors for the specified resource group. + /// + /// + /// The name of the resource group within the user's subscription. The + /// name is case insensitive. + /// + /// + /// The headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + Task>> ListByResourceGroupWithHttpMessagesAsync(string resourceGroupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + /// + /// Retrieves details of a specific security connector + /// + /// + /// The name of the resource group within the user's subscription. The + /// name is case insensitive. + /// + /// + /// The security connector name. + /// + /// + /// The headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + Task> GetWithHttpMessagesAsync(string resourceGroupName, string securityConnectorName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + /// + /// Creates or updates a security connector. If a security connector is + /// already created and a subsequent request is issued for the same + /// security connector id, then it will be updated. + /// + /// + /// The name of the resource group within the user's subscription. The + /// name is case insensitive. + /// + /// + /// The security connector name. + /// + /// + /// The security connector resource + /// + /// + /// The headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + Task> CreateOrUpdateWithHttpMessagesAsync(string resourceGroupName, string securityConnectorName, SecurityConnector securityConnector, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + /// + /// Updates a security connector + /// + /// + /// The name of the resource group within the user's subscription. The + /// name is case insensitive. + /// + /// + /// The security connector name. + /// + /// + /// The security connector resource + /// + /// + /// The headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + Task> UpdateWithHttpMessagesAsync(string resourceGroupName, string securityConnectorName, SecurityConnector securityConnector, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + /// + /// Deletes a security connector. + /// + /// + /// The name of the resource group within the user's subscription. The + /// name is case insensitive. + /// + /// + /// The security connector name. + /// + /// + /// The headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when a required parameter is null + /// + Task DeleteWithHttpMessagesAsync(string resourceGroupName, string securityConnectorName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + /// + /// Lists all the security connectors in the specified subscription. + /// Use the 'nextLink' property in the response to get the next page of + /// security connectors for the specified subscription. + /// + /// + /// The NextLink from the previous successful call to List operation. + /// + /// + /// The headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + Task>> ListNextWithHttpMessagesAsync(string nextPageLink, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + /// + /// Lists all the security connectors in the specified resource group. + /// Use the 'nextLink' property in the response to get the next page of + /// security connectors for the specified resource group. + /// + /// + /// The NextLink from the previous successful call to List operation. + /// + /// + /// The headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + Task>> ListByResourceGroupNextWithHttpMessagesAsync(string nextPageLink, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ISecuritySolutionsOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ISecuritySolutionsOperations.cs index e59e818e3dc7..885fefcb1b15 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ISecuritySolutionsOperations.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ISecuritySolutionsOperations.cs @@ -49,6 +49,10 @@ public partial interface ISecuritySolutionsOperations /// The name of the resource group within the user's subscription. The /// name is case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of security solution. /// @@ -67,7 +71,7 @@ public partial interface ISecuritySolutionsOperations /// /// Thrown when a required parameter is null /// - Task> GetWithHttpMessagesAsync(string resourceGroupName, string securitySolutionName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task> GetWithHttpMessagesAsync(string resourceGroupName, string ascLocation, string securitySolutionName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Gets a list of Security Solutions for the subscription. /// diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ISecuritySolutionsReferenceDataOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ISecuritySolutionsReferenceDataOperations.cs index 0d8b4e9c13ef..fc8b2128ea98 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ISecuritySolutionsReferenceDataOperations.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ISecuritySolutionsReferenceDataOperations.cs @@ -47,6 +47,10 @@ public partial interface ISecuritySolutionsReferenceDataOperations /// Gets list of all supported Security Solutions for subscription and /// location. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// The headers that will be added to request. /// @@ -62,6 +66,6 @@ public partial interface ISecuritySolutionsReferenceDataOperations /// /// Thrown when a required parameter is null /// - Task> ListByHomeRegionWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task> ListByHomeRegionWithHttpMessagesAsync(string ascLocation, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); } } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ITasksOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ITasksOperations.cs index ee472989bb53..7165cdee40b7 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ITasksOperations.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ITasksOperations.cs @@ -50,6 +50,10 @@ public partial interface ITasksOperations /// Recommended tasks that will help improve the security of the /// subscription proactively /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// OData filter. Optional. /// @@ -68,11 +72,15 @@ public partial interface ITasksOperations /// /// Thrown when a required parameter is null /// - Task>> ListByHomeRegionWithHttpMessagesAsync(string filter = default(string), Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task>> ListByHomeRegionWithHttpMessagesAsync(string ascLocation, string filter = default(string), Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Recommended tasks that will help improve the security of the /// subscription proactively /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the task object, will be a GUID /// @@ -91,11 +99,15 @@ public partial interface ITasksOperations /// /// Thrown when a required parameter is null /// - Task> GetSubscriptionLevelTaskWithHttpMessagesAsync(string taskName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task> GetSubscriptionLevelTaskWithHttpMessagesAsync(string ascLocation, string taskName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Recommended tasks that will help improve the security of the /// subscription proactively /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the task object, will be a GUID /// @@ -115,7 +127,7 @@ public partial interface ITasksOperations /// /// Thrown when a required parameter is null /// - Task UpdateSubscriptionLevelTaskStateWithHttpMessagesAsync(string taskName, string taskUpdateActionType, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task UpdateSubscriptionLevelTaskStateWithHttpMessagesAsync(string ascLocation, string taskName, string taskUpdateActionType, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Recommended tasks that will help improve the security of the /// subscription proactively @@ -124,6 +136,10 @@ public partial interface ITasksOperations /// The name of the resource group within the user's subscription. The /// name is case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// OData filter. Optional. /// @@ -142,7 +158,7 @@ public partial interface ITasksOperations /// /// Thrown when a required parameter is null /// - Task>> ListByResourceGroupWithHttpMessagesAsync(string resourceGroupName, string filter = default(string), Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task>> ListByResourceGroupWithHttpMessagesAsync(string resourceGroupName, string ascLocation, string filter = default(string), Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Recommended tasks that will help improve the security of the /// subscription proactively @@ -151,6 +167,10 @@ public partial interface ITasksOperations /// The name of the resource group within the user's subscription. The /// name is case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the task object, will be a GUID /// @@ -169,7 +189,7 @@ public partial interface ITasksOperations /// /// Thrown when a required parameter is null /// - Task> GetResourceGroupLevelTaskWithHttpMessagesAsync(string resourceGroupName, string taskName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task> GetResourceGroupLevelTaskWithHttpMessagesAsync(string resourceGroupName, string ascLocation, string taskName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Recommended tasks that will help improve the security of the /// subscription proactively @@ -178,6 +198,10 @@ public partial interface ITasksOperations /// The name of the resource group within the user's subscription. The /// name is case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the task object, will be a GUID /// @@ -197,7 +221,7 @@ public partial interface ITasksOperations /// /// Thrown when a required parameter is null /// - Task UpdateResourceGroupLevelTaskStateWithHttpMessagesAsync(string resourceGroupName, string taskName, string taskUpdateActionType, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task UpdateResourceGroupLevelTaskStateWithHttpMessagesAsync(string resourceGroupName, string ascLocation, string taskName, string taskUpdateActionType, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Recommended tasks that will help improve the security of the /// subscription proactively diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ITopologyOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ITopologyOperations.cs index 064b65cd1f7e..7e61c05126da 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ITopologyOperations.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/ITopologyOperations.cs @@ -46,6 +46,10 @@ public partial interface ITopologyOperations /// Gets a list that allows to build a topology view of a subscription /// and location. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// The headers that will be added to request. /// @@ -61,7 +65,7 @@ public partial interface ITopologyOperations /// /// Thrown when a required parameter is null /// - Task>> ListByHomeRegionWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task>> ListByHomeRegionWithHttpMessagesAsync(string ascLocation, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Gets a specific topology component. /// @@ -69,6 +73,10 @@ public partial interface ITopologyOperations /// The name of the resource group within the user's subscription. The /// name is case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of a topology resources collection. /// @@ -87,7 +95,7 @@ public partial interface ITopologyOperations /// /// Thrown when a required parameter is null /// - Task> GetWithHttpMessagesAsync(string resourceGroupName, string topologyResourceName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); + Task> GetWithHttpMessagesAsync(string resourceGroupName, string ascLocation, string topologyResourceName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)); /// /// Gets a list that allows to build a topology view of a subscription. /// diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/InformationProtectionPoliciesOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/InformationProtectionPoliciesOperations.cs index b0dd1523134d..c7eeb37b8542 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/InformationProtectionPoliciesOperations.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/InformationProtectionPoliciesOperations.cs @@ -111,7 +111,7 @@ internal InformationProtectionPoliciesOperations(SecurityCenterClient client) var _baseUrl = Client.BaseUri.AbsoluteUri; var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "{scope}/providers/Microsoft.Security/informationProtectionPolicies/{informationProtectionPolicyName}").ToString(); _url = _url.Replace("{scope}", scope); - _url = _url.Replace("{informationProtectionPolicyName}", System.Uri.EscapeDataString(Rest.Serialization.SafeJsonConvert.SerializeObject(informationProtectionPolicyName, Client.SerializationSettings).Trim('"'))); + _url = _url.Replace("{informationProtectionPolicyName}", System.Uri.EscapeDataString(informationProtectionPolicyName)); List _queryParameters = new List(); if (apiVersion != null) { @@ -316,7 +316,7 @@ internal InformationProtectionPoliciesOperations(SecurityCenterClient client) var _baseUrl = Client.BaseUri.AbsoluteUri; var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "{scope}/providers/Microsoft.Security/informationProtectionPolicies/{informationProtectionPolicyName}").ToString(); _url = _url.Replace("{scope}", scope); - _url = _url.Replace("{informationProtectionPolicyName}", System.Uri.EscapeDataString(Rest.Serialization.SafeJsonConvert.SerializeObject(informationProtectionPolicyName, Client.SerializationSettings).Trim('"'))); + _url = _url.Replace("{informationProtectionPolicyName}", System.Uri.EscapeDataString(informationProtectionPolicyName)); List _queryParameters = new List(); if (apiVersion != null) { diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/JitNetworkAccessPoliciesOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/JitNetworkAccessPoliciesOperations.cs index e600a0970206..e93fd756f677 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/JitNetworkAccessPoliciesOperations.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/JitNetworkAccessPoliciesOperations.cs @@ -237,6 +237,10 @@ internal JitNetworkAccessPoliciesOperations(SecurityCenterClient client) /// Policies for protecting resources using Just-in-Time access control for the /// subscription, location /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Headers that will be added to request. /// @@ -258,7 +262,7 @@ internal JitNetworkAccessPoliciesOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task>> ListByRegionWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task>> ListByRegionWithHttpMessagesAsync(string ascLocation, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -271,9 +275,9 @@ internal JitNetworkAccessPoliciesOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } string apiVersion = "2020-01-01"; // Tracing @@ -283,6 +287,7 @@ internal JitNetworkAccessPoliciesOperations(SecurityCenterClient client) { _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("apiVersion", apiVersion); tracingParameters.Add("cancellationToken", cancellationToken); ServiceClientTracing.Enter(_invocationId, this, "ListByRegion", tracingParameters); @@ -291,7 +296,7 @@ internal JitNetworkAccessPoliciesOperations(SecurityCenterClient client) var _baseUrl = Client.BaseUri.AbsoluteUri; var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/providers/Microsoft.Security/locations/{ascLocation}/jitNetworkAccessPolicies").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); List _queryParameters = new List(); if (apiVersion != null) { @@ -639,6 +644,10 @@ internal JitNetworkAccessPoliciesOperations(SecurityCenterClient client) /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Headers that will be added to request. /// @@ -660,7 +669,7 @@ internal JitNetworkAccessPoliciesOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task>> ListByResourceGroupAndRegionWithHttpMessagesAsync(string resourceGroupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task>> ListByResourceGroupAndRegionWithHttpMessagesAsync(string resourceGroupName, string ascLocation, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -692,9 +701,9 @@ internal JitNetworkAccessPoliciesOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } string apiVersion = "2020-01-01"; // Tracing @@ -705,6 +714,7 @@ internal JitNetworkAccessPoliciesOperations(SecurityCenterClient client) _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); tracingParameters.Add("resourceGroupName", resourceGroupName); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("apiVersion", apiVersion); tracingParameters.Add("cancellationToken", cancellationToken); ServiceClientTracing.Enter(_invocationId, this, "ListByResourceGroupAndRegion", tracingParameters); @@ -714,7 +724,7 @@ internal JitNetworkAccessPoliciesOperations(SecurityCenterClient client) var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/locations/{ascLocation}/jitNetworkAccessPolicies").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); List _queryParameters = new List(); if (apiVersion != null) { @@ -853,6 +863,10 @@ internal JitNetworkAccessPoliciesOperations(SecurityCenterClient client) /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of a Just-in-Time access configuration policy. /// @@ -877,7 +891,7 @@ internal JitNetworkAccessPoliciesOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task> GetWithHttpMessagesAsync(string resourceGroupName, string jitNetworkAccessPolicyName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task> GetWithHttpMessagesAsync(string resourceGroupName, string ascLocation, string jitNetworkAccessPolicyName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -909,9 +923,9 @@ internal JitNetworkAccessPoliciesOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } if (jitNetworkAccessPolicyName == null) { @@ -926,6 +940,7 @@ internal JitNetworkAccessPoliciesOperations(SecurityCenterClient client) _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); tracingParameters.Add("resourceGroupName", resourceGroupName); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("jitNetworkAccessPolicyName", jitNetworkAccessPolicyName); tracingParameters.Add("apiVersion", apiVersion); tracingParameters.Add("cancellationToken", cancellationToken); @@ -936,7 +951,7 @@ internal JitNetworkAccessPoliciesOperations(SecurityCenterClient client) var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/locations/{ascLocation}/jitNetworkAccessPolicies/{jitNetworkAccessPolicyName}").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); _url = _url.Replace("{jitNetworkAccessPolicyName}", System.Uri.EscapeDataString(jitNetworkAccessPolicyName)); List _queryParameters = new List(); if (apiVersion != null) @@ -1075,6 +1090,10 @@ internal JitNetworkAccessPoliciesOperations(SecurityCenterClient client) /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of a Just-in-Time access configuration policy. /// @@ -1101,7 +1120,7 @@ internal JitNetworkAccessPoliciesOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task> CreateOrUpdateWithHttpMessagesAsync(string resourceGroupName, string jitNetworkAccessPolicyName, JitNetworkAccessPolicy body, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task> CreateOrUpdateWithHttpMessagesAsync(string resourceGroupName, string ascLocation, string jitNetworkAccessPolicyName, JitNetworkAccessPolicy body, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -1133,9 +1152,9 @@ internal JitNetworkAccessPoliciesOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } if (jitNetworkAccessPolicyName == null) { @@ -1158,6 +1177,7 @@ internal JitNetworkAccessPoliciesOperations(SecurityCenterClient client) _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); tracingParameters.Add("resourceGroupName", resourceGroupName); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("jitNetworkAccessPolicyName", jitNetworkAccessPolicyName); tracingParameters.Add("apiVersion", apiVersion); tracingParameters.Add("body", body); @@ -1169,7 +1189,7 @@ internal JitNetworkAccessPoliciesOperations(SecurityCenterClient client) var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/locations/{ascLocation}/jitNetworkAccessPolicies/{jitNetworkAccessPolicyName}").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); _url = _url.Replace("{jitNetworkAccessPolicyName}", System.Uri.EscapeDataString(jitNetworkAccessPolicyName)); List _queryParameters = new List(); if (apiVersion != null) @@ -1314,6 +1334,10 @@ internal JitNetworkAccessPoliciesOperations(SecurityCenterClient client) /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of a Just-in-Time access configuration policy. /// @@ -1335,7 +1359,7 @@ internal JitNetworkAccessPoliciesOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task DeleteWithHttpMessagesAsync(string resourceGroupName, string jitNetworkAccessPolicyName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task DeleteWithHttpMessagesAsync(string resourceGroupName, string ascLocation, string jitNetworkAccessPolicyName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -1367,9 +1391,9 @@ internal JitNetworkAccessPoliciesOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } if (jitNetworkAccessPolicyName == null) { @@ -1384,6 +1408,7 @@ internal JitNetworkAccessPoliciesOperations(SecurityCenterClient client) _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); tracingParameters.Add("resourceGroupName", resourceGroupName); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("jitNetworkAccessPolicyName", jitNetworkAccessPolicyName); tracingParameters.Add("apiVersion", apiVersion); tracingParameters.Add("cancellationToken", cancellationToken); @@ -1394,7 +1419,7 @@ internal JitNetworkAccessPoliciesOperations(SecurityCenterClient client) var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/locations/{ascLocation}/jitNetworkAccessPolicies/{jitNetworkAccessPolicyName}").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); _url = _url.Replace("{jitNetworkAccessPolicyName}", System.Uri.EscapeDataString(jitNetworkAccessPolicyName)); List _queryParameters = new List(); if (apiVersion != null) @@ -1515,6 +1540,10 @@ internal JitNetworkAccessPoliciesOperations(SecurityCenterClient client) /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of a Just-in-Time access configuration policy. /// @@ -1545,7 +1574,7 @@ internal JitNetworkAccessPoliciesOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task> InitiateWithHttpMessagesAsync(string resourceGroupName, string jitNetworkAccessPolicyName, IList virtualMachines, string justification = default(string), Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task> InitiateWithHttpMessagesAsync(string resourceGroupName, string ascLocation, string jitNetworkAccessPolicyName, IList virtualMachines, string justification = default(string), Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -1577,9 +1606,9 @@ internal JitNetworkAccessPoliciesOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } if (jitNetworkAccessPolicyName == null) { @@ -1615,6 +1644,7 @@ internal JitNetworkAccessPoliciesOperations(SecurityCenterClient client) _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); tracingParameters.Add("resourceGroupName", resourceGroupName); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("jitNetworkAccessPolicyName", jitNetworkAccessPolicyName); tracingParameters.Add("jitNetworkAccessPolicyInitiateType", jitNetworkAccessPolicyInitiateType); tracingParameters.Add("apiVersion", apiVersion); @@ -1627,7 +1657,7 @@ internal JitNetworkAccessPoliciesOperations(SecurityCenterClient client) var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/locations/{ascLocation}/jitNetworkAccessPolicies/{jitNetworkAccessPolicyName}/{jitNetworkAccessPolicyInitiateType}").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); _url = _url.Replace("{jitNetworkAccessPolicyName}", System.Uri.EscapeDataString(jitNetworkAccessPolicyName)); _url = _url.Replace("{jitNetworkAccessPolicyInitiateType}", System.Uri.EscapeDataString(jitNetworkAccessPolicyInitiateType)); List _queryParameters = new List(); diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/JitNetworkAccessPoliciesOperationsExtensions.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/JitNetworkAccessPoliciesOperationsExtensions.cs index d38cf804bfe6..e571f41e10f0 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/JitNetworkAccessPoliciesOperationsExtensions.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/JitNetworkAccessPoliciesOperationsExtensions.cs @@ -58,9 +58,13 @@ public static IPage List(this IJitNetworkAccessPoliciesO /// /// The operations group for this extension method. /// - public static IPage ListByRegion(this IJitNetworkAccessPoliciesOperations operations) + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// + public static IPage ListByRegion(this IJitNetworkAccessPoliciesOperations operations, string ascLocation) { - return operations.ListByRegionAsync().GetAwaiter().GetResult(); + return operations.ListByRegionAsync(ascLocation).GetAwaiter().GetResult(); } /// @@ -70,12 +74,16 @@ public static IPage ListByRegion(this IJitNetworkAccessP /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// The cancellation token. /// - public static async Task> ListByRegionAsync(this IJitNetworkAccessPoliciesOperations operations, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task> ListByRegionAsync(this IJitNetworkAccessPoliciesOperations operations, string ascLocation, CancellationToken cancellationToken = default(CancellationToken)) { - using (var _result = await operations.ListByRegionWithHttpMessagesAsync(null, cancellationToken).ConfigureAwait(false)) + using (var _result = await operations.ListByRegionWithHttpMessagesAsync(ascLocation, null, cancellationToken).ConfigureAwait(false)) { return _result.Body; } @@ -130,9 +138,13 @@ public static IPage ListByResourceGroup(this IJitNetwork /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// - public static IPage ListByResourceGroupAndRegion(this IJitNetworkAccessPoliciesOperations operations, string resourceGroupName) + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// + public static IPage ListByResourceGroupAndRegion(this IJitNetworkAccessPoliciesOperations operations, string resourceGroupName, string ascLocation) { - return operations.ListByResourceGroupAndRegionAsync(resourceGroupName).GetAwaiter().GetResult(); + return operations.ListByResourceGroupAndRegionAsync(resourceGroupName, ascLocation).GetAwaiter().GetResult(); } /// @@ -146,12 +158,16 @@ public static IPage ListByResourceGroupAndRegion(this IJ /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// The cancellation token. /// - public static async Task> ListByResourceGroupAndRegionAsync(this IJitNetworkAccessPoliciesOperations operations, string resourceGroupName, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task> ListByResourceGroupAndRegionAsync(this IJitNetworkAccessPoliciesOperations operations, string resourceGroupName, string ascLocation, CancellationToken cancellationToken = default(CancellationToken)) { - using (var _result = await operations.ListByResourceGroupAndRegionWithHttpMessagesAsync(resourceGroupName, null, cancellationToken).ConfigureAwait(false)) + using (var _result = await operations.ListByResourceGroupAndRegionWithHttpMessagesAsync(resourceGroupName, ascLocation, null, cancellationToken).ConfigureAwait(false)) { return _result.Body; } @@ -168,12 +184,16 @@ public static IPage ListByResourceGroupAndRegion(this IJ /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of a Just-in-Time access configuration policy. /// - public static JitNetworkAccessPolicy Get(this IJitNetworkAccessPoliciesOperations operations, string resourceGroupName, string jitNetworkAccessPolicyName) + public static JitNetworkAccessPolicy Get(this IJitNetworkAccessPoliciesOperations operations, string resourceGroupName, string ascLocation, string jitNetworkAccessPolicyName) { - return operations.GetAsync(resourceGroupName, jitNetworkAccessPolicyName).GetAwaiter().GetResult(); + return operations.GetAsync(resourceGroupName, ascLocation, jitNetworkAccessPolicyName).GetAwaiter().GetResult(); } /// @@ -187,15 +207,19 @@ public static JitNetworkAccessPolicy Get(this IJitNetworkAccessPoliciesOperation /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of a Just-in-Time access configuration policy. /// /// /// The cancellation token. /// - public static async Task GetAsync(this IJitNetworkAccessPoliciesOperations operations, string resourceGroupName, string jitNetworkAccessPolicyName, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task GetAsync(this IJitNetworkAccessPoliciesOperations operations, string resourceGroupName, string ascLocation, string jitNetworkAccessPolicyName, CancellationToken cancellationToken = default(CancellationToken)) { - using (var _result = await operations.GetWithHttpMessagesAsync(resourceGroupName, jitNetworkAccessPolicyName, null, cancellationToken).ConfigureAwait(false)) + using (var _result = await operations.GetWithHttpMessagesAsync(resourceGroupName, ascLocation, jitNetworkAccessPolicyName, null, cancellationToken).ConfigureAwait(false)) { return _result.Body; } @@ -211,14 +235,18 @@ public static JitNetworkAccessPolicy Get(this IJitNetworkAccessPoliciesOperation /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of a Just-in-Time access configuration policy. /// /// /// - public static JitNetworkAccessPolicy CreateOrUpdate(this IJitNetworkAccessPoliciesOperations operations, string resourceGroupName, string jitNetworkAccessPolicyName, JitNetworkAccessPolicy body) + public static JitNetworkAccessPolicy CreateOrUpdate(this IJitNetworkAccessPoliciesOperations operations, string resourceGroupName, string ascLocation, string jitNetworkAccessPolicyName, JitNetworkAccessPolicy body) { - return operations.CreateOrUpdateAsync(resourceGroupName, jitNetworkAccessPolicyName, body).GetAwaiter().GetResult(); + return operations.CreateOrUpdateAsync(resourceGroupName, ascLocation, jitNetworkAccessPolicyName, body).GetAwaiter().GetResult(); } /// @@ -231,6 +259,10 @@ public static JitNetworkAccessPolicy CreateOrUpdate(this IJitNetworkAccessPolici /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of a Just-in-Time access configuration policy. /// @@ -239,9 +271,9 @@ public static JitNetworkAccessPolicy CreateOrUpdate(this IJitNetworkAccessPolici /// /// The cancellation token. /// - public static async Task CreateOrUpdateAsync(this IJitNetworkAccessPoliciesOperations operations, string resourceGroupName, string jitNetworkAccessPolicyName, JitNetworkAccessPolicy body, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task CreateOrUpdateAsync(this IJitNetworkAccessPoliciesOperations operations, string resourceGroupName, string ascLocation, string jitNetworkAccessPolicyName, JitNetworkAccessPolicy body, CancellationToken cancellationToken = default(CancellationToken)) { - using (var _result = await operations.CreateOrUpdateWithHttpMessagesAsync(resourceGroupName, jitNetworkAccessPolicyName, body, null, cancellationToken).ConfigureAwait(false)) + using (var _result = await operations.CreateOrUpdateWithHttpMessagesAsync(resourceGroupName, ascLocation, jitNetworkAccessPolicyName, body, null, cancellationToken).ConfigureAwait(false)) { return _result.Body; } @@ -257,12 +289,16 @@ public static JitNetworkAccessPolicy CreateOrUpdate(this IJitNetworkAccessPolici /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of a Just-in-Time access configuration policy. /// - public static void Delete(this IJitNetworkAccessPoliciesOperations operations, string resourceGroupName, string jitNetworkAccessPolicyName) + public static void Delete(this IJitNetworkAccessPoliciesOperations operations, string resourceGroupName, string ascLocation, string jitNetworkAccessPolicyName) { - operations.DeleteAsync(resourceGroupName, jitNetworkAccessPolicyName).GetAwaiter().GetResult(); + operations.DeleteAsync(resourceGroupName, ascLocation, jitNetworkAccessPolicyName).GetAwaiter().GetResult(); } /// @@ -275,15 +311,19 @@ public static void Delete(this IJitNetworkAccessPoliciesOperations operations, s /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of a Just-in-Time access configuration policy. /// /// /// The cancellation token. /// - public static async Task DeleteAsync(this IJitNetworkAccessPoliciesOperations operations, string resourceGroupName, string jitNetworkAccessPolicyName, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task DeleteAsync(this IJitNetworkAccessPoliciesOperations operations, string resourceGroupName, string ascLocation, string jitNetworkAccessPolicyName, CancellationToken cancellationToken = default(CancellationToken)) { - (await operations.DeleteWithHttpMessagesAsync(resourceGroupName, jitNetworkAccessPolicyName, null, cancellationToken).ConfigureAwait(false)).Dispose(); + (await operations.DeleteWithHttpMessagesAsync(resourceGroupName, ascLocation, jitNetworkAccessPolicyName, null, cancellationToken).ConfigureAwait(false)).Dispose(); } /// @@ -296,6 +336,10 @@ public static void Delete(this IJitNetworkAccessPoliciesOperations operations, s /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of a Just-in-Time access configuration policy. /// @@ -305,9 +349,9 @@ public static void Delete(this IJitNetworkAccessPoliciesOperations operations, s /// /// The justification for making the initiate request /// - public static JitNetworkAccessRequest Initiate(this IJitNetworkAccessPoliciesOperations operations, string resourceGroupName, string jitNetworkAccessPolicyName, IList virtualMachines, string justification = default(string)) + public static JitNetworkAccessRequest Initiate(this IJitNetworkAccessPoliciesOperations operations, string resourceGroupName, string ascLocation, string jitNetworkAccessPolicyName, IList virtualMachines, string justification = default(string)) { - return operations.InitiateAsync(resourceGroupName, jitNetworkAccessPolicyName, virtualMachines, justification).GetAwaiter().GetResult(); + return operations.InitiateAsync(resourceGroupName, ascLocation, jitNetworkAccessPolicyName, virtualMachines, justification).GetAwaiter().GetResult(); } /// @@ -320,6 +364,10 @@ public static void Delete(this IJitNetworkAccessPoliciesOperations operations, s /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of a Just-in-Time access configuration policy. /// @@ -332,9 +380,9 @@ public static void Delete(this IJitNetworkAccessPoliciesOperations operations, s /// /// The cancellation token. /// - public static async Task InitiateAsync(this IJitNetworkAccessPoliciesOperations operations, string resourceGroupName, string jitNetworkAccessPolicyName, IList virtualMachines, string justification = default(string), CancellationToken cancellationToken = default(CancellationToken)) + public static async Task InitiateAsync(this IJitNetworkAccessPoliciesOperations operations, string resourceGroupName, string ascLocation, string jitNetworkAccessPolicyName, IList virtualMachines, string justification = default(string), CancellationToken cancellationToken = default(CancellationToken)) { - using (var _result = await operations.InitiateWithHttpMessagesAsync(resourceGroupName, jitNetworkAccessPolicyName, virtualMachines, justification, null, cancellationToken).ConfigureAwait(false)) + using (var _result = await operations.InitiateWithHttpMessagesAsync(resourceGroupName, ascLocation, jitNetworkAccessPolicyName, virtualMachines, justification, null, cancellationToken).ConfigureAwait(false)) { return _result.Body; } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/LocationsOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/LocationsOperations.cs index 456e5d1aa5a0..9ca654a39afb 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/LocationsOperations.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/LocationsOperations.cs @@ -239,6 +239,10 @@ internal LocationsOperations(SecurityCenterClient client) /// /// Details of a specific location /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Headers that will be added to request. /// @@ -260,7 +264,7 @@ internal LocationsOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task> GetWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task> GetWithHttpMessagesAsync(string ascLocation, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -273,9 +277,9 @@ internal LocationsOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } string apiVersion = "2015-06-01-preview"; // Tracing @@ -286,6 +290,7 @@ internal LocationsOperations(SecurityCenterClient client) _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); tracingParameters.Add("apiVersion", apiVersion); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("cancellationToken", cancellationToken); ServiceClientTracing.Enter(_invocationId, this, "Get", tracingParameters); } @@ -293,7 +298,7 @@ internal LocationsOperations(SecurityCenterClient client) var _baseUrl = Client.BaseUri.AbsoluteUri; var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/providers/Microsoft.Security/locations/{ascLocation}").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); List _queryParameters = new List(); if (apiVersion != null) { diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/LocationsOperationsExtensions.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/LocationsOperationsExtensions.cs index 2352a413ee62..3743f5bb3355 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/LocationsOperationsExtensions.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/LocationsOperationsExtensions.cs @@ -61,9 +61,13 @@ public static IPage List(this ILocationsOperations operations) /// /// The operations group for this extension method. /// - public static AscLocation Get(this ILocationsOperations operations) + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// + public static AscLocation Get(this ILocationsOperations operations, string ascLocation) { - return operations.GetAsync().GetAwaiter().GetResult(); + return operations.GetAsync(ascLocation).GetAwaiter().GetResult(); } /// @@ -72,12 +76,16 @@ public static AscLocation Get(this ILocationsOperations operations) /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// The cancellation token. /// - public static async Task GetAsync(this ILocationsOperations operations, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task GetAsync(this ILocationsOperations operations, string ascLocation, CancellationToken cancellationToken = default(CancellationToken)) { - using (var _result = await operations.GetWithHttpMessagesAsync(null, cancellationToken).ConfigureAwait(false)) + using (var _result = await operations.GetWithHttpMessagesAsync(ascLocation, null, cancellationToken).ConfigureAwait(false)) { return _result.Body; } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/MdeOnboardingsOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/MdeOnboardingsOperations.cs new file mode 100644 index 000000000000..a4372d966bfb --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/MdeOnboardingsOperations.cs @@ -0,0 +1,420 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security +{ + using Microsoft.Rest; + using Microsoft.Rest.Azure; + using Models; + using Newtonsoft.Json; + using System.Collections; + using System.Collections.Generic; + using System.Linq; + using System.Net; + using System.Net.Http; + using System.Threading; + using System.Threading.Tasks; + + /// + /// MdeOnboardingsOperations operations. + /// + internal partial class MdeOnboardingsOperations : IServiceOperations, IMdeOnboardingsOperations + { + /// + /// Initializes a new instance of the MdeOnboardingsOperations class. + /// + /// + /// Reference to the service client. + /// + /// + /// Thrown when a required parameter is null + /// + internal MdeOnboardingsOperations(SecurityCenterClient client) + { + if (client == null) + { + throw new System.ArgumentNullException("client"); + } + Client = client; + } + + /// + /// Gets a reference to the SecurityCenterClient + /// + public SecurityCenterClient Client { get; private set; } + + /// + /// The configuration or data needed to onboard the machine to MDE + /// + /// + /// Headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// A response object containing the response body and response headers. + /// + public async Task> ListWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + { + if (Client.SubscriptionId == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId"); + } + if (Client.SubscriptionId != null) + { + if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$")) + { + throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); + } + } + string apiVersion = "2021-10-01-preview"; + // Tracing + bool _shouldTrace = ServiceClientTracing.IsEnabled; + string _invocationId = null; + if (_shouldTrace) + { + _invocationId = ServiceClientTracing.NextInvocationId.ToString(); + Dictionary tracingParameters = new Dictionary(); + tracingParameters.Add("apiVersion", apiVersion); + tracingParameters.Add("cancellationToken", cancellationToken); + ServiceClientTracing.Enter(_invocationId, this, "List", tracingParameters); + } + // Construct URL + var _baseUrl = Client.BaseUri.AbsoluteUri; + var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/providers/Microsoft.Security/mdeOnboardings").ToString(); + _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); + List _queryParameters = new List(); + if (apiVersion != null) + { + _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(apiVersion))); + } + if (_queryParameters.Count > 0) + { + _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters); + } + // Create HTTP transport objects + var _httpRequest = new HttpRequestMessage(); + HttpResponseMessage _httpResponse = null; + _httpRequest.Method = new HttpMethod("GET"); + _httpRequest.RequestUri = new System.Uri(_url); + // Set Headers + if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value) + { + _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString()); + } + if (Client.AcceptLanguage != null) + { + if (_httpRequest.Headers.Contains("accept-language")) + { + _httpRequest.Headers.Remove("accept-language"); + } + _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage); + } + + + if (customHeaders != null) + { + foreach(var _header in customHeaders) + { + if (_httpRequest.Headers.Contains(_header.Key)) + { + _httpRequest.Headers.Remove(_header.Key); + } + _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value); + } + } + + // Serialize Request + string _requestContent = null; + // Set Credentials + if (Client.Credentials != null) + { + cancellationToken.ThrowIfCancellationRequested(); + await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + } + // Send Request + if (_shouldTrace) + { + ServiceClientTracing.SendRequest(_invocationId, _httpRequest); + } + cancellationToken.ThrowIfCancellationRequested(); + _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + if (_shouldTrace) + { + ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse); + } + HttpStatusCode _statusCode = _httpResponse.StatusCode; + cancellationToken.ThrowIfCancellationRequested(); + string _responseContent = null; + if ((int)_statusCode != 200) + { + var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode)); + try + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + CloudError _errorBody = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + if (_errorBody != null) + { + ex = new CloudException(_errorBody.Message); + ex.Body = _errorBody; + } + } + catch (JsonException) + { + // Ignore the exception + } + ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent); + ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent); + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + if (_shouldTrace) + { + ServiceClientTracing.Error(_invocationId, ex); + } + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw ex; + } + // Create Result + var _result = new AzureOperationResponse(); + _result.Request = _httpRequest; + _result.Response = _httpResponse; + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + // Deserialize Response + if ((int)_statusCode == 200) + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + try + { + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + } + catch (JsonException ex) + { + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw new SerializationException("Unable to deserialize the response.", _responseContent, ex); + } + } + if (_shouldTrace) + { + ServiceClientTracing.Exit(_invocationId, _result); + } + return _result; + } + + /// + /// The default configuration or data needed to onboard the machine to MDE + /// + /// + /// Headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// A response object containing the response body and response headers. + /// + public async Task> GetWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + { + if (Client.SubscriptionId == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId"); + } + if (Client.SubscriptionId != null) + { + if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$")) + { + throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); + } + } + string apiVersion = "2021-10-01-preview"; + // Tracing + bool _shouldTrace = ServiceClientTracing.IsEnabled; + string _invocationId = null; + if (_shouldTrace) + { + _invocationId = ServiceClientTracing.NextInvocationId.ToString(); + Dictionary tracingParameters = new Dictionary(); + tracingParameters.Add("apiVersion", apiVersion); + tracingParameters.Add("cancellationToken", cancellationToken); + ServiceClientTracing.Enter(_invocationId, this, "Get", tracingParameters); + } + // Construct URL + var _baseUrl = Client.BaseUri.AbsoluteUri; + var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/providers/Microsoft.Security/mdeOnboardings/default").ToString(); + _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); + List _queryParameters = new List(); + if (apiVersion != null) + { + _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(apiVersion))); + } + if (_queryParameters.Count > 0) + { + _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters); + } + // Create HTTP transport objects + var _httpRequest = new HttpRequestMessage(); + HttpResponseMessage _httpResponse = null; + _httpRequest.Method = new HttpMethod("GET"); + _httpRequest.RequestUri = new System.Uri(_url); + // Set Headers + if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value) + { + _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString()); + } + if (Client.AcceptLanguage != null) + { + if (_httpRequest.Headers.Contains("accept-language")) + { + _httpRequest.Headers.Remove("accept-language"); + } + _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage); + } + + + if (customHeaders != null) + { + foreach(var _header in customHeaders) + { + if (_httpRequest.Headers.Contains(_header.Key)) + { + _httpRequest.Headers.Remove(_header.Key); + } + _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value); + } + } + + // Serialize Request + string _requestContent = null; + // Set Credentials + if (Client.Credentials != null) + { + cancellationToken.ThrowIfCancellationRequested(); + await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + } + // Send Request + if (_shouldTrace) + { + ServiceClientTracing.SendRequest(_invocationId, _httpRequest); + } + cancellationToken.ThrowIfCancellationRequested(); + _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + if (_shouldTrace) + { + ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse); + } + HttpStatusCode _statusCode = _httpResponse.StatusCode; + cancellationToken.ThrowIfCancellationRequested(); + string _responseContent = null; + if ((int)_statusCode != 200) + { + var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode)); + try + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + CloudError _errorBody = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + if (_errorBody != null) + { + ex = new CloudException(_errorBody.Message); + ex.Body = _errorBody; + } + } + catch (JsonException) + { + // Ignore the exception + } + ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent); + ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent); + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + if (_shouldTrace) + { + ServiceClientTracing.Error(_invocationId, ex); + } + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw ex; + } + // Create Result + var _result = new AzureOperationResponse(); + _result.Request = _httpRequest; + _result.Response = _httpResponse; + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + // Deserialize Response + if ((int)_statusCode == 200) + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + try + { + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + } + catch (JsonException ex) + { + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw new SerializationException("Unable to deserialize the response.", _responseContent, ex); + } + } + if (_shouldTrace) + { + ServiceClientTracing.Exit(_invocationId, _result); + } + return _result; + } + + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/MdeOnboardingsOperationsExtensions.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/MdeOnboardingsOperationsExtensions.cs new file mode 100644 index 000000000000..37b90bccd89c --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/MdeOnboardingsOperationsExtensions.cs @@ -0,0 +1,81 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security +{ + using Microsoft.Rest; + using Microsoft.Rest.Azure; + using Models; + using System.Threading; + using System.Threading.Tasks; + + /// + /// Extension methods for MdeOnboardingsOperations. + /// + public static partial class MdeOnboardingsOperationsExtensions + { + /// + /// The configuration or data needed to onboard the machine to MDE + /// + /// + /// The operations group for this extension method. + /// + public static MdeOnboardingDataList List(this IMdeOnboardingsOperations operations) + { + return operations.ListAsync().GetAwaiter().GetResult(); + } + + /// + /// The configuration or data needed to onboard the machine to MDE + /// + /// + /// The operations group for this extension method. + /// + /// + /// The cancellation token. + /// + public static async Task ListAsync(this IMdeOnboardingsOperations operations, CancellationToken cancellationToken = default(CancellationToken)) + { + using (var _result = await operations.ListWithHttpMessagesAsync(null, cancellationToken).ConfigureAwait(false)) + { + return _result.Body; + } + } + + /// + /// The default configuration or data needed to onboard the machine to MDE + /// + /// + /// The operations group for this extension method. + /// + public static MdeOnboardingData Get(this IMdeOnboardingsOperations operations) + { + return operations.GetAsync().GetAwaiter().GetResult(); + } + + /// + /// The default configuration or data needed to onboard the machine to MDE + /// + /// + /// The operations group for this extension method. + /// + /// + /// The cancellation token. + /// + public static async Task GetAsync(this IMdeOnboardingsOperations operations, CancellationToken cancellationToken = default(CancellationToken)) + { + using (var _result = await operations.GetWithHttpMessagesAsync(null, cancellationToken).ConfigureAwait(false)) + { + return _result.Body; + } + } + + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/AssessmentStatusResponse.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/AssessmentStatusResponse.cs new file mode 100644 index 000000000000..8c65907db4db --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/AssessmentStatusResponse.cs @@ -0,0 +1,83 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + using Newtonsoft.Json; + using System.Linq; + + /// + /// The result of the assessment + /// + public partial class AssessmentStatusResponse : AssessmentStatus + { + /// + /// Initializes a new instance of the AssessmentStatusResponse class. + /// + public AssessmentStatusResponse() + { + CustomInit(); + } + + /// + /// Initializes a new instance of the AssessmentStatusResponse class. + /// + /// Programmatic code for the status of the + /// assessment. Possible values include: 'Healthy', 'Unhealthy', + /// 'NotApplicable' + /// Programmatic code for the cause of the + /// assessment status + /// Human readable description of the + /// assessment status + /// The time that the assessment was + /// created and first evaluated. Returned as UTC time in ISO 8601 + /// format + /// The time that the status of the + /// assessment last changed. Returned as UTC time in ISO 8601 + /// format + public AssessmentStatusResponse(string code, string cause = default(string), string description = default(string), System.DateTime? firstEvaluationDate = default(System.DateTime?), System.DateTime? statusChangeDate = default(System.DateTime?)) + : base(code, cause, description) + { + FirstEvaluationDate = firstEvaluationDate; + StatusChangeDate = statusChangeDate; + CustomInit(); + } + + /// + /// An initialization method that performs custom operations like setting defaults + /// + partial void CustomInit(); + + /// + /// Gets the time that the assessment was created and first evaluated. + /// Returned as UTC time in ISO 8601 format + /// + [JsonProperty(PropertyName = "firstEvaluationDate")] + public System.DateTime? FirstEvaluationDate { get; private set; } + + /// + /// Gets the time that the status of the assessment last changed. + /// Returned as UTC time in ISO 8601 format + /// + [JsonProperty(PropertyName = "statusChangeDate")] + public System.DateTime? StatusChangeDate { get; private set; } + + /// + /// Validate the object. + /// + /// + /// Thrown if validation fails + /// + public override void Validate() + { + base.Validate(); + } + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/AutomationSource.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/AutomationSource.cs index 9e48941ebb18..4ca8dd6c764f 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/AutomationSource.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/AutomationSource.cs @@ -35,7 +35,8 @@ public AutomationSource() /// Initializes a new instance of the AutomationSource class. /// /// A valid event source type. Possible - /// values include: 'Assessments', 'SubAssessments', 'Alerts', + /// values include: 'Assessments', 'AssessmentsSnapshot', + /// 'SubAssessments', 'SubAssessmentsSnapshot', 'Alerts', /// 'SecureScores', 'SecureScoresSnapshot', 'SecureScoreControls', /// 'SecureScoreControlsSnapshot', 'RegulatoryComplianceAssessment', /// 'RegulatoryComplianceAssessmentSnapshot' @@ -56,7 +57,8 @@ public AutomationSource() /// /// Gets or sets a valid event source type. Possible values include: - /// 'Assessments', 'SubAssessments', 'Alerts', 'SecureScores', + /// 'Assessments', 'AssessmentsSnapshot', 'SubAssessments', + /// 'SubAssessmentsSnapshot', 'Alerts', 'SecureScores', /// 'SecureScoresSnapshot', 'SecureScoreControls', /// 'SecureScoreControlsSnapshot', 'RegulatoryComplianceAssessment', /// 'RegulatoryComplianceAssessmentSnapshot' diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/CloudName.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/CloudName.cs new file mode 100644 index 000000000000..406bdca397a2 --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/CloudName.cs @@ -0,0 +1,23 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + + /// + /// Defines values for CloudName. + /// + public static class CloudName + { + public const string Azure = "Azure"; + public const string AWS = "AWS"; + public const string GCP = "GCP"; + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/CloudOffering.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/CloudOffering.cs new file mode 100644 index 000000000000..61f9eed172e0 --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/CloudOffering.cs @@ -0,0 +1,52 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + using Newtonsoft.Json; + using System.Linq; + + /// + /// The security offering details + /// + [Newtonsoft.Json.JsonObject("cloudOffering")] + public partial class CloudOffering + { + /// + /// Initializes a new instance of the CloudOffering class. + /// + public CloudOffering() + { + CustomInit(); + } + + /// + /// Initializes a new instance of the CloudOffering class. + /// + /// The offering description. + public CloudOffering(string description = default(string)) + { + Description = description; + CustomInit(); + } + + /// + /// An initialization method that performs custom operations like setting defaults + /// + partial void CustomInit(); + + /// + /// Gets the offering description. + /// + [JsonProperty(PropertyName = "description")] + public string Description { get; private set; } + + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/CspmMonitorAwsOffering.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/CspmMonitorAwsOffering.cs new file mode 100644 index 000000000000..3f8cec7ad26d --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/CspmMonitorAwsOffering.cs @@ -0,0 +1,55 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + using Newtonsoft.Json; + using System.Linq; + + /// + /// The CSPM monitoring for AWS offering configurations + /// + [Newtonsoft.Json.JsonObject("CspmMonitorAws")] + public partial class CspmMonitorAwsOffering : CloudOffering + { + /// + /// Initializes a new instance of the CspmMonitorAwsOffering class. + /// + public CspmMonitorAwsOffering() + { + CustomInit(); + } + + /// + /// Initializes a new instance of the CspmMonitorAwsOffering class. + /// + /// The offering description. + /// The native cloud connection + /// configuration + public CspmMonitorAwsOffering(string description = default(string), CspmMonitorAwsOfferingNativeCloudConnection nativeCloudConnection = default(CspmMonitorAwsOfferingNativeCloudConnection)) + : base(description) + { + NativeCloudConnection = nativeCloudConnection; + CustomInit(); + } + + /// + /// An initialization method that performs custom operations like setting defaults + /// + partial void CustomInit(); + + /// + /// Gets or sets the native cloud connection configuration + /// + [JsonProperty(PropertyName = "nativeCloudConnection")] + public CspmMonitorAwsOfferingNativeCloudConnection NativeCloudConnection { get; set; } + + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/CspmMonitorAwsOfferingNativeCloudConnection.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/CspmMonitorAwsOfferingNativeCloudConnection.cs new file mode 100644 index 000000000000..710796af0f02 --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/CspmMonitorAwsOfferingNativeCloudConnection.cs @@ -0,0 +1,54 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + using Newtonsoft.Json; + using System.Linq; + + /// + /// The native cloud connection configuration + /// + public partial class CspmMonitorAwsOfferingNativeCloudConnection + { + /// + /// Initializes a new instance of the + /// CspmMonitorAwsOfferingNativeCloudConnection class. + /// + public CspmMonitorAwsOfferingNativeCloudConnection() + { + CustomInit(); + } + + /// + /// Initializes a new instance of the + /// CspmMonitorAwsOfferingNativeCloudConnection class. + /// + /// The cloud role ARN in AWS for this + /// feature + public CspmMonitorAwsOfferingNativeCloudConnection(string cloudRoleArn = default(string)) + { + CloudRoleArn = cloudRoleArn; + CustomInit(); + } + + /// + /// An initialization method that performs custom operations like setting defaults + /// + partial void CustomInit(); + + /// + /// Gets or sets the cloud role ARN in AWS for this feature + /// + [JsonProperty(PropertyName = "cloudRoleArn")] + public string CloudRoleArn { get; set; } + + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/CustomAssessmentAutomation.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/CustomAssessmentAutomation.cs new file mode 100644 index 000000000000..99a623549639 --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/CustomAssessmentAutomation.cs @@ -0,0 +1,134 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + using Microsoft.Rest; + using Microsoft.Rest.Serialization; + using Newtonsoft.Json; + using System.Linq; + + /// + /// Custom Assessment Automation + /// + [Rest.Serialization.JsonTransformation] + public partial class CustomAssessmentAutomation : Resource + { + /// + /// Initializes a new instance of the CustomAssessmentAutomation class. + /// + public CustomAssessmentAutomation() + { + CustomInit(); + } + + /// + /// Initializes a new instance of the CustomAssessmentAutomation class. + /// + /// Resource Id + /// Resource name + /// Resource type + /// Azure Resource Manager metadata containing + /// createdBy and modifiedBy information. + /// GZip encoded KQL query representing + /// the assessment automation results required. + /// Relevant cloud for the custom + /// assessment automation. Possible values include: 'AWS', + /// 'GCP' + /// The severity to relate to the assessments + /// generated by this assessment automation. Possible values include: + /// 'High', 'Medium', 'Low' + /// The display name of the assessments + /// generated by this assessment automation. + /// The description to relate to the + /// assessments generated by this assessment automation. + /// The remediation description to + /// relate to the assessments generated by this assessment + /// automation. + /// The assessment metadata key used when + /// an assessment is generated for this assessment automation. + public CustomAssessmentAutomation(string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), string compressedQuery = default(string), string supportedCloud = default(string), string severity = default(string), string displayName = default(string), string description = default(string), string remediationDescription = default(string), string assessmentKey = default(string)) + : base(id, name, type) + { + SystemData = systemData; + CompressedQuery = compressedQuery; + SupportedCloud = supportedCloud; + Severity = severity; + DisplayName = displayName; + Description = description; + RemediationDescription = remediationDescription; + AssessmentKey = assessmentKey; + CustomInit(); + } + + /// + /// An initialization method that performs custom operations like setting defaults + /// + partial void CustomInit(); + + /// + /// Gets azure Resource Manager metadata containing createdBy and + /// modifiedBy information. + /// + [JsonProperty(PropertyName = "systemData")] + public SystemData SystemData { get; private set; } + + /// + /// Gets or sets gZip encoded KQL query representing the assessment + /// automation results required. + /// + [JsonProperty(PropertyName = "properties.compressedQuery")] + public string CompressedQuery { get; set; } + + /// + /// Gets or sets relevant cloud for the custom assessment automation. + /// Possible values include: 'AWS', 'GCP' + /// + [JsonProperty(PropertyName = "properties.supportedCloud")] + public string SupportedCloud { get; set; } + + /// + /// Gets or sets the severity to relate to the assessments generated by + /// this assessment automation. Possible values include: 'High', + /// 'Medium', 'Low' + /// + [JsonProperty(PropertyName = "properties.severity")] + public string Severity { get; set; } + + /// + /// Gets or sets the display name of the assessments generated by this + /// assessment automation. + /// + [JsonProperty(PropertyName = "properties.displayName")] + public string DisplayName { get; set; } + + /// + /// Gets or sets the description to relate to the assessments generated + /// by this assessment automation. + /// + [JsonProperty(PropertyName = "properties.description")] + public string Description { get; set; } + + /// + /// Gets or sets the remediation description to relate to the + /// assessments generated by this assessment automation. + /// + [JsonProperty(PropertyName = "properties.remediationDescription")] + public string RemediationDescription { get; set; } + + /// + /// Gets or sets the assessment metadata key used when an assessment is + /// generated for this assessment automation. + /// + [JsonProperty(PropertyName = "properties.assessmentKey")] + public string AssessmentKey { get; set; } + + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/CustomAssessmentAutomationRequest.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/CustomAssessmentAutomationRequest.cs new file mode 100644 index 000000000000..b6a13a810a10 --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/CustomAssessmentAutomationRequest.cs @@ -0,0 +1,116 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + using Microsoft.Rest; + using Microsoft.Rest.Serialization; + using Newtonsoft.Json; + using System.Linq; + + /// + /// Custom Assessment Automation request + /// + [Rest.Serialization.JsonTransformation] + public partial class CustomAssessmentAutomationRequest : Resource + { + /// + /// Initializes a new instance of the CustomAssessmentAutomationRequest + /// class. + /// + public CustomAssessmentAutomationRequest() + { + CustomInit(); + } + + /// + /// Initializes a new instance of the CustomAssessmentAutomationRequest + /// class. + /// + /// Resource Id + /// Resource name + /// Resource type + /// Base 64 encoded KQL query + /// representing the assessment automation results required. + /// Relevant cloud for the custom + /// assessment automation. Possible values include: 'AWS', + /// 'GCP' + /// The severity to relate to the assessments + /// generated by this assessment automation. Possible values include: + /// 'High', 'Medium', 'Low' + /// The display name of the assessments + /// generated by this assessment automation. + /// The description to relate to the + /// assessments generated by this assessment automation. + /// The remediation description to + /// relate to the assessments generated by this assessment + /// automation. + public CustomAssessmentAutomationRequest(string id = default(string), string name = default(string), string type = default(string), string compressedQuery = default(string), string supportedCloud = default(string), string severity = default(string), string displayName = default(string), string description = default(string), string remediationDescription = default(string)) + : base(id, name, type) + { + CompressedQuery = compressedQuery; + SupportedCloud = supportedCloud; + Severity = severity; + DisplayName = displayName; + Description = description; + RemediationDescription = remediationDescription; + CustomInit(); + } + + /// + /// An initialization method that performs custom operations like setting defaults + /// + partial void CustomInit(); + + /// + /// Gets or sets base 64 encoded KQL query representing the assessment + /// automation results required. + /// + [JsonProperty(PropertyName = "properties.compressedQuery")] + public string CompressedQuery { get; set; } + + /// + /// Gets or sets relevant cloud for the custom assessment automation. + /// Possible values include: 'AWS', 'GCP' + /// + [JsonProperty(PropertyName = "properties.supportedCloud")] + public string SupportedCloud { get; set; } + + /// + /// Gets or sets the severity to relate to the assessments generated by + /// this assessment automation. Possible values include: 'High', + /// 'Medium', 'Low' + /// + [JsonProperty(PropertyName = "properties.severity")] + public string Severity { get; set; } + + /// + /// Gets or sets the display name of the assessments generated by this + /// assessment automation. + /// + [JsonProperty(PropertyName = "properties.displayName")] + public string DisplayName { get; set; } + + /// + /// Gets or sets the description to relate to the assessments generated + /// by this assessment automation. + /// + [JsonProperty(PropertyName = "properties.description")] + public string Description { get; set; } + + /// + /// Gets or sets the remediation description to relate to the + /// assessments generated by this assessment automation. + /// + [JsonProperty(PropertyName = "properties.remediationDescription")] + public string RemediationDescription { get; set; } + + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/CustomEntityStoreAssignment.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/CustomEntityStoreAssignment.cs new file mode 100644 index 000000000000..fa1e2ff27620 --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/CustomEntityStoreAssignment.cs @@ -0,0 +1,82 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + using Microsoft.Rest; + using Microsoft.Rest.Serialization; + using Newtonsoft.Json; + using System.Linq; + + /// + /// Custom entity store assignment + /// + [Rest.Serialization.JsonTransformation] + public partial class CustomEntityStoreAssignment : Resource + { + /// + /// Initializes a new instance of the CustomEntityStoreAssignment + /// class. + /// + public CustomEntityStoreAssignment() + { + CustomInit(); + } + + /// + /// Initializes a new instance of the CustomEntityStoreAssignment + /// class. + /// + /// Resource Id + /// Resource name + /// Resource type + /// Azure Resource Manager metadata containing + /// createdBy and modifiedBy information. + /// The principal assigned with entity store. + /// Format of principal is: [AAD + /// type]=[PrincipalObjectId];[TenantId] + /// The link to entity store + /// database. + public CustomEntityStoreAssignment(string id = default(string), string name = default(string), string type = default(string), SystemData systemData = default(SystemData), string principal = default(string), string entityStoreDatabaseLink = default(string)) + : base(id, name, type) + { + SystemData = systemData; + Principal = principal; + EntityStoreDatabaseLink = entityStoreDatabaseLink; + CustomInit(); + } + + /// + /// An initialization method that performs custom operations like setting defaults + /// + partial void CustomInit(); + + /// + /// Gets azure Resource Manager metadata containing createdBy and + /// modifiedBy information. + /// + [JsonProperty(PropertyName = "systemData")] + public SystemData SystemData { get; private set; } + + /// + /// Gets or sets the principal assigned with entity store. Format of + /// principal is: [AAD type]=[PrincipalObjectId];[TenantId] + /// + [JsonProperty(PropertyName = "properties.principal")] + public string Principal { get; set; } + + /// + /// Gets or sets the link to entity store database. + /// + [JsonProperty(PropertyName = "properties.entityStoreDatabaseLink")] + public string EntityStoreDatabaseLink { get; set; } + + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/CustomEntityStoreAssignmentRequest.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/CustomEntityStoreAssignmentRequest.cs new file mode 100644 index 000000000000..ba4022d7b0b3 --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/CustomEntityStoreAssignmentRequest.cs @@ -0,0 +1,60 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + using Microsoft.Rest; + using Microsoft.Rest.Serialization; + using Newtonsoft.Json; + using System.Linq; + + /// + /// describes the custom entity store assignment request + /// + [Rest.Serialization.JsonTransformation] + public partial class CustomEntityStoreAssignmentRequest + { + /// + /// Initializes a new instance of the + /// CustomEntityStoreAssignmentRequest class. + /// + public CustomEntityStoreAssignmentRequest() + { + CustomInit(); + } + + /// + /// Initializes a new instance of the + /// CustomEntityStoreAssignmentRequest class. + /// + /// The principal assigned with entity store. + /// If not provided, will use caller principal. Format of principal is: + /// [AAD type]=[PrincipalObjectId];[TenantId] + public CustomEntityStoreAssignmentRequest(string principal = default(string)) + { + Principal = principal; + CustomInit(); + } + + /// + /// An initialization method that performs custom operations like setting defaults + /// + partial void CustomInit(); + + /// + /// Gets or sets the principal assigned with entity store. If not + /// provided, will use caller principal. Format of principal is: [AAD + /// type]=[PrincipalObjectId];[TenantId] + /// + [JsonProperty(PropertyName = "properties.principal")] + public string Principal { get; set; } + + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/DefenderForContainersAwsOffering.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/DefenderForContainersAwsOffering.cs new file mode 100644 index 000000000000..70e37cc0eda6 --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/DefenderForContainersAwsOffering.cs @@ -0,0 +1,84 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + using Newtonsoft.Json; + using System.Linq; + + /// + /// The Defender for Containers AWS offering configurations + /// + [Newtonsoft.Json.JsonObject("DefenderForContainersAws")] + public partial class DefenderForContainersAwsOffering : CloudOffering + { + /// + /// Initializes a new instance of the DefenderForContainersAwsOffering + /// class. + /// + public DefenderForContainersAwsOffering() + { + CustomInit(); + } + + /// + /// Initializes a new instance of the DefenderForContainersAwsOffering + /// class. + /// + /// The offering description. + /// The kubernetes service connection + /// configuration + /// The kubernetes to scuba + /// connection configuration + /// The cloudwatch to kinesis + /// connection configuration + /// The kinesis to s3 connection + /// configuration + public DefenderForContainersAwsOffering(string description = default(string), DefenderForContainersAwsOfferingKubernetesService kubernetesService = default(DefenderForContainersAwsOfferingKubernetesService), DefenderForContainersAwsOfferingKubernetesScubaReader kubernetesScubaReader = default(DefenderForContainersAwsOfferingKubernetesScubaReader), DefenderForContainersAwsOfferingCloudWatchToKinesis cloudWatchToKinesis = default(DefenderForContainersAwsOfferingCloudWatchToKinesis), DefenderForContainersAwsOfferingKinesisToS3 kinesisToS3 = default(DefenderForContainersAwsOfferingKinesisToS3)) + : base(description) + { + KubernetesService = kubernetesService; + KubernetesScubaReader = kubernetesScubaReader; + CloudWatchToKinesis = cloudWatchToKinesis; + KinesisToS3 = kinesisToS3; + CustomInit(); + } + + /// + /// An initialization method that performs custom operations like setting defaults + /// + partial void CustomInit(); + + /// + /// Gets or sets the kubernetes service connection configuration + /// + [JsonProperty(PropertyName = "kubernetesService")] + public DefenderForContainersAwsOfferingKubernetesService KubernetesService { get; set; } + + /// + /// Gets or sets the kubernetes to scuba connection configuration + /// + [JsonProperty(PropertyName = "kubernetesScubaReader")] + public DefenderForContainersAwsOfferingKubernetesScubaReader KubernetesScubaReader { get; set; } + + /// + /// Gets or sets the cloudwatch to kinesis connection configuration + /// + [JsonProperty(PropertyName = "cloudWatchToKinesis")] + public DefenderForContainersAwsOfferingCloudWatchToKinesis CloudWatchToKinesis { get; set; } + + /// + /// Gets or sets the kinesis to s3 connection configuration + /// + [JsonProperty(PropertyName = "kinesisToS3")] + public DefenderForContainersAwsOfferingKinesisToS3 KinesisToS3 { get; set; } + + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/DefenderForContainersAwsOfferingCloudWatchToKinesis.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/DefenderForContainersAwsOfferingCloudWatchToKinesis.cs new file mode 100644 index 000000000000..c8f35601623e --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/DefenderForContainersAwsOfferingCloudWatchToKinesis.cs @@ -0,0 +1,54 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + using Newtonsoft.Json; + using System.Linq; + + /// + /// The cloudwatch to kinesis connection configuration + /// + public partial class DefenderForContainersAwsOfferingCloudWatchToKinesis + { + /// + /// Initializes a new instance of the + /// DefenderForContainersAwsOfferingCloudWatchToKinesis class. + /// + public DefenderForContainersAwsOfferingCloudWatchToKinesis() + { + CustomInit(); + } + + /// + /// Initializes a new instance of the + /// DefenderForContainersAwsOfferingCloudWatchToKinesis class. + /// + /// The cloud role ARN in AWS for this + /// feature + public DefenderForContainersAwsOfferingCloudWatchToKinesis(string cloudRoleArn = default(string)) + { + CloudRoleArn = cloudRoleArn; + CustomInit(); + } + + /// + /// An initialization method that performs custom operations like setting defaults + /// + partial void CustomInit(); + + /// + /// Gets or sets the cloud role ARN in AWS for this feature + /// + [JsonProperty(PropertyName = "cloudRoleArn")] + public string CloudRoleArn { get; set; } + + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/DefenderForContainersAwsOfferingKinesisToS3.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/DefenderForContainersAwsOfferingKinesisToS3.cs new file mode 100644 index 000000000000..8f175a6e5813 --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/DefenderForContainersAwsOfferingKinesisToS3.cs @@ -0,0 +1,54 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + using Newtonsoft.Json; + using System.Linq; + + /// + /// The kinesis to s3 connection configuration + /// + public partial class DefenderForContainersAwsOfferingKinesisToS3 + { + /// + /// Initializes a new instance of the + /// DefenderForContainersAwsOfferingKinesisToS3 class. + /// + public DefenderForContainersAwsOfferingKinesisToS3() + { + CustomInit(); + } + + /// + /// Initializes a new instance of the + /// DefenderForContainersAwsOfferingKinesisToS3 class. + /// + /// The cloud role ARN in AWS for this + /// feature + public DefenderForContainersAwsOfferingKinesisToS3(string cloudRoleArn = default(string)) + { + CloudRoleArn = cloudRoleArn; + CustomInit(); + } + + /// + /// An initialization method that performs custom operations like setting defaults + /// + partial void CustomInit(); + + /// + /// Gets or sets the cloud role ARN in AWS for this feature + /// + [JsonProperty(PropertyName = "cloudRoleArn")] + public string CloudRoleArn { get; set; } + + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/DefenderForContainersAwsOfferingKubernetesScubaReader.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/DefenderForContainersAwsOfferingKubernetesScubaReader.cs new file mode 100644 index 000000000000..3147808e3729 --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/DefenderForContainersAwsOfferingKubernetesScubaReader.cs @@ -0,0 +1,54 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + using Newtonsoft.Json; + using System.Linq; + + /// + /// The kubernetes to scuba connection configuration + /// + public partial class DefenderForContainersAwsOfferingKubernetesScubaReader + { + /// + /// Initializes a new instance of the + /// DefenderForContainersAwsOfferingKubernetesScubaReader class. + /// + public DefenderForContainersAwsOfferingKubernetesScubaReader() + { + CustomInit(); + } + + /// + /// Initializes a new instance of the + /// DefenderForContainersAwsOfferingKubernetesScubaReader class. + /// + /// The cloud role ARN in AWS for this + /// feature + public DefenderForContainersAwsOfferingKubernetesScubaReader(string cloudRoleArn = default(string)) + { + CloudRoleArn = cloudRoleArn; + CustomInit(); + } + + /// + /// An initialization method that performs custom operations like setting defaults + /// + partial void CustomInit(); + + /// + /// Gets or sets the cloud role ARN in AWS for this feature + /// + [JsonProperty(PropertyName = "cloudRoleArn")] + public string CloudRoleArn { get; set; } + + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/DefenderForContainersAwsOfferingKubernetesService.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/DefenderForContainersAwsOfferingKubernetesService.cs new file mode 100644 index 000000000000..6c26874714eb --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/DefenderForContainersAwsOfferingKubernetesService.cs @@ -0,0 +1,54 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + using Newtonsoft.Json; + using System.Linq; + + /// + /// The kubernetes service connection configuration + /// + public partial class DefenderForContainersAwsOfferingKubernetesService + { + /// + /// Initializes a new instance of the + /// DefenderForContainersAwsOfferingKubernetesService class. + /// + public DefenderForContainersAwsOfferingKubernetesService() + { + CustomInit(); + } + + /// + /// Initializes a new instance of the + /// DefenderForContainersAwsOfferingKubernetesService class. + /// + /// The cloud role ARN in AWS for this + /// feature + public DefenderForContainersAwsOfferingKubernetesService(string cloudRoleArn = default(string)) + { + CloudRoleArn = cloudRoleArn; + CustomInit(); + } + + /// + /// An initialization method that performs custom operations like setting defaults + /// + partial void CustomInit(); + + /// + /// Gets or sets the cloud role ARN in AWS for this feature + /// + [JsonProperty(PropertyName = "cloudRoleArn")] + public string CloudRoleArn { get; set; } + + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/DefenderForServersAwsOffering.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/DefenderForServersAwsOffering.cs new file mode 100644 index 000000000000..fc83aa2663ca --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/DefenderForServersAwsOffering.cs @@ -0,0 +1,66 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + using Newtonsoft.Json; + using System.Linq; + + /// + /// The Defender for Servers AWS offering configurations + /// + [Newtonsoft.Json.JsonObject("DefenderForServersAws")] + public partial class DefenderForServersAwsOffering : CloudOffering + { + /// + /// Initializes a new instance of the DefenderForServersAwsOffering + /// class. + /// + public DefenderForServersAwsOffering() + { + CustomInit(); + } + + /// + /// Initializes a new instance of the DefenderForServersAwsOffering + /// class. + /// + /// The offering description. + /// The Defender for servers + /// connection configuration + /// The ARC autoprovisioning + /// configuration + public DefenderForServersAwsOffering(string description = default(string), DefenderForServersAwsOfferingDefenderForServers defenderForServers = default(DefenderForServersAwsOfferingDefenderForServers), DefenderForServersAwsOfferingArcAutoProvisioning arcAutoProvisioning = default(DefenderForServersAwsOfferingArcAutoProvisioning)) + : base(description) + { + DefenderForServers = defenderForServers; + ArcAutoProvisioning = arcAutoProvisioning; + CustomInit(); + } + + /// + /// An initialization method that performs custom operations like setting defaults + /// + partial void CustomInit(); + + /// + /// Gets or sets the Defender for servers connection configuration + /// + [JsonProperty(PropertyName = "defenderForServers")] + public DefenderForServersAwsOfferingDefenderForServers DefenderForServers { get; set; } + + /// + /// Gets or sets the ARC autoprovisioning configuration + /// + [JsonProperty(PropertyName = "arcAutoProvisioning")] + public DefenderForServersAwsOfferingArcAutoProvisioning ArcAutoProvisioning { get; set; } + + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/DefenderForServersAwsOfferingArcAutoProvisioning.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/DefenderForServersAwsOfferingArcAutoProvisioning.cs new file mode 100644 index 000000000000..335b30a7807c --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/DefenderForServersAwsOfferingArcAutoProvisioning.cs @@ -0,0 +1,63 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + using Newtonsoft.Json; + using System.Linq; + + /// + /// The ARC autoprovisioning configuration + /// + public partial class DefenderForServersAwsOfferingArcAutoProvisioning + { + /// + /// Initializes a new instance of the + /// DefenderForServersAwsOfferingArcAutoProvisioning class. + /// + public DefenderForServersAwsOfferingArcAutoProvisioning() + { + CustomInit(); + } + + /// + /// Initializes a new instance of the + /// DefenderForServersAwsOfferingArcAutoProvisioning class. + /// + /// Is arc auto provisioning enabled + /// Metadata of Service + /// Principal secret for autoprovisioning + public DefenderForServersAwsOfferingArcAutoProvisioning(bool? enabled = default(bool?), DefenderForServersAwsOfferingArcAutoProvisioningServicePrincipalSecretMetadata servicePrincipalSecretMetadata = default(DefenderForServersAwsOfferingArcAutoProvisioningServicePrincipalSecretMetadata)) + { + Enabled = enabled; + ServicePrincipalSecretMetadata = servicePrincipalSecretMetadata; + CustomInit(); + } + + /// + /// An initialization method that performs custom operations like setting defaults + /// + partial void CustomInit(); + + /// + /// Gets or sets is arc auto provisioning enabled + /// + [JsonProperty(PropertyName = "enabled")] + public bool? Enabled { get; set; } + + /// + /// Gets or sets metadata of Service Principal secret for + /// autoprovisioning + /// + [JsonProperty(PropertyName = "servicePrincipalSecretMetadata")] + public DefenderForServersAwsOfferingArcAutoProvisioningServicePrincipalSecretMetadata ServicePrincipalSecretMetadata { get; set; } + + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/DefenderForServersAwsOfferingArcAutoProvisioningServicePrincipalSecretMetadata.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/DefenderForServersAwsOfferingArcAutoProvisioningServicePrincipalSecretMetadata.cs new file mode 100644 index 000000000000..b9694c798ae3 --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/DefenderForServersAwsOfferingArcAutoProvisioningServicePrincipalSecretMetadata.cs @@ -0,0 +1,74 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + using Newtonsoft.Json; + using System.Linq; + + /// + /// Metadata of Service Principal secret for autoprovisioning + /// + public partial class DefenderForServersAwsOfferingArcAutoProvisioningServicePrincipalSecretMetadata + { + /// + /// Initializes a new instance of the + /// DefenderForServersAwsOfferingArcAutoProvisioningServicePrincipalSecretMetadata + /// class. + /// + public DefenderForServersAwsOfferingArcAutoProvisioningServicePrincipalSecretMetadata() + { + CustomInit(); + } + + /// + /// Initializes a new instance of the + /// DefenderForServersAwsOfferingArcAutoProvisioningServicePrincipalSecretMetadata + /// class. + /// + /// expiration date of service principal + /// secret + /// region of parameter store where + /// secret is kept + /// name of secret resource in + /// parameter store + public DefenderForServersAwsOfferingArcAutoProvisioningServicePrincipalSecretMetadata(string expiryDate = default(string), string parameterStoreRegion = default(string), string parameterNameInStore = default(string)) + { + ExpiryDate = expiryDate; + ParameterStoreRegion = parameterStoreRegion; + ParameterNameInStore = parameterNameInStore; + CustomInit(); + } + + /// + /// An initialization method that performs custom operations like setting defaults + /// + partial void CustomInit(); + + /// + /// Gets or sets expiration date of service principal secret + /// + [JsonProperty(PropertyName = "expiryDate")] + public string ExpiryDate { get; set; } + + /// + /// Gets or sets region of parameter store where secret is kept + /// + [JsonProperty(PropertyName = "parameterStoreRegion")] + public string ParameterStoreRegion { get; set; } + + /// + /// Gets or sets name of secret resource in parameter store + /// + [JsonProperty(PropertyName = "parameterNameInStore")] + public string ParameterNameInStore { get; set; } + + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/DefenderForServersAwsOfferingDefenderForServers.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/DefenderForServersAwsOfferingDefenderForServers.cs new file mode 100644 index 000000000000..8e39b34fd800 --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/DefenderForServersAwsOfferingDefenderForServers.cs @@ -0,0 +1,54 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + using Newtonsoft.Json; + using System.Linq; + + /// + /// The Defender for servers connection configuration + /// + public partial class DefenderForServersAwsOfferingDefenderForServers + { + /// + /// Initializes a new instance of the + /// DefenderForServersAwsOfferingDefenderForServers class. + /// + public DefenderForServersAwsOfferingDefenderForServers() + { + CustomInit(); + } + + /// + /// Initializes a new instance of the + /// DefenderForServersAwsOfferingDefenderForServers class. + /// + /// The cloud role ARN in AWS for this + /// feature + public DefenderForServersAwsOfferingDefenderForServers(string cloudRoleArn = default(string)) + { + CloudRoleArn = cloudRoleArn; + CustomInit(); + } + + /// + /// An initialization method that performs custom operations like setting defaults + /// + partial void CustomInit(); + + /// + /// Gets or sets the cloud role ARN in AWS for this feature + /// + [JsonProperty(PropertyName = "cloudRoleArn")] + public string CloudRoleArn { get; set; } + + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/EventSource.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/EventSource.cs index 78f7630e6c2e..e90fe1ebe454 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/EventSource.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/EventSource.cs @@ -17,7 +17,9 @@ namespace Microsoft.Azure.Management.Security.Models public static class EventSource { public const string Assessments = "Assessments"; + public const string AssessmentsSnapshot = "AssessmentsSnapshot"; public const string SubAssessments = "SubAssessments"; + public const string SubAssessmentsSnapshot = "SubAssessmentsSnapshot"; public const string Alerts = "Alerts"; public const string SecureScores = "SecureScores"; public const string SecureScoresSnapshot = "SecureScoresSnapshot"; diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/InformationProtectionAwsOffering.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/InformationProtectionAwsOffering.cs new file mode 100644 index 000000000000..10aa8bf51c32 --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/InformationProtectionAwsOffering.cs @@ -0,0 +1,57 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + using Newtonsoft.Json; + using System.Linq; + + /// + /// The information protection for AWS offering configurations + /// + [Newtonsoft.Json.JsonObject("InformationProtectionAws")] + public partial class InformationProtectionAwsOffering : CloudOffering + { + /// + /// Initializes a new instance of the InformationProtectionAwsOffering + /// class. + /// + public InformationProtectionAwsOffering() + { + CustomInit(); + } + + /// + /// Initializes a new instance of the InformationProtectionAwsOffering + /// class. + /// + /// The offering description. + /// The native cloud connection + /// configuration + public InformationProtectionAwsOffering(string description = default(string), InformationProtectionAwsOfferingInformationProtection informationProtection = default(InformationProtectionAwsOfferingInformationProtection)) + : base(description) + { + InformationProtection = informationProtection; + CustomInit(); + } + + /// + /// An initialization method that performs custom operations like setting defaults + /// + partial void CustomInit(); + + /// + /// Gets or sets the native cloud connection configuration + /// + [JsonProperty(PropertyName = "informationProtection")] + public InformationProtectionAwsOfferingInformationProtection InformationProtection { get; set; } + + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/InformationProtectionAwsOfferingInformationProtection.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/InformationProtectionAwsOfferingInformationProtection.cs new file mode 100644 index 000000000000..d2868f0f3374 --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/InformationProtectionAwsOfferingInformationProtection.cs @@ -0,0 +1,54 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + using Newtonsoft.Json; + using System.Linq; + + /// + /// The native cloud connection configuration + /// + public partial class InformationProtectionAwsOfferingInformationProtection + { + /// + /// Initializes a new instance of the + /// InformationProtectionAwsOfferingInformationProtection class. + /// + public InformationProtectionAwsOfferingInformationProtection() + { + CustomInit(); + } + + /// + /// Initializes a new instance of the + /// InformationProtectionAwsOfferingInformationProtection class. + /// + /// The cloud role ARN in AWS for this + /// feature + public InformationProtectionAwsOfferingInformationProtection(string cloudRoleArn = default(string)) + { + CloudRoleArn = cloudRoleArn; + CustomInit(); + } + + /// + /// An initialization method that performs custom operations like setting defaults + /// + partial void CustomInit(); + + /// + /// Gets or sets the cloud role ARN in AWS for this feature + /// + [JsonProperty(PropertyName = "cloudRoleArn")] + public string CloudRoleArn { get; set; } + + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/InformationProtectionPolicyName.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/InformationProtectionPolicyName.cs new file mode 100644 index 000000000000..980ac3f12ba9 --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/InformationProtectionPolicyName.cs @@ -0,0 +1,22 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + + /// + /// Defines values for InformationProtectionPolicyName. + /// + public static class InformationProtectionPolicyName + { + public const string Effective = "effective"; + public const string Custom = "custom"; + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/MdeOnboardingData.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/MdeOnboardingData.cs new file mode 100644 index 000000000000..4ac0a8e3c861 --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/MdeOnboardingData.cs @@ -0,0 +1,75 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + using Microsoft.Rest; + using Microsoft.Rest.Serialization; + using Newtonsoft.Json; + using System.Linq; + + /// + /// The resource of the configuration or data needed to onboard the machine + /// to MDE + /// + [Rest.Serialization.JsonTransformation] + public partial class MdeOnboardingData : Resource + { + /// + /// Initializes a new instance of the MdeOnboardingData class. + /// + public MdeOnboardingData() + { + CustomInit(); + } + + /// + /// Initializes a new instance of the MdeOnboardingData class. + /// + /// Resource Id + /// Resource name + /// Resource type + /// The onboarding package used + /// to onboard Windows machines to MDE, coded in base64. This can also + /// be used for onboarding using the dedicated VM Extension + /// The onboarding package used to + /// onboard Linux machines to MDE, coded in base64. This can also be + /// used for onboarding using the dedicated VM Extension + public MdeOnboardingData(string id = default(string), string name = default(string), string type = default(string), byte[] onboardingPackageWindows = default(byte[]), byte[] onboardingPackageLinux = default(byte[])) + : base(id, name, type) + { + OnboardingPackageWindows = onboardingPackageWindows; + OnboardingPackageLinux = onboardingPackageLinux; + CustomInit(); + } + + /// + /// An initialization method that performs custom operations like setting defaults + /// + partial void CustomInit(); + + /// + /// Gets or sets the onboarding package used to onboard Windows + /// machines to MDE, coded in base64. This can also be used for + /// onboarding using the dedicated VM Extension + /// + [JsonProperty(PropertyName = "properties.onboardingPackageWindows")] + public byte[] OnboardingPackageWindows { get; set; } + + /// + /// Gets or sets the onboarding package used to onboard Linux machines + /// to MDE, coded in base64. This can also be used for onboarding using + /// the dedicated VM Extension + /// + [JsonProperty(PropertyName = "properties.onboardingPackageLinux")] + public byte[] OnboardingPackageLinux { get; set; } + + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/MdeOnboardingDataList.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/MdeOnboardingDataList.cs new file mode 100644 index 000000000000..8df1ce7278aa --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/MdeOnboardingDataList.cs @@ -0,0 +1,55 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + using Newtonsoft.Json; + using System.Collections; + using System.Collections.Generic; + using System.Linq; + + /// + /// List of all MDE onboarding data resources + /// + public partial class MdeOnboardingDataList + { + /// + /// Initializes a new instance of the MdeOnboardingDataList class. + /// + public MdeOnboardingDataList() + { + CustomInit(); + } + + /// + /// Initializes a new instance of the MdeOnboardingDataList class. + /// + /// List of the resources of the configuration or + /// data needed to onboard the machine to MDE + public MdeOnboardingDataList(IList value = default(IList)) + { + Value = value; + CustomInit(); + } + + /// + /// An initialization method that performs custom operations like setting defaults + /// + partial void CustomInit(); + + /// + /// Gets or sets list of the resources of the configuration or data + /// needed to onboard the machine to MDE + /// + [JsonProperty(PropertyName = "value")] + public IList Value { get; set; } + + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/OrganizationMembershipType.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/OrganizationMembershipType.cs new file mode 100644 index 000000000000..4676ab9a2f8f --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/OrganizationMembershipType.cs @@ -0,0 +1,22 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + + /// + /// Defines values for OrganizationMembershipType. + /// + public static class OrganizationMembershipType + { + public const string Member = "Member"; + public const string Organization = "Organization"; + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/Pricing.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/Pricing.cs index 145fa72a76b7..f81bf3647b16 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/Pricing.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/Pricing.cs @@ -44,13 +44,18 @@ public Pricing() /// Resource Id /// Resource name /// Resource type + /// The sub-plan selected for a Standard pricing + /// configuration, when more than one sub-plan is available. Each + /// sub-plan enables a set of security features. When not specified, + /// full plan is applied. /// The duration left for the /// subscriptions free trial period - in ISO 8601 format (e.g. /// P3Y6M4DT12H30M5S). - public Pricing(string pricingTier, string id = default(string), string name = default(string), string type = default(string), System.TimeSpan? freeTrialRemainingTime = default(System.TimeSpan?)) + public Pricing(string pricingTier, string id = default(string), string name = default(string), string type = default(string), string subPlan = default(string), System.TimeSpan? freeTrialRemainingTime = default(System.TimeSpan?)) : base(id, name, type) { PricingTier = pricingTier; + SubPlan = subPlan; FreeTrialRemainingTime = freeTrialRemainingTime; CustomInit(); } @@ -70,6 +75,15 @@ public Pricing() [JsonProperty(PropertyName = "properties.pricingTier")] public string PricingTier { get; set; } + /// + /// Gets or sets the sub-plan selected for a Standard pricing + /// configuration, when more than one sub-plan is available. Each + /// sub-plan enables a set of security features. When not specified, + /// full plan is applied. + /// + [JsonProperty(PropertyName = "properties.subPlan")] + public string SubPlan { get; set; } + /// /// Gets the duration left for the subscriptions free trial period - in /// ISO 8601 format (e.g. P3Y6M4DT12H30M5S). diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SecurityAssessment.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SecurityAssessment.cs index 2b4a650f6330..03c06c51b147 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SecurityAssessment.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SecurityAssessment.cs @@ -46,11 +46,11 @@ public SecurityAssessment() { ResourceDetails = resourceDetails; DisplayName = displayName; - Status = status; AdditionalData = additionalData; Links = links; Metadata = metadata; PartnersData = partnersData; + Status = status; CustomInit(); } @@ -70,11 +70,6 @@ public SecurityAssessment() [JsonProperty(PropertyName = "properties.displayName")] public string DisplayName { get; private set; } - /// - /// - [JsonProperty(PropertyName = "properties.status")] - public AssessmentStatus Status { get; set; } - /// /// Gets or sets additional data regarding the assessment /// @@ -96,6 +91,11 @@ public SecurityAssessment() [JsonProperty(PropertyName = "properties.partnersData")] public SecurityAssessmentPartnerData PartnersData { get; set; } + /// + /// + [JsonProperty(PropertyName = "properties.status")] + public AssessmentStatus Status { get; set; } + /// /// Validate the object. /// @@ -112,10 +112,6 @@ public virtual void Validate() { throw new ValidationException(ValidationRules.CannotBeNull, "Status"); } - if (Status != null) - { - Status.Validate(); - } if (Metadata != null) { Metadata.Validate(); @@ -124,6 +120,10 @@ public virtual void Validate() { PartnersData.Validate(); } + if (Status != null) + { + Status.Validate(); + } } } } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SecurityAssessmentMetadataPropertiesResponsePublishDates.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SecurityAssessmentMetadataPropertiesResponsePublishDates.cs new file mode 100644 index 000000000000..aeadb7deed5d --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SecurityAssessmentMetadataPropertiesResponsePublishDates.cs @@ -0,0 +1,82 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + using Microsoft.Rest; + using Newtonsoft.Json; + using System.Linq; + + public partial class SecurityAssessmentMetadataPropertiesResponsePublishDates + { + /// + /// Initializes a new instance of the + /// SecurityAssessmentMetadataPropertiesResponsePublishDates class. + /// + public SecurityAssessmentMetadataPropertiesResponsePublishDates() + { + CustomInit(); + } + + /// + /// Initializes a new instance of the + /// SecurityAssessmentMetadataPropertiesResponsePublishDates class. + /// + public SecurityAssessmentMetadataPropertiesResponsePublishDates(string publicProperty, string ga = default(string)) + { + GA = ga; + PublicProperty = publicProperty; + CustomInit(); + } + + /// + /// An initialization method that performs custom operations like setting defaults + /// + partial void CustomInit(); + + /// + /// + [JsonProperty(PropertyName = "GA")] + public string GA { get; set; } + + /// + /// + [JsonProperty(PropertyName = "public")] + public string PublicProperty { get; set; } + + /// + /// Validate the object. + /// + /// + /// Thrown if validation fails + /// + public virtual void Validate() + { + if (PublicProperty == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "PublicProperty"); + } + if (GA != null) + { + if (!System.Text.RegularExpressions.Regex.IsMatch(GA, "^([0-9]{2}/){2}[0-9]{4}$")) + { + throw new ValidationException(ValidationRules.Pattern, "GA", "^([0-9]{2}/){2}[0-9]{4}$"); + } + } + if (PublicProperty != null) + { + if (!System.Text.RegularExpressions.Regex.IsMatch(PublicProperty, "^([0-9]{2}/){2}[0-9]{4}$")) + { + throw new ValidationException(ValidationRules.Pattern, "PublicProperty", "^([0-9]{2}/){2}[0-9]{4}$"); + } + } + } + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SecurityAssessmentMetadataResponse.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SecurityAssessmentMetadataResponse.cs new file mode 100644 index 000000000000..3f4914690ea7 --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SecurityAssessmentMetadataResponse.cs @@ -0,0 +1,224 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + using Microsoft.Rest; + using Microsoft.Rest.Serialization; + using Newtonsoft.Json; + using System.Collections; + using System.Collections.Generic; + using System.Linq; + + /// + /// Security assessment metadata response + /// + [Rest.Serialization.JsonTransformation] + public partial class SecurityAssessmentMetadataResponse : Resource + { + /// + /// Initializes a new instance of the + /// SecurityAssessmentMetadataResponse class. + /// + public SecurityAssessmentMetadataResponse() + { + CustomInit(); + } + + /// + /// Initializes a new instance of the + /// SecurityAssessmentMetadataResponse class. + /// + /// User friendly display name of the + /// assessment + /// The severity level of the assessment. + /// Possible values include: 'Low', 'Medium', 'High' + /// BuiltIn if the assessment based on + /// built-in Azure Policy definition, Custom if the assessment based on + /// custom Azure Policy definition. Possible values include: 'BuiltIn', + /// 'CustomPolicy', 'CustomerManaged', 'VerifiedPartner' + /// Resource Id + /// Resource name + /// Resource type + /// Azure resource ID of the policy + /// definition that turns this assessment calculation on + /// Human readable description of the + /// assessment + /// Human readable description of + /// what you should do to mitigate this security issue + /// The user impact of the assessment. + /// Possible values include: 'Low', 'Moderate', 'High' + /// The implementation effort + /// required to remediate this assessment. Possible values include: + /// 'Low', 'Moderate', 'High' + /// True if this assessment is in preview release + /// status + public SecurityAssessmentMetadataResponse(string displayName, string severity, string assessmentType, string id = default(string), string name = default(string), string type = default(string), string policyDefinitionId = default(string), string description = default(string), string remediationDescription = default(string), IList categories = default(IList), string userImpact = default(string), string implementationEffort = default(string), IList threats = default(IList), bool? preview = default(bool?), SecurityAssessmentMetadataPartnerData partnerData = default(SecurityAssessmentMetadataPartnerData), SecurityAssessmentMetadataPropertiesResponsePublishDates publishDates = default(SecurityAssessmentMetadataPropertiesResponsePublishDates), string plannedDeprecationDate = default(string), IList tactics = default(IList), IList techniques = default(IList)) + : base(id, name, type) + { + DisplayName = displayName; + PolicyDefinitionId = policyDefinitionId; + Description = description; + RemediationDescription = remediationDescription; + Categories = categories; + Severity = severity; + UserImpact = userImpact; + ImplementationEffort = implementationEffort; + Threats = threats; + Preview = preview; + AssessmentType = assessmentType; + PartnerData = partnerData; + PublishDates = publishDates; + PlannedDeprecationDate = plannedDeprecationDate; + Tactics = tactics; + Techniques = techniques; + CustomInit(); + } + + /// + /// An initialization method that performs custom operations like setting defaults + /// + partial void CustomInit(); + + /// + /// Gets or sets user friendly display name of the assessment + /// + [JsonProperty(PropertyName = "properties.displayName")] + public string DisplayName { get; set; } + + /// + /// Gets azure resource ID of the policy definition that turns this + /// assessment calculation on + /// + [JsonProperty(PropertyName = "properties.policyDefinitionId")] + public string PolicyDefinitionId { get; private set; } + + /// + /// Gets or sets human readable description of the assessment + /// + [JsonProperty(PropertyName = "properties.description")] + public string Description { get; set; } + + /// + /// Gets or sets human readable description of what you should do to + /// mitigate this security issue + /// + [JsonProperty(PropertyName = "properties.remediationDescription")] + public string RemediationDescription { get; set; } + + /// + /// + [JsonProperty(PropertyName = "properties.categories")] + public IList Categories { get; set; } + + /// + /// Gets or sets the severity level of the assessment. Possible values + /// include: 'Low', 'Medium', 'High' + /// + [JsonProperty(PropertyName = "properties.severity")] + public string Severity { get; set; } + + /// + /// Gets or sets the user impact of the assessment. Possible values + /// include: 'Low', 'Moderate', 'High' + /// + [JsonProperty(PropertyName = "properties.userImpact")] + public string UserImpact { get; set; } + + /// + /// Gets or sets the implementation effort required to remediate this + /// assessment. Possible values include: 'Low', 'Moderate', 'High' + /// + [JsonProperty(PropertyName = "properties.implementationEffort")] + public string ImplementationEffort { get; set; } + + /// + /// + [JsonProperty(PropertyName = "properties.threats")] + public IList Threats { get; set; } + + /// + /// Gets or sets true if this assessment is in preview release status + /// + [JsonProperty(PropertyName = "properties.preview")] + public bool? Preview { get; set; } + + /// + /// Gets or sets builtIn if the assessment based on built-in Azure + /// Policy definition, Custom if the assessment based on custom Azure + /// Policy definition. Possible values include: 'BuiltIn', + /// 'CustomPolicy', 'CustomerManaged', 'VerifiedPartner' + /// + [JsonProperty(PropertyName = "properties.assessmentType")] + public string AssessmentType { get; set; } + + /// + /// + [JsonProperty(PropertyName = "properties.partnerData")] + public SecurityAssessmentMetadataPartnerData PartnerData { get; set; } + + /// + /// + [JsonProperty(PropertyName = "properties.publishDates")] + public SecurityAssessmentMetadataPropertiesResponsePublishDates PublishDates { get; set; } + + /// + /// + [JsonProperty(PropertyName = "properties.plannedDeprecationDate")] + public string PlannedDeprecationDate { get; set; } + + /// + /// + [JsonProperty(PropertyName = "properties.tactics")] + public IList Tactics { get; set; } + + /// + /// + [JsonProperty(PropertyName = "properties.techniques")] + public IList Techniques { get; set; } + + /// + /// Validate the object. + /// + /// + /// Thrown if validation fails + /// + public virtual void Validate() + { + if (DisplayName == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "DisplayName"); + } + if (Severity == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "Severity"); + } + if (AssessmentType == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "AssessmentType"); + } + if (PartnerData != null) + { + PartnerData.Validate(); + } + if (PublishDates != null) + { + PublishDates.Validate(); + } + if (PlannedDeprecationDate != null) + { + if (!System.Text.RegularExpressions.Regex.IsMatch(PlannedDeprecationDate, "^[0-9]{2}/[0-9]{4}$")) + { + throw new ValidationException(ValidationRules.Pattern, "PlannedDeprecationDate", "^[0-9]{2}/[0-9]{4}$"); + } + } + } + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SecurityAssessmentPropertiesBase.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SecurityAssessmentPropertiesBase.cs new file mode 100644 index 000000000000..b427a560b47d --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SecurityAssessmentPropertiesBase.cs @@ -0,0 +1,111 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + using Microsoft.Rest; + using Newtonsoft.Json; + using System.Collections; + using System.Collections.Generic; + using System.Linq; + + /// + /// Describes properties of an assessment. + /// + public partial class SecurityAssessmentPropertiesBase + { + /// + /// Initializes a new instance of the SecurityAssessmentPropertiesBase + /// class. + /// + public SecurityAssessmentPropertiesBase() + { + CustomInit(); + } + + /// + /// Initializes a new instance of the SecurityAssessmentPropertiesBase + /// class. + /// + /// User friendly display name of the + /// assessment + /// Additional data regarding the + /// assessment + public SecurityAssessmentPropertiesBase(ResourceDetails resourceDetails, string displayName = default(string), IDictionary additionalData = default(IDictionary), AssessmentLinks links = default(AssessmentLinks), SecurityAssessmentMetadataProperties metadata = default(SecurityAssessmentMetadataProperties), SecurityAssessmentPartnerData partnersData = default(SecurityAssessmentPartnerData)) + { + ResourceDetails = resourceDetails; + DisplayName = displayName; + AdditionalData = additionalData; + Links = links; + Metadata = metadata; + PartnersData = partnersData; + CustomInit(); + } + + /// + /// An initialization method that performs custom operations like setting defaults + /// + partial void CustomInit(); + + /// + /// + [JsonProperty(PropertyName = "resourceDetails")] + public ResourceDetails ResourceDetails { get; set; } + + /// + /// Gets user friendly display name of the assessment + /// + [JsonProperty(PropertyName = "displayName")] + public string DisplayName { get; private set; } + + /// + /// Gets or sets additional data regarding the assessment + /// + [JsonProperty(PropertyName = "additionalData")] + public IDictionary AdditionalData { get; set; } + + /// + /// + [JsonProperty(PropertyName = "links")] + public AssessmentLinks Links { get; set; } + + /// + /// + [JsonProperty(PropertyName = "metadata")] + public SecurityAssessmentMetadataProperties Metadata { get; set; } + + /// + /// + [JsonProperty(PropertyName = "partnersData")] + public SecurityAssessmentPartnerData PartnersData { get; set; } + + /// + /// Validate the object. + /// + /// + /// Thrown if validation fails + /// + public virtual void Validate() + { + if (ResourceDetails == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "ResourceDetails"); + } + if (Metadata != null) + { + Metadata.Validate(); + } + if (PartnersData != null) + { + PartnersData.Validate(); + } + } + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SecurityAssessmentResponse.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SecurityAssessmentResponse.cs new file mode 100644 index 000000000000..9b440803bb42 --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SecurityAssessmentResponse.cs @@ -0,0 +1,129 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + using Microsoft.Rest; + using Microsoft.Rest.Serialization; + using Newtonsoft.Json; + using System.Collections; + using System.Collections.Generic; + using System.Linq; + + /// + /// Security assessment on a resource - response format + /// + [Rest.Serialization.JsonTransformation] + public partial class SecurityAssessmentResponse : Resource + { + /// + /// Initializes a new instance of the SecurityAssessmentResponse class. + /// + public SecurityAssessmentResponse() + { + CustomInit(); + } + + /// + /// Initializes a new instance of the SecurityAssessmentResponse class. + /// + /// Resource Id + /// Resource name + /// Resource type + /// User friendly display name of the + /// assessment + /// Additional data regarding the + /// assessment + public SecurityAssessmentResponse(ResourceDetails resourceDetails, AssessmentStatusResponse status, string id = default(string), string name = default(string), string type = default(string), string displayName = default(string), IDictionary additionalData = default(IDictionary), AssessmentLinks links = default(AssessmentLinks), SecurityAssessmentMetadataProperties metadata = default(SecurityAssessmentMetadataProperties), SecurityAssessmentPartnerData partnersData = default(SecurityAssessmentPartnerData)) + : base(id, name, type) + { + ResourceDetails = resourceDetails; + DisplayName = displayName; + AdditionalData = additionalData; + Links = links; + Metadata = metadata; + PartnersData = partnersData; + Status = status; + CustomInit(); + } + + /// + /// An initialization method that performs custom operations like setting defaults + /// + partial void CustomInit(); + + /// + /// + [JsonProperty(PropertyName = "properties.resourceDetails")] + public ResourceDetails ResourceDetails { get; set; } + + /// + /// Gets user friendly display name of the assessment + /// + [JsonProperty(PropertyName = "properties.displayName")] + public string DisplayName { get; private set; } + + /// + /// Gets or sets additional data regarding the assessment + /// + [JsonProperty(PropertyName = "properties.additionalData")] + public IDictionary AdditionalData { get; set; } + + /// + /// + [JsonProperty(PropertyName = "properties.links")] + public AssessmentLinks Links { get; set; } + + /// + /// + [JsonProperty(PropertyName = "properties.metadata")] + public SecurityAssessmentMetadataProperties Metadata { get; set; } + + /// + /// + [JsonProperty(PropertyName = "properties.partnersData")] + public SecurityAssessmentPartnerData PartnersData { get; set; } + + /// + /// + [JsonProperty(PropertyName = "properties.status")] + public AssessmentStatusResponse Status { get; set; } + + /// + /// Validate the object. + /// + /// + /// Thrown if validation fails + /// + public virtual void Validate() + { + if (ResourceDetails == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "ResourceDetails"); + } + if (Status == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "Status"); + } + if (Metadata != null) + { + Metadata.Validate(); + } + if (PartnersData != null) + { + PartnersData.Validate(); + } + if (Status != null) + { + Status.Validate(); + } + } + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SecurityConnector.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SecurityConnector.cs new file mode 100644 index 000000000000..3bcfc665b341 --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SecurityConnector.cs @@ -0,0 +1,107 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + using Microsoft.Rest; + using Microsoft.Rest.Serialization; + using Newtonsoft.Json; + using System.Collections; + using System.Collections.Generic; + using System.Linq; + + /// + /// The security connector resource. + /// + [Rest.Serialization.JsonTransformation] + public partial class SecurityConnector : TrackedResource + { + /// + /// Initializes a new instance of the SecurityConnector class. + /// + public SecurityConnector() + { + CustomInit(); + } + + /// + /// Initializes a new instance of the SecurityConnector class. + /// + /// Resource Id + /// Resource name + /// Resource type + /// Location where the resource is + /// stored + /// Kind of the resource + /// Entity tag is used for comparing two or more + /// entities from the same requested resource. + /// A list of key value pairs that describe the + /// resource. + /// Azure Resource Manager metadata containing + /// createdBy and modifiedBy information. + /// The multi cloud resource + /// identifier (account id in case of AWS connector). + /// The multi cloud resource's cloud name. + /// Possible values include: 'Azure', 'AWS', 'GCP' + /// A collection of offerings for the security + /// connector. + /// The multi cloud account's + /// organizational data + public SecurityConnector(string id = default(string), string name = default(string), string type = default(string), string location = default(string), string kind = default(string), string etag = default(string), IDictionary tags = default(IDictionary), SystemData systemData = default(SystemData), string hierarchyIdentifier = default(string), string cloudName = default(string), IList offerings = default(IList), SecurityConnectorPropertiesOrganizationalData organizationalData = default(SecurityConnectorPropertiesOrganizationalData)) + : base(id, name, type, location, kind, etag, tags) + { + SystemData = systemData; + HierarchyIdentifier = hierarchyIdentifier; + CloudName = cloudName; + Offerings = offerings; + OrganizationalData = organizationalData; + CustomInit(); + } + + /// + /// An initialization method that performs custom operations like setting defaults + /// + partial void CustomInit(); + + /// + /// Gets azure Resource Manager metadata containing createdBy and + /// modifiedBy information. + /// + [JsonProperty(PropertyName = "systemData")] + public SystemData SystemData { get; private set; } + + /// + /// Gets or sets the multi cloud resource identifier (account id in + /// case of AWS connector). + /// + [JsonProperty(PropertyName = "properties.hierarchyIdentifier")] + public string HierarchyIdentifier { get; set; } + + /// + /// Gets or sets the multi cloud resource's cloud name. Possible values + /// include: 'Azure', 'AWS', 'GCP' + /// + [JsonProperty(PropertyName = "properties.cloudName")] + public string CloudName { get; set; } + + /// + /// Gets or sets a collection of offerings for the security connector. + /// + [JsonProperty(PropertyName = "properties.offerings")] + public IList Offerings { get; set; } + + /// + /// Gets or sets the multi cloud account's organizational data + /// + [JsonProperty(PropertyName = "properties.organizationalData")] + public SecurityConnectorPropertiesOrganizationalData OrganizationalData { get; set; } + + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SecurityConnectorPropertiesOrganizationalData.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SecurityConnectorPropertiesOrganizationalData.cs new file mode 100644 index 000000000000..78c543a85588 --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SecurityConnectorPropertiesOrganizationalData.cs @@ -0,0 +1,91 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + using Newtonsoft.Json; + using System.Collections; + using System.Collections.Generic; + using System.Linq; + + /// + /// The multi cloud account's organizational data + /// + public partial class SecurityConnectorPropertiesOrganizationalData + { + /// + /// Initializes a new instance of the + /// SecurityConnectorPropertiesOrganizationalData class. + /// + public SecurityConnectorPropertiesOrganizationalData() + { + CustomInit(); + } + + /// + /// Initializes a new instance of the + /// SecurityConnectorPropertiesOrganizationalData class. + /// + /// The multi cloud account's + /// membership type in the organization. Possible values include: + /// 'Member', 'Organization' + /// If the multi cloud account is not + /// of membership type organization, this will be the ID of the + /// account's parent + /// If the multi cloud account is of + /// membership type organization, this will be the name of the + /// onboarding stackset + /// If the multi cloud account is of + /// membership type organization, list of accounts excluded from + /// offering + public SecurityConnectorPropertiesOrganizationalData(string organizationMembershipType = default(string), string parentHierarchyId = default(string), string stacksetName = default(string), IList excludedAccountIds = default(IList)) + { + OrganizationMembershipType = organizationMembershipType; + ParentHierarchyId = parentHierarchyId; + StacksetName = stacksetName; + ExcludedAccountIds = excludedAccountIds; + CustomInit(); + } + + /// + /// An initialization method that performs custom operations like setting defaults + /// + partial void CustomInit(); + + /// + /// Gets or sets the multi cloud account's membership type in the + /// organization. Possible values include: 'Member', 'Organization' + /// + [JsonProperty(PropertyName = "organizationMembershipType")] + public string OrganizationMembershipType { get; set; } + + /// + /// Gets or sets if the multi cloud account is not of membership type + /// organization, this will be the ID of the account's parent + /// + [JsonProperty(PropertyName = "parentHierarchyId")] + public string ParentHierarchyId { get; set; } + + /// + /// Gets or sets if the multi cloud account is of membership type + /// organization, this will be the name of the onboarding stackset + /// + [JsonProperty(PropertyName = "stacksetName")] + public string StacksetName { get; set; } + + /// + /// Gets or sets if the multi cloud account is of membership type + /// organization, list of accounts excluded from offering + /// + [JsonProperty(PropertyName = "excludedAccountIds")] + public IList ExcludedAccountIds { get; set; } + + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SettingName2.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SettingName2.cs new file mode 100644 index 000000000000..568349d21bdc --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SettingName2.cs @@ -0,0 +1,24 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + + /// + /// Defines values for SettingName2. + /// + public static class SettingName2 + { + public const string MCAS = "MCAS"; + public const string WDATP = "WDATP"; + public const string WDATPEXCLUDELINUXPUBLICPREVIEW = "WDATP_EXCLUDE_LINUX_PUBLIC_PREVIEW"; + public const string Sentinel = "Sentinel"; + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SettingName4.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SettingName4.cs new file mode 100644 index 000000000000..3dab0fd74fcd --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SettingName4.cs @@ -0,0 +1,24 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + + /// + /// Defines values for SettingName4. + /// + public static class SettingName4 + { + public const string MCAS = "MCAS"; + public const string WDATP = "WDATP"; + public const string WDATPEXCLUDELINUXPUBLICPREVIEW = "WDATP_EXCLUDE_LINUX_PUBLIC_PREVIEW"; + public const string Sentinel = "Sentinel"; + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SettingName5.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SettingName5.cs new file mode 100644 index 000000000000..0cded56be1c9 --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SettingName5.cs @@ -0,0 +1,24 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + + /// + /// Defines values for SettingName5. + /// + public static class SettingName5 + { + public const string MCAS = "MCAS"; + public const string WDATP = "WDATP"; + public const string WDATPEXCLUDELINUXPUBLICPREVIEW = "WDATP_EXCLUDE_LINUX_PUBLIC_PREVIEW"; + public const string Sentinel = "Sentinel"; + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SeverityEnum.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SeverityEnum.cs new file mode 100644 index 000000000000..2cb486159e05 --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SeverityEnum.cs @@ -0,0 +1,23 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + + /// + /// Defines values for SeverityEnum. + /// + public static class SeverityEnum + { + public const string High = "High"; + public const string Medium = "Medium"; + public const string Low = "Low"; + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SupportedCloudEnum.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SupportedCloudEnum.cs new file mode 100644 index 000000000000..f4a13c93dba1 --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/SupportedCloudEnum.cs @@ -0,0 +1,22 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + + /// + /// Defines values for SupportedCloudEnum. + /// + public static class SupportedCloudEnum + { + public const string AWS = "AWS"; + public const string GCP = "GCP"; + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/Tactics.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/Tactics.cs new file mode 100644 index 000000000000..dd960101d446 --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/Tactics.cs @@ -0,0 +1,34 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + + /// + /// Defines values for Tactics. + /// + public static class Tactics + { + public const string Reconnaissance = "Reconnaissance"; + public const string ResourceDevelopment = "Resource Development"; + public const string InitialAccess = "Initial Access"; + public const string Execution = "Execution"; + public const string Persistence = "Persistence"; + public const string PrivilegeEscalation = "Privilege Escalation"; + public const string DefenseEvasion = "Defense Evasion"; + public const string CredentialAccess = "Credential Access"; + public const string Discovery = "Discovery"; + public const string LateralMovement = "Lateral Movement"; + public const string Collection = "Collection"; + public const string CommandandControl = "Command and Control"; + public const string Exfiltration = "Exfiltration"; + public const string Impact = "Impact"; + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/TaskUpdateActionType.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/TaskUpdateActionType.cs new file mode 100644 index 000000000000..c296c6abfb5f --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/TaskUpdateActionType.cs @@ -0,0 +1,25 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + + /// + /// Defines values for TaskUpdateActionType. + /// + public static class TaskUpdateActionType + { + public const string Activate = "Activate"; + public const string Dismiss = "Dismiss"; + public const string Start = "Start"; + public const string Resolve = "Resolve"; + public const string Close = "Close"; + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/Techniques.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/Techniques.cs new file mode 100644 index 000000000000..9acf4cad6320 --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/Models/Techniques.cs @@ -0,0 +1,124 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security.Models +{ + + /// + /// Defines values for Techniques. + /// + public static class Techniques + { + public const string AbuseElevationControlMechanism = "Abuse Elevation Control Mechanism"; + public const string AccessTokenManipulation = "Access Token Manipulation"; + public const string AccountDiscovery = "Account Discovery"; + public const string AccountManipulation = "Account Manipulation"; + public const string ActiveScanning = "Active Scanning"; + public const string ApplicationLayerProtocol = "Application Layer Protocol"; + public const string AudioCapture = "Audio Capture"; + public const string BootorLogonAutostartExecution = "Boot or Logon Autostart Execution"; + public const string BootorLogonInitializationScripts = "Boot or Logon Initialization Scripts"; + public const string BruteForce = "Brute Force"; + public const string CloudInfrastructureDiscovery = "Cloud Infrastructure Discovery"; + public const string CloudServiceDashboard = "Cloud Service Dashboard"; + public const string CloudServiceDiscovery = "Cloud Service Discovery"; + public const string CommandandScriptingInterpreter = "Command and Scripting Interpreter"; + public const string CompromiseClientSoftwareBinary = "Compromise Client Software Binary"; + public const string CompromiseInfrastructure = "Compromise Infrastructure"; + public const string ContainerandResourceDiscovery = "Container and Resource Discovery"; + public const string CreateAccount = "Create Account"; + public const string CreateorModifySystemProcess = "Create or Modify System Process"; + public const string CredentialsfromPasswordStores = "Credentials from Password Stores"; + public const string DataDestruction = "Data Destruction"; + public const string DataEncryptedforImpact = "Data Encrypted for Impact"; + public const string DatafromCloudStorageObject = "Data from Cloud Storage Object"; + public const string DatafromConfigurationRepository = "Data from Configuration Repository"; + public const string DatafromInformationRepositories = "Data from Information Repositories"; + public const string DatafromLocalSystem = "Data from Local System"; + public const string DataManipulation = "Data Manipulation"; + public const string DataStaged = "Data Staged"; + public const string Defacement = "Defacement"; + public const string DeobfuscateDecodeFilesorInformation = "Deobfuscate/Decode Files or Information"; + public const string DiskWipe = "Disk Wipe"; + public const string DomainTrustDiscovery = "Domain Trust Discovery"; + public const string DriveByCompromise = "Drive-by Compromise"; + public const string DynamicResolution = "Dynamic Resolution"; + public const string EndpointDenialofService = "Endpoint Denial of Service"; + public const string EventTriggeredExecution = "Event Triggered Execution"; + public const string ExfiltrationOverAlternativeProtocol = "Exfiltration Over Alternative Protocol"; + public const string ExploitPublicFacingApplication = "Exploit Public-Facing Application"; + public const string ExploitationforClientExecution = "Exploitation for Client Execution"; + public const string ExploitationforCredentialAccess = "Exploitation for Credential Access"; + public const string ExploitationforDefenseEvasion = "Exploitation for Defense Evasion"; + public const string ExploitationforPrivilegeEscalation = "Exploitation for Privilege Escalation"; + public const string ExploitationofRemoteServices = "Exploitation of Remote Services"; + public const string ExternalRemoteServices = "External Remote Services"; + public const string FallbackChannels = "Fallback Channels"; + public const string FileandDirectoryDiscovery = "File and Directory Discovery"; + public const string GatherVictimNetworkInformation = "Gather Victim Network Information"; + public const string HideArtifacts = "Hide Artifacts"; + public const string HijackExecutionFlow = "Hijack Execution Flow"; + public const string ImpairDefenses = "Impair Defenses"; + public const string ImplantContainerImage = "Implant Container Image"; + public const string IndicatorRemovalonHost = "Indicator Removal on Host"; + public const string IndirectCommandExecution = "Indirect Command Execution"; + public const string IngressToolTransfer = "Ingress Tool Transfer"; + public const string InputCapture = "Input Capture"; + public const string InterProcessCommunication = "Inter-Process Communication"; + public const string LateralToolTransfer = "Lateral Tool Transfer"; + public const string ManInTheMiddle = "Man-in-the-Middle"; + public const string Masquerading = "Masquerading"; + public const string ModifyAuthenticationProcess = "Modify Authentication Process"; + public const string ModifyRegistry = "Modify Registry"; + public const string NetworkDenialofService = "Network Denial of Service"; + public const string NetworkServiceScanning = "Network Service Scanning"; + public const string NetworkSniffing = "Network Sniffing"; + public const string NonApplicationLayerProtocol = "Non-Application Layer Protocol"; + public const string NonStandardPort = "Non-Standard Port"; + public const string ObtainCapabilities = "Obtain Capabilities"; + public const string ObfuscatedFilesorInformation = "Obfuscated Files or Information"; + public const string OfficeApplicationStartup = "Office Application Startup"; + public const string OSCredentialDumping = "OS Credential Dumping"; + public const string PermissionGroupsDiscovery = "Permission Groups Discovery"; + public const string Phishing = "Phishing"; + public const string PreOSBoot = "Pre-OS Boot"; + public const string ProcessDiscovery = "Process Discovery"; + public const string ProcessInjection = "Process Injection"; + public const string ProtocolTunneling = "Protocol Tunneling"; + public const string Proxy = "Proxy"; + public const string QueryRegistry = "Query Registry"; + public const string RemoteAccessSoftware = "Remote Access Software"; + public const string RemoteServiceSessionHijacking = "Remote Service Session Hijacking"; + public const string RemoteServices = "Remote Services"; + public const string RemoteSystemDiscovery = "Remote System Discovery"; + public const string ResourceHijacking = "Resource Hijacking"; + public const string ScheduledTaskJob = "Scheduled Task/Job"; + public const string ScreenCapture = "Screen Capture"; + public const string SearchVictimOwnedWebsites = "Search Victim-Owned Websites"; + public const string ServerSoftwareComponent = "Server Software Component"; + public const string ServiceStop = "Service Stop"; + public const string SignedBinaryProxyExecution = "Signed Binary Proxy Execution"; + public const string SoftwareDeploymentTools = "Software Deployment Tools"; + public const string SQLStoredProcedures = "SQL Stored Procedures"; + public const string StealorForgeKerberosTickets = "Steal or Forge Kerberos Tickets"; + public const string SubvertTrustControls = "Subvert Trust Controls"; + public const string SupplyChainCompromise = "Supply Chain Compromise"; + public const string SystemInformationDiscovery = "System Information Discovery"; + public const string TaintSharedContent = "Taint Shared Content"; + public const string TrafficSignaling = "Traffic Signaling"; + public const string TransferDatatoCloudAccount = "Transfer Data to Cloud Account"; + public const string TrustedRelationship = "Trusted Relationship"; + public const string UnsecuredCredentials = "Unsecured Credentials"; + public const string UserExecution = "User Execution"; + public const string ValidAccounts = "Valid Accounts"; + public const string WindowsManagementInstrumentation = "Windows Management Instrumentation"; + public const string FileandDirectoryPermissionsModification = "File and Directory Permissions Modification"; + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/PricingsOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/PricingsOperations.cs index 40be7023380e..f9537f1c750b 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/PricingsOperations.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/PricingsOperations.cs @@ -87,7 +87,7 @@ internal PricingsOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); } } - string apiVersion = "2018-06-01"; + string apiVersion = "2022-03-01"; // Tracing bool _shouldTrace = ServiceClientTracing.IsEnabled; string _invocationId = null; @@ -277,7 +277,7 @@ internal PricingsOperations(SecurityCenterClient client) { throw new ValidationException(ValidationRules.CannotBeNull, "pricingName"); } - string apiVersion = "2018-06-01"; + string apiVersion = "2022-03-01"; // Tracing bool _shouldTrace = ServiceClientTracing.IsEnabled; string _invocationId = null; @@ -439,6 +439,11 @@ internal PricingsOperations(SecurityCenterClient client) /// free tier offers basic security features. Possible values include: 'Free', /// 'Standard' /// + /// + /// The sub-plan selected for a Standard pricing configuration, when more than + /// one sub-plan is available. Each sub-plan enables a set of security + /// features. When not specified, full plan is applied. + /// /// /// Headers that will be added to request. /// @@ -460,7 +465,7 @@ internal PricingsOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task> UpdateWithHttpMessagesAsync(string pricingName, string pricingTier, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task> UpdateWithHttpMessagesAsync(string pricingName, string pricingTier, string subPlan = default(string), Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -481,11 +486,12 @@ internal PricingsOperations(SecurityCenterClient client) { throw new ValidationException(ValidationRules.CannotBeNull, "pricingTier"); } - string apiVersion = "2018-06-01"; + string apiVersion = "2022-03-01"; Pricing pricing = new Pricing(); - if (pricingTier != null) + if (pricingTier != null || subPlan != null) { pricing.PricingTier = pricingTier; + pricing.SubPlan = subPlan; } // Tracing bool _shouldTrace = ServiceClientTracing.IsEnabled; diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/PricingsOperationsExtensions.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/PricingsOperationsExtensions.cs index 7e17c1a59785..733303ef9a55 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/PricingsOperationsExtensions.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/PricingsOperationsExtensions.cs @@ -100,9 +100,14 @@ public static Pricing Get(this IPricingsOperations operations, string pricingNam /// free tier offers basic security features. Possible values include: 'Free', /// 'Standard' /// - public static Pricing Update(this IPricingsOperations operations, string pricingName, string pricingTier) + /// + /// The sub-plan selected for a Standard pricing configuration, when more than + /// one sub-plan is available. Each sub-plan enables a set of security + /// features. When not specified, full plan is applied. + /// + public static Pricing Update(this IPricingsOperations operations, string pricingName, string pricingTier, string subPlan = default(string)) { - return operations.UpdateAsync(pricingName, pricingTier).GetAwaiter().GetResult(); + return operations.UpdateAsync(pricingName, pricingTier, subPlan).GetAwaiter().GetResult(); } /// @@ -122,12 +127,17 @@ public static Pricing Update(this IPricingsOperations operations, string pricing /// free tier offers basic security features. Possible values include: 'Free', /// 'Standard' /// + /// + /// The sub-plan selected for a Standard pricing configuration, when more than + /// one sub-plan is available. Each sub-plan enables a set of security + /// features. When not specified, full plan is applied. + /// /// /// The cancellation token. /// - public static async Task UpdateAsync(this IPricingsOperations operations, string pricingName, string pricingTier, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task UpdateAsync(this IPricingsOperations operations, string pricingName, string pricingTier, string subPlan = default(string), CancellationToken cancellationToken = default(CancellationToken)) { - using (var _result = await operations.UpdateWithHttpMessagesAsync(pricingName, pricingTier, null, cancellationToken).ConfigureAwait(false)) + using (var _result = await operations.UpdateWithHttpMessagesAsync(pricingName, pricingTier, subPlan, null, cancellationToken).ConfigureAwait(false)) { return _result.Body; } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SdkInfo_SecurityCenter.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SdkInfo_SecurityCenter.cs index da9ebfb93191..25aa69db4d17 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SdkInfo_SecurityCenter.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SdkInfo_SecurityCenter.cs @@ -22,16 +22,18 @@ public static IEnumerable> ApiInfo_SecurityCenter new Tuple("Security", "AdaptiveApplicationControls", "2020-01-01"), new Tuple("Security", "AdaptiveNetworkHardenings", "2020-01-01"), new Tuple("Security", "AdvancedThreatProtection", "2019-01-01"), - new Tuple("Security", "Alerts", "2021-01-01"), + new Tuple("Security", "Alerts", "2021-11-01"), new Tuple("Security", "AlertsSuppressionRules", "2019-01-01-preview"), new Tuple("Security", "AllowedConnections", "2020-01-01"), - new Tuple("Security", "Assessments", "2020-01-01"), - new Tuple("Security", "AssessmentsMetadata", "2020-01-01"), + new Tuple("Security", "Assessments", "2021-06-01"), + new Tuple("Security", "AssessmentsMetadata", "2021-06-01"), new Tuple("Security", "AutoProvisioningSettings", "2017-08-01-preview"), new Tuple("Security", "Automations", "2019-01-01-preview"), new Tuple("Security", "ComplianceResults", "2017-08-01"), new Tuple("Security", "Compliances", "2017-08-01-preview"), new Tuple("Security", "Connectors", "2020-01-01-preview"), + new Tuple("Security", "CustomAssessmentAutomations", "2021-07-01-preview"), + new Tuple("Security", "CustomEntityStoreAssignments", "2021-07-01-preview"), new Tuple("Security", "DeviceSecurityGroups", "2019-08-01"), new Tuple("Security", "DiscoveredSecuritySolutions", "2020-01-01"), new Tuple("Security", "ExternalSecuritySolutions", "2020-01-01"), @@ -43,14 +45,16 @@ public static IEnumerable> ApiInfo_SecurityCenter new Tuple("Security", "IotSecuritySolutionsAnalyticsRecommendation", "2019-08-01"), new Tuple("Security", "JitNetworkAccessPolicies", "2020-01-01"), new Tuple("Security", "Locations", "2015-06-01-preview"), + new Tuple("Security", "MdeOnboardings", "2021-10-01-preview"), new Tuple("Security", "Operations", "2015-06-01-preview"), - new Tuple("Security", "Pricings", "2018-06-01"), + new Tuple("Security", "Pricings", "2022-03-01"), new Tuple("Security", "RegulatoryComplianceAssessments", "2019-01-01-preview"), new Tuple("Security", "RegulatoryComplianceControls", "2019-01-01-preview"), new Tuple("Security", "RegulatoryComplianceStandards", "2019-01-01-preview"), new Tuple("Security", "SecureScoreControlDefinitions", "2020-01-01"), new Tuple("Security", "SecureScoreControls", "2020-01-01"), new Tuple("Security", "SecureScores", "2020-01-01"), + new Tuple("Security", "SecurityConnectors", "2021-07-01-preview"), new Tuple("Security", "SecurityContacts", "2017-08-01-preview"), new Tuple("Security", "SecuritySolutions", "2020-01-01"), new Tuple("Security", "SecuritySolutionsReferenceData", "2020-01-01"), @@ -69,12 +73,12 @@ public static IEnumerable> ApiInfo_SecurityCenter } } // BEGIN: Code Generation Metadata Section - public static readonly String AutoRestVersion = "v2"; + public static readonly String AutoRestVersion = "2.0.4421"; public static readonly String AutoRestBootStrapperVersion = "autorest@2.0.4413"; - public static readonly String AutoRestCmdExecuted = "cmd.exe /c autorest.cmd https://github.com/Azure/azure-rest-api-specs/blob/master/specification/security/resource-manager/readme.md --csharp --version=v2 --reflect-api-versions --csharp-sdks-folder=C:\\code\\azure-sdk-for-net\\sdk"; + public static readonly String AutoRestCmdExecuted = "cmd.exe /c autorest.cmd https://github.com/Azure/azure-rest-api-specs/blob/main/specification/security/resource-manager/readme.md --csharp --version=2.0.4421 --reflect-api-versions --csharp-sdks-folder=C:\\code\\azure-sdk-for-net\\sdk"; public static readonly String GithubForkName = "Azure"; - public static readonly String GithubBranchName = "master"; - public static readonly String GithubCommidId = "c981b81aa26ad4d0d156e034e6782853b4e747a1"; + public static readonly String GithubBranchName = "main"; + public static readonly String GithubCommidId = "bcec16b1ef77dc266ada0b3eb6d86eae0cdf3b16"; public static readonly String CodeGenerationErrors = ""; public static readonly String GithubRepoName = "azure-rest-api-specs"; // END: Code Generation Metadata Section diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SecurityCenterClient.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SecurityCenterClient.cs index d987a9b88202..65b51522d1d8 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SecurityCenterClient.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SecurityCenterClient.cs @@ -52,12 +52,6 @@ public partial class SecurityCenterClient : ServiceClient, /// public string SubscriptionId { get; set; } - /// - /// The location where ASC stores the data of the subscription. can be - /// retrieved from Get locations - /// - public string AscLocation { get; set; } - /// /// The preferred language for the response. /// @@ -76,6 +70,21 @@ public partial class SecurityCenterClient : ServiceClient, /// public bool? GenerateClientRequestId { get; set; } + /// + /// Gets the IMdeOnboardingsOperations. + /// + public virtual IMdeOnboardingsOperations MdeOnboardings { get; private set; } + + /// + /// Gets the ICustomAssessmentAutomationsOperations. + /// + public virtual ICustomAssessmentAutomationsOperations CustomAssessmentAutomations { get; private set; } + + /// + /// Gets the ICustomEntityStoreAssignmentsOperations. + /// + public virtual ICustomEntityStoreAssignmentsOperations CustomEntityStoreAssignments { get; private set; } + /// /// Gets the IComplianceResultsOperations. /// @@ -301,6 +310,11 @@ public partial class SecurityCenterClient : ServiceClient, /// public virtual ISoftwareInventoriesOperations SoftwareInventories { get; private set; } + /// + /// Gets the ISecurityConnectorsOperations. + /// + public virtual ISecurityConnectorsOperations SecurityConnectors { get; private set; } + /// /// Initializes a new instance of the SecurityCenterClient class. /// @@ -542,6 +556,9 @@ public SecurityCenterClient(System.Uri baseUri, ServiceClientCredentials credent /// private void Initialize() { + MdeOnboardings = new MdeOnboardingsOperations(this); + CustomAssessmentAutomations = new CustomAssessmentAutomationsOperations(this); + CustomEntityStoreAssignments = new CustomEntityStoreAssignmentsOperations(this); ComplianceResults = new ComplianceResultsOperations(this); Pricings = new PricingsOperations(this); AdvancedThreatProtection = new AdvancedThreatProtectionOperations(this); @@ -587,6 +604,7 @@ private void Initialize() Settings = new SettingsOperations(this); IngestionSettings = new IngestionSettingsOperations(this); SoftwareInventories = new SoftwareInventoriesOperations(this); + SecurityConnectors = new SecurityConnectorsOperations(this); BaseUri = new System.Uri("https://management.azure.com"); AcceptLanguage = "en-US"; LongRunningOperationRetryTimeout = 30; @@ -635,6 +653,8 @@ private void Initialize() DeserializationSettings.Converters.Add(new PolymorphicDeserializeJsonConverter("kind")); SerializationSettings.Converters.Add(new PolymorphicSerializeJsonConverter("kind")); DeserializationSettings.Converters.Add(new PolymorphicDeserializeJsonConverter("kind")); + SerializationSettings.Converters.Add(new PolymorphicSerializeJsonConverter("offeringType")); + DeserializationSettings.Converters.Add(new PolymorphicDeserializeJsonConverter("offeringType")); CustomInitialize(); DeserializationSettings.Converters.Add(new TransformationJsonConverter()); DeserializationSettings.Converters.Add(new CloudErrorJsonConverter()); diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SecurityConnectorsOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SecurityConnectorsOperations.cs new file mode 100644 index 000000000000..1271c0701bf1 --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SecurityConnectorsOperations.cs @@ -0,0 +1,1694 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security +{ + using Microsoft.Rest; + using Microsoft.Rest.Azure; + using Models; + using Newtonsoft.Json; + using System.Collections; + using System.Collections.Generic; + using System.Linq; + using System.Net; + using System.Net.Http; + using System.Threading; + using System.Threading.Tasks; + + /// + /// SecurityConnectorsOperations operations. + /// + internal partial class SecurityConnectorsOperations : IServiceOperations, ISecurityConnectorsOperations + { + /// + /// Initializes a new instance of the SecurityConnectorsOperations class. + /// + /// + /// Reference to the service client. + /// + /// + /// Thrown when a required parameter is null + /// + internal SecurityConnectorsOperations(SecurityCenterClient client) + { + if (client == null) + { + throw new System.ArgumentNullException("client"); + } + Client = client; + } + + /// + /// Gets a reference to the SecurityCenterClient + /// + public SecurityCenterClient Client { get; private set; } + + /// + /// Lists all the security connectors in the specified subscription. Use the + /// 'nextLink' property in the response to get the next page of security + /// connectors for the specified subscription. + /// + /// + /// Headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// A response object containing the response body and response headers. + /// + public async Task>> ListWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + { + if (Client.SubscriptionId == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId"); + } + if (Client.SubscriptionId != null) + { + if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$")) + { + throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); + } + } + string apiVersion = "2021-07-01-preview"; + // Tracing + bool _shouldTrace = ServiceClientTracing.IsEnabled; + string _invocationId = null; + if (_shouldTrace) + { + _invocationId = ServiceClientTracing.NextInvocationId.ToString(); + Dictionary tracingParameters = new Dictionary(); + tracingParameters.Add("apiVersion", apiVersion); + tracingParameters.Add("cancellationToken", cancellationToken); + ServiceClientTracing.Enter(_invocationId, this, "List", tracingParameters); + } + // Construct URL + var _baseUrl = Client.BaseUri.AbsoluteUri; + var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/providers/Microsoft.Security/securityConnectors").ToString(); + _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); + List _queryParameters = new List(); + if (apiVersion != null) + { + _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(apiVersion))); + } + if (_queryParameters.Count > 0) + { + _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters); + } + // Create HTTP transport objects + var _httpRequest = new HttpRequestMessage(); + HttpResponseMessage _httpResponse = null; + _httpRequest.Method = new HttpMethod("GET"); + _httpRequest.RequestUri = new System.Uri(_url); + // Set Headers + if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value) + { + _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString()); + } + if (Client.AcceptLanguage != null) + { + if (_httpRequest.Headers.Contains("accept-language")) + { + _httpRequest.Headers.Remove("accept-language"); + } + _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage); + } + + + if (customHeaders != null) + { + foreach(var _header in customHeaders) + { + if (_httpRequest.Headers.Contains(_header.Key)) + { + _httpRequest.Headers.Remove(_header.Key); + } + _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value); + } + } + + // Serialize Request + string _requestContent = null; + // Set Credentials + if (Client.Credentials != null) + { + cancellationToken.ThrowIfCancellationRequested(); + await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + } + // Send Request + if (_shouldTrace) + { + ServiceClientTracing.SendRequest(_invocationId, _httpRequest); + } + cancellationToken.ThrowIfCancellationRequested(); + _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + if (_shouldTrace) + { + ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse); + } + HttpStatusCode _statusCode = _httpResponse.StatusCode; + cancellationToken.ThrowIfCancellationRequested(); + string _responseContent = null; + if ((int)_statusCode != 200) + { + var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode)); + try + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + CloudError _errorBody = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + if (_errorBody != null) + { + ex = new CloudException(_errorBody.Message); + ex.Body = _errorBody; + } + } + catch (JsonException) + { + // Ignore the exception + } + ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent); + ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent); + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + if (_shouldTrace) + { + ServiceClientTracing.Error(_invocationId, ex); + } + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw ex; + } + // Create Result + var _result = new AzureOperationResponse>(); + _result.Request = _httpRequest; + _result.Response = _httpResponse; + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + // Deserialize Response + if ((int)_statusCode == 200) + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + try + { + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject>(_responseContent, Client.DeserializationSettings); + } + catch (JsonException ex) + { + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw new SerializationException("Unable to deserialize the response.", _responseContent, ex); + } + } + if (_shouldTrace) + { + ServiceClientTracing.Exit(_invocationId, _result); + } + return _result; + } + + /// + /// Lists all the security connectors in the specified resource group. Use the + /// 'nextLink' property in the response to get the next page of security + /// connectors for the specified resource group. + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// Headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// A response object containing the response body and response headers. + /// + public async Task>> ListByResourceGroupWithHttpMessagesAsync(string resourceGroupName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + { + if (Client.SubscriptionId == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId"); + } + if (Client.SubscriptionId != null) + { + if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$")) + { + throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); + } + } + if (resourceGroupName == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "resourceGroupName"); + } + if (resourceGroupName != null) + { + if (resourceGroupName.Length > 90) + { + throw new ValidationException(ValidationRules.MaxLength, "resourceGroupName", 90); + } + if (resourceGroupName.Length < 1) + { + throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1); + } + if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$")) + { + throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$"); + } + } + string apiVersion = "2021-07-01-preview"; + // Tracing + bool _shouldTrace = ServiceClientTracing.IsEnabled; + string _invocationId = null; + if (_shouldTrace) + { + _invocationId = ServiceClientTracing.NextInvocationId.ToString(); + Dictionary tracingParameters = new Dictionary(); + tracingParameters.Add("apiVersion", apiVersion); + tracingParameters.Add("resourceGroupName", resourceGroupName); + tracingParameters.Add("cancellationToken", cancellationToken); + ServiceClientTracing.Enter(_invocationId, this, "ListByResourceGroup", tracingParameters); + } + // Construct URL + var _baseUrl = Client.BaseUri.AbsoluteUri; + var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/securityConnectors").ToString(); + _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); + _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName)); + List _queryParameters = new List(); + if (apiVersion != null) + { + _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(apiVersion))); + } + if (_queryParameters.Count > 0) + { + _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters); + } + // Create HTTP transport objects + var _httpRequest = new HttpRequestMessage(); + HttpResponseMessage _httpResponse = null; + _httpRequest.Method = new HttpMethod("GET"); + _httpRequest.RequestUri = new System.Uri(_url); + // Set Headers + if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value) + { + _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString()); + } + if (Client.AcceptLanguage != null) + { + if (_httpRequest.Headers.Contains("accept-language")) + { + _httpRequest.Headers.Remove("accept-language"); + } + _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage); + } + + + if (customHeaders != null) + { + foreach(var _header in customHeaders) + { + if (_httpRequest.Headers.Contains(_header.Key)) + { + _httpRequest.Headers.Remove(_header.Key); + } + _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value); + } + } + + // Serialize Request + string _requestContent = null; + // Set Credentials + if (Client.Credentials != null) + { + cancellationToken.ThrowIfCancellationRequested(); + await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + } + // Send Request + if (_shouldTrace) + { + ServiceClientTracing.SendRequest(_invocationId, _httpRequest); + } + cancellationToken.ThrowIfCancellationRequested(); + _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + if (_shouldTrace) + { + ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse); + } + HttpStatusCode _statusCode = _httpResponse.StatusCode; + cancellationToken.ThrowIfCancellationRequested(); + string _responseContent = null; + if ((int)_statusCode != 200) + { + var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode)); + try + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + CloudError _errorBody = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + if (_errorBody != null) + { + ex = new CloudException(_errorBody.Message); + ex.Body = _errorBody; + } + } + catch (JsonException) + { + // Ignore the exception + } + ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent); + ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent); + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + if (_shouldTrace) + { + ServiceClientTracing.Error(_invocationId, ex); + } + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw ex; + } + // Create Result + var _result = new AzureOperationResponse>(); + _result.Request = _httpRequest; + _result.Response = _httpResponse; + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + // Deserialize Response + if ((int)_statusCode == 200) + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + try + { + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject>(_responseContent, Client.DeserializationSettings); + } + catch (JsonException ex) + { + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw new SerializationException("Unable to deserialize the response.", _responseContent, ex); + } + } + if (_shouldTrace) + { + ServiceClientTracing.Exit(_invocationId, _result); + } + return _result; + } + + /// + /// Retrieves details of a specific security connector + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// The security connector name. + /// + /// + /// Headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// A response object containing the response body and response headers. + /// + public async Task> GetWithHttpMessagesAsync(string resourceGroupName, string securityConnectorName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + { + if (Client.SubscriptionId == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId"); + } + if (Client.SubscriptionId != null) + { + if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$")) + { + throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); + } + } + if (resourceGroupName == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "resourceGroupName"); + } + if (resourceGroupName != null) + { + if (resourceGroupName.Length > 90) + { + throw new ValidationException(ValidationRules.MaxLength, "resourceGroupName", 90); + } + if (resourceGroupName.Length < 1) + { + throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1); + } + if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$")) + { + throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$"); + } + } + if (securityConnectorName == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "securityConnectorName"); + } + string apiVersion = "2021-07-01-preview"; + // Tracing + bool _shouldTrace = ServiceClientTracing.IsEnabled; + string _invocationId = null; + if (_shouldTrace) + { + _invocationId = ServiceClientTracing.NextInvocationId.ToString(); + Dictionary tracingParameters = new Dictionary(); + tracingParameters.Add("apiVersion", apiVersion); + tracingParameters.Add("resourceGroupName", resourceGroupName); + tracingParameters.Add("securityConnectorName", securityConnectorName); + tracingParameters.Add("cancellationToken", cancellationToken); + ServiceClientTracing.Enter(_invocationId, this, "Get", tracingParameters); + } + // Construct URL + var _baseUrl = Client.BaseUri.AbsoluteUri; + var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/securityConnectors/{securityConnectorName}").ToString(); + _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); + _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName)); + _url = _url.Replace("{securityConnectorName}", System.Uri.EscapeDataString(securityConnectorName)); + List _queryParameters = new List(); + if (apiVersion != null) + { + _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(apiVersion))); + } + if (_queryParameters.Count > 0) + { + _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters); + } + // Create HTTP transport objects + var _httpRequest = new HttpRequestMessage(); + HttpResponseMessage _httpResponse = null; + _httpRequest.Method = new HttpMethod("GET"); + _httpRequest.RequestUri = new System.Uri(_url); + // Set Headers + if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value) + { + _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString()); + } + if (Client.AcceptLanguage != null) + { + if (_httpRequest.Headers.Contains("accept-language")) + { + _httpRequest.Headers.Remove("accept-language"); + } + _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage); + } + + + if (customHeaders != null) + { + foreach(var _header in customHeaders) + { + if (_httpRequest.Headers.Contains(_header.Key)) + { + _httpRequest.Headers.Remove(_header.Key); + } + _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value); + } + } + + // Serialize Request + string _requestContent = null; + // Set Credentials + if (Client.Credentials != null) + { + cancellationToken.ThrowIfCancellationRequested(); + await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + } + // Send Request + if (_shouldTrace) + { + ServiceClientTracing.SendRequest(_invocationId, _httpRequest); + } + cancellationToken.ThrowIfCancellationRequested(); + _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + if (_shouldTrace) + { + ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse); + } + HttpStatusCode _statusCode = _httpResponse.StatusCode; + cancellationToken.ThrowIfCancellationRequested(); + string _responseContent = null; + if ((int)_statusCode != 200) + { + var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode)); + try + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + CloudError _errorBody = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + if (_errorBody != null) + { + ex = new CloudException(_errorBody.Message); + ex.Body = _errorBody; + } + } + catch (JsonException) + { + // Ignore the exception + } + ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent); + ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent); + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + if (_shouldTrace) + { + ServiceClientTracing.Error(_invocationId, ex); + } + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw ex; + } + // Create Result + var _result = new AzureOperationResponse(); + _result.Request = _httpRequest; + _result.Response = _httpResponse; + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + // Deserialize Response + if ((int)_statusCode == 200) + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + try + { + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + } + catch (JsonException ex) + { + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw new SerializationException("Unable to deserialize the response.", _responseContent, ex); + } + } + if (_shouldTrace) + { + ServiceClientTracing.Exit(_invocationId, _result); + } + return _result; + } + + /// + /// Creates or updates a security connector. If a security connector is already + /// created and a subsequent request is issued for the same security connector + /// id, then it will be updated. + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// The security connector name. + /// + /// + /// The security connector resource + /// + /// + /// Headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// A response object containing the response body and response headers. + /// + public async Task> CreateOrUpdateWithHttpMessagesAsync(string resourceGroupName, string securityConnectorName, SecurityConnector securityConnector, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + { + if (Client.SubscriptionId == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId"); + } + if (Client.SubscriptionId != null) + { + if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$")) + { + throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); + } + } + if (resourceGroupName == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "resourceGroupName"); + } + if (resourceGroupName != null) + { + if (resourceGroupName.Length > 90) + { + throw new ValidationException(ValidationRules.MaxLength, "resourceGroupName", 90); + } + if (resourceGroupName.Length < 1) + { + throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1); + } + if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$")) + { + throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$"); + } + } + if (securityConnectorName == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "securityConnectorName"); + } + if (securityConnector == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "securityConnector"); + } + string apiVersion = "2021-07-01-preview"; + // Tracing + bool _shouldTrace = ServiceClientTracing.IsEnabled; + string _invocationId = null; + if (_shouldTrace) + { + _invocationId = ServiceClientTracing.NextInvocationId.ToString(); + Dictionary tracingParameters = new Dictionary(); + tracingParameters.Add("apiVersion", apiVersion); + tracingParameters.Add("resourceGroupName", resourceGroupName); + tracingParameters.Add("securityConnectorName", securityConnectorName); + tracingParameters.Add("securityConnector", securityConnector); + tracingParameters.Add("cancellationToken", cancellationToken); + ServiceClientTracing.Enter(_invocationId, this, "CreateOrUpdate", tracingParameters); + } + // Construct URL + var _baseUrl = Client.BaseUri.AbsoluteUri; + var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/securityConnectors/{securityConnectorName}").ToString(); + _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); + _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName)); + _url = _url.Replace("{securityConnectorName}", System.Uri.EscapeDataString(securityConnectorName)); + List _queryParameters = new List(); + if (apiVersion != null) + { + _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(apiVersion))); + } + if (_queryParameters.Count > 0) + { + _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters); + } + // Create HTTP transport objects + var _httpRequest = new HttpRequestMessage(); + HttpResponseMessage _httpResponse = null; + _httpRequest.Method = new HttpMethod("PUT"); + _httpRequest.RequestUri = new System.Uri(_url); + // Set Headers + if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value) + { + _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString()); + } + if (Client.AcceptLanguage != null) + { + if (_httpRequest.Headers.Contains("accept-language")) + { + _httpRequest.Headers.Remove("accept-language"); + } + _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage); + } + + + if (customHeaders != null) + { + foreach(var _header in customHeaders) + { + if (_httpRequest.Headers.Contains(_header.Key)) + { + _httpRequest.Headers.Remove(_header.Key); + } + _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value); + } + } + + // Serialize Request + string _requestContent = null; + if(securityConnector != null) + { + _requestContent = Rest.Serialization.SafeJsonConvert.SerializeObject(securityConnector, Client.SerializationSettings); + _httpRequest.Content = new StringContent(_requestContent, System.Text.Encoding.UTF8); + _httpRequest.Content.Headers.ContentType =System.Net.Http.Headers.MediaTypeHeaderValue.Parse("application/json; charset=utf-8"); + } + // Set Credentials + if (Client.Credentials != null) + { + cancellationToken.ThrowIfCancellationRequested(); + await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + } + // Send Request + if (_shouldTrace) + { + ServiceClientTracing.SendRequest(_invocationId, _httpRequest); + } + cancellationToken.ThrowIfCancellationRequested(); + _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + if (_shouldTrace) + { + ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse); + } + HttpStatusCode _statusCode = _httpResponse.StatusCode; + cancellationToken.ThrowIfCancellationRequested(); + string _responseContent = null; + if ((int)_statusCode != 200 && (int)_statusCode != 201) + { + var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode)); + try + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + CloudError _errorBody = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + if (_errorBody != null) + { + ex = new CloudException(_errorBody.Message); + ex.Body = _errorBody; + } + } + catch (JsonException) + { + // Ignore the exception + } + ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent); + ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent); + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + if (_shouldTrace) + { + ServiceClientTracing.Error(_invocationId, ex); + } + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw ex; + } + // Create Result + var _result = new AzureOperationResponse(); + _result.Request = _httpRequest; + _result.Response = _httpResponse; + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + // Deserialize Response + if ((int)_statusCode == 200) + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + try + { + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + } + catch (JsonException ex) + { + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw new SerializationException("Unable to deserialize the response.", _responseContent, ex); + } + } + // Deserialize Response + if ((int)_statusCode == 201) + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + try + { + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + } + catch (JsonException ex) + { + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw new SerializationException("Unable to deserialize the response.", _responseContent, ex); + } + } + if (_shouldTrace) + { + ServiceClientTracing.Exit(_invocationId, _result); + } + return _result; + } + + /// + /// Updates a security connector + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// The security connector name. + /// + /// + /// The security connector resource + /// + /// + /// Headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// A response object containing the response body and response headers. + /// + public async Task> UpdateWithHttpMessagesAsync(string resourceGroupName, string securityConnectorName, SecurityConnector securityConnector, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + { + if (Client.SubscriptionId == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId"); + } + if (Client.SubscriptionId != null) + { + if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$")) + { + throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); + } + } + if (resourceGroupName == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "resourceGroupName"); + } + if (resourceGroupName != null) + { + if (resourceGroupName.Length > 90) + { + throw new ValidationException(ValidationRules.MaxLength, "resourceGroupName", 90); + } + if (resourceGroupName.Length < 1) + { + throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1); + } + if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$")) + { + throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$"); + } + } + if (securityConnectorName == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "securityConnectorName"); + } + if (securityConnector == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "securityConnector"); + } + string apiVersion = "2021-07-01-preview"; + // Tracing + bool _shouldTrace = ServiceClientTracing.IsEnabled; + string _invocationId = null; + if (_shouldTrace) + { + _invocationId = ServiceClientTracing.NextInvocationId.ToString(); + Dictionary tracingParameters = new Dictionary(); + tracingParameters.Add("apiVersion", apiVersion); + tracingParameters.Add("resourceGroupName", resourceGroupName); + tracingParameters.Add("securityConnectorName", securityConnectorName); + tracingParameters.Add("securityConnector", securityConnector); + tracingParameters.Add("cancellationToken", cancellationToken); + ServiceClientTracing.Enter(_invocationId, this, "Update", tracingParameters); + } + // Construct URL + var _baseUrl = Client.BaseUri.AbsoluteUri; + var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/securityConnectors/{securityConnectorName}").ToString(); + _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); + _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName)); + _url = _url.Replace("{securityConnectorName}", System.Uri.EscapeDataString(securityConnectorName)); + List _queryParameters = new List(); + if (apiVersion != null) + { + _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(apiVersion))); + } + if (_queryParameters.Count > 0) + { + _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters); + } + // Create HTTP transport objects + var _httpRequest = new HttpRequestMessage(); + HttpResponseMessage _httpResponse = null; + _httpRequest.Method = new HttpMethod("PATCH"); + _httpRequest.RequestUri = new System.Uri(_url); + // Set Headers + if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value) + { + _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString()); + } + if (Client.AcceptLanguage != null) + { + if (_httpRequest.Headers.Contains("accept-language")) + { + _httpRequest.Headers.Remove("accept-language"); + } + _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage); + } + + + if (customHeaders != null) + { + foreach(var _header in customHeaders) + { + if (_httpRequest.Headers.Contains(_header.Key)) + { + _httpRequest.Headers.Remove(_header.Key); + } + _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value); + } + } + + // Serialize Request + string _requestContent = null; + if(securityConnector != null) + { + _requestContent = Rest.Serialization.SafeJsonConvert.SerializeObject(securityConnector, Client.SerializationSettings); + _httpRequest.Content = new StringContent(_requestContent, System.Text.Encoding.UTF8); + _httpRequest.Content.Headers.ContentType =System.Net.Http.Headers.MediaTypeHeaderValue.Parse("application/json; charset=utf-8"); + } + // Set Credentials + if (Client.Credentials != null) + { + cancellationToken.ThrowIfCancellationRequested(); + await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + } + // Send Request + if (_shouldTrace) + { + ServiceClientTracing.SendRequest(_invocationId, _httpRequest); + } + cancellationToken.ThrowIfCancellationRequested(); + _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + if (_shouldTrace) + { + ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse); + } + HttpStatusCode _statusCode = _httpResponse.StatusCode; + cancellationToken.ThrowIfCancellationRequested(); + string _responseContent = null; + if ((int)_statusCode != 200) + { + var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode)); + try + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + CloudError _errorBody = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + if (_errorBody != null) + { + ex = new CloudException(_errorBody.Message); + ex.Body = _errorBody; + } + } + catch (JsonException) + { + // Ignore the exception + } + ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent); + ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent); + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + if (_shouldTrace) + { + ServiceClientTracing.Error(_invocationId, ex); + } + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw ex; + } + // Create Result + var _result = new AzureOperationResponse(); + _result.Request = _httpRequest; + _result.Response = _httpResponse; + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + // Deserialize Response + if ((int)_statusCode == 200) + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + try + { + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + } + catch (JsonException ex) + { + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw new SerializationException("Unable to deserialize the response.", _responseContent, ex); + } + } + if (_shouldTrace) + { + ServiceClientTracing.Exit(_invocationId, _result); + } + return _result; + } + + /// + /// Deletes a security connector. + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// The security connector name. + /// + /// + /// Headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// A response object containing the response body and response headers. + /// + public async Task DeleteWithHttpMessagesAsync(string resourceGroupName, string securityConnectorName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + { + if (Client.SubscriptionId == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.SubscriptionId"); + } + if (Client.SubscriptionId != null) + { + if (!System.Text.RegularExpressions.Regex.IsMatch(Client.SubscriptionId, "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$")) + { + throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); + } + } + if (resourceGroupName == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "resourceGroupName"); + } + if (resourceGroupName != null) + { + if (resourceGroupName.Length > 90) + { + throw new ValidationException(ValidationRules.MaxLength, "resourceGroupName", 90); + } + if (resourceGroupName.Length < 1) + { + throw new ValidationException(ValidationRules.MinLength, "resourceGroupName", 1); + } + if (!System.Text.RegularExpressions.Regex.IsMatch(resourceGroupName, "^[-\\w\\._\\(\\)]+$")) + { + throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$"); + } + } + if (securityConnectorName == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "securityConnectorName"); + } + string apiVersion = "2021-07-01-preview"; + // Tracing + bool _shouldTrace = ServiceClientTracing.IsEnabled; + string _invocationId = null; + if (_shouldTrace) + { + _invocationId = ServiceClientTracing.NextInvocationId.ToString(); + Dictionary tracingParameters = new Dictionary(); + tracingParameters.Add("apiVersion", apiVersion); + tracingParameters.Add("resourceGroupName", resourceGroupName); + tracingParameters.Add("securityConnectorName", securityConnectorName); + tracingParameters.Add("cancellationToken", cancellationToken); + ServiceClientTracing.Enter(_invocationId, this, "Delete", tracingParameters); + } + // Construct URL + var _baseUrl = Client.BaseUri.AbsoluteUri; + var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/securityConnectors/{securityConnectorName}").ToString(); + _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); + _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName)); + _url = _url.Replace("{securityConnectorName}", System.Uri.EscapeDataString(securityConnectorName)); + List _queryParameters = new List(); + if (apiVersion != null) + { + _queryParameters.Add(string.Format("api-version={0}", System.Uri.EscapeDataString(apiVersion))); + } + if (_queryParameters.Count > 0) + { + _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters); + } + // Create HTTP transport objects + var _httpRequest = new HttpRequestMessage(); + HttpResponseMessage _httpResponse = null; + _httpRequest.Method = new HttpMethod("DELETE"); + _httpRequest.RequestUri = new System.Uri(_url); + // Set Headers + if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value) + { + _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString()); + } + if (Client.AcceptLanguage != null) + { + if (_httpRequest.Headers.Contains("accept-language")) + { + _httpRequest.Headers.Remove("accept-language"); + } + _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage); + } + + + if (customHeaders != null) + { + foreach(var _header in customHeaders) + { + if (_httpRequest.Headers.Contains(_header.Key)) + { + _httpRequest.Headers.Remove(_header.Key); + } + _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value); + } + } + + // Serialize Request + string _requestContent = null; + // Set Credentials + if (Client.Credentials != null) + { + cancellationToken.ThrowIfCancellationRequested(); + await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + } + // Send Request + if (_shouldTrace) + { + ServiceClientTracing.SendRequest(_invocationId, _httpRequest); + } + cancellationToken.ThrowIfCancellationRequested(); + _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + if (_shouldTrace) + { + ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse); + } + HttpStatusCode _statusCode = _httpResponse.StatusCode; + cancellationToken.ThrowIfCancellationRequested(); + string _responseContent = null; + if ((int)_statusCode != 200 && (int)_statusCode != 204) + { + var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode)); + try + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + CloudError _errorBody = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + if (_errorBody != null) + { + ex = new CloudException(_errorBody.Message); + ex.Body = _errorBody; + } + } + catch (JsonException) + { + // Ignore the exception + } + ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent); + ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent); + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + if (_shouldTrace) + { + ServiceClientTracing.Error(_invocationId, ex); + } + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw ex; + } + // Create Result + var _result = new AzureOperationResponse(); + _result.Request = _httpRequest; + _result.Response = _httpResponse; + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + if (_shouldTrace) + { + ServiceClientTracing.Exit(_invocationId, _result); + } + return _result; + } + + /// + /// Lists all the security connectors in the specified subscription. Use the + /// 'nextLink' property in the response to get the next page of security + /// connectors for the specified subscription. + /// + /// + /// The NextLink from the previous successful call to List operation. + /// + /// + /// Headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// A response object containing the response body and response headers. + /// + public async Task>> ListNextWithHttpMessagesAsync(string nextPageLink, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + { + if (nextPageLink == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "nextPageLink"); + } + // Tracing + bool _shouldTrace = ServiceClientTracing.IsEnabled; + string _invocationId = null; + if (_shouldTrace) + { + _invocationId = ServiceClientTracing.NextInvocationId.ToString(); + Dictionary tracingParameters = new Dictionary(); + tracingParameters.Add("nextPageLink", nextPageLink); + tracingParameters.Add("cancellationToken", cancellationToken); + ServiceClientTracing.Enter(_invocationId, this, "ListNext", tracingParameters); + } + // Construct URL + string _url = "{nextLink}"; + _url = _url.Replace("{nextLink}", nextPageLink); + List _queryParameters = new List(); + if (_queryParameters.Count > 0) + { + _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters); + } + // Create HTTP transport objects + var _httpRequest = new HttpRequestMessage(); + HttpResponseMessage _httpResponse = null; + _httpRequest.Method = new HttpMethod("GET"); + _httpRequest.RequestUri = new System.Uri(_url); + // Set Headers + if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value) + { + _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString()); + } + if (Client.AcceptLanguage != null) + { + if (_httpRequest.Headers.Contains("accept-language")) + { + _httpRequest.Headers.Remove("accept-language"); + } + _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage); + } + + + if (customHeaders != null) + { + foreach(var _header in customHeaders) + { + if (_httpRequest.Headers.Contains(_header.Key)) + { + _httpRequest.Headers.Remove(_header.Key); + } + _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value); + } + } + + // Serialize Request + string _requestContent = null; + // Set Credentials + if (Client.Credentials != null) + { + cancellationToken.ThrowIfCancellationRequested(); + await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + } + // Send Request + if (_shouldTrace) + { + ServiceClientTracing.SendRequest(_invocationId, _httpRequest); + } + cancellationToken.ThrowIfCancellationRequested(); + _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + if (_shouldTrace) + { + ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse); + } + HttpStatusCode _statusCode = _httpResponse.StatusCode; + cancellationToken.ThrowIfCancellationRequested(); + string _responseContent = null; + if ((int)_statusCode != 200) + { + var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode)); + try + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + CloudError _errorBody = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + if (_errorBody != null) + { + ex = new CloudException(_errorBody.Message); + ex.Body = _errorBody; + } + } + catch (JsonException) + { + // Ignore the exception + } + ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent); + ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent); + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + if (_shouldTrace) + { + ServiceClientTracing.Error(_invocationId, ex); + } + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw ex; + } + // Create Result + var _result = new AzureOperationResponse>(); + _result.Request = _httpRequest; + _result.Response = _httpResponse; + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + // Deserialize Response + if ((int)_statusCode == 200) + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + try + { + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject>(_responseContent, Client.DeserializationSettings); + } + catch (JsonException ex) + { + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw new SerializationException("Unable to deserialize the response.", _responseContent, ex); + } + } + if (_shouldTrace) + { + ServiceClientTracing.Exit(_invocationId, _result); + } + return _result; + } + + /// + /// Lists all the security connectors in the specified resource group. Use the + /// 'nextLink' property in the response to get the next page of security + /// connectors for the specified resource group. + /// + /// + /// The NextLink from the previous successful call to List operation. + /// + /// + /// Headers that will be added to request. + /// + /// + /// The cancellation token. + /// + /// + /// Thrown when the operation returned an invalid status code + /// + /// + /// Thrown when unable to deserialize the response + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// Thrown when a required parameter is null + /// + /// + /// A response object containing the response body and response headers. + /// + public async Task>> ListByResourceGroupNextWithHttpMessagesAsync(string nextPageLink, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + { + if (nextPageLink == null) + { + throw new ValidationException(ValidationRules.CannotBeNull, "nextPageLink"); + } + // Tracing + bool _shouldTrace = ServiceClientTracing.IsEnabled; + string _invocationId = null; + if (_shouldTrace) + { + _invocationId = ServiceClientTracing.NextInvocationId.ToString(); + Dictionary tracingParameters = new Dictionary(); + tracingParameters.Add("nextPageLink", nextPageLink); + tracingParameters.Add("cancellationToken", cancellationToken); + ServiceClientTracing.Enter(_invocationId, this, "ListByResourceGroupNext", tracingParameters); + } + // Construct URL + string _url = "{nextLink}"; + _url = _url.Replace("{nextLink}", nextPageLink); + List _queryParameters = new List(); + if (_queryParameters.Count > 0) + { + _url += (_url.Contains("?") ? "&" : "?") + string.Join("&", _queryParameters); + } + // Create HTTP transport objects + var _httpRequest = new HttpRequestMessage(); + HttpResponseMessage _httpResponse = null; + _httpRequest.Method = new HttpMethod("GET"); + _httpRequest.RequestUri = new System.Uri(_url); + // Set Headers + if (Client.GenerateClientRequestId != null && Client.GenerateClientRequestId.Value) + { + _httpRequest.Headers.TryAddWithoutValidation("x-ms-client-request-id", System.Guid.NewGuid().ToString()); + } + if (Client.AcceptLanguage != null) + { + if (_httpRequest.Headers.Contains("accept-language")) + { + _httpRequest.Headers.Remove("accept-language"); + } + _httpRequest.Headers.TryAddWithoutValidation("accept-language", Client.AcceptLanguage); + } + + + if (customHeaders != null) + { + foreach(var _header in customHeaders) + { + if (_httpRequest.Headers.Contains(_header.Key)) + { + _httpRequest.Headers.Remove(_header.Key); + } + _httpRequest.Headers.TryAddWithoutValidation(_header.Key, _header.Value); + } + } + + // Serialize Request + string _requestContent = null; + // Set Credentials + if (Client.Credentials != null) + { + cancellationToken.ThrowIfCancellationRequested(); + await Client.Credentials.ProcessHttpRequestAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + } + // Send Request + if (_shouldTrace) + { + ServiceClientTracing.SendRequest(_invocationId, _httpRequest); + } + cancellationToken.ThrowIfCancellationRequested(); + _httpResponse = await Client.HttpClient.SendAsync(_httpRequest, cancellationToken).ConfigureAwait(false); + if (_shouldTrace) + { + ServiceClientTracing.ReceiveResponse(_invocationId, _httpResponse); + } + HttpStatusCode _statusCode = _httpResponse.StatusCode; + cancellationToken.ThrowIfCancellationRequested(); + string _responseContent = null; + if ((int)_statusCode != 200) + { + var ex = new CloudException(string.Format("Operation returned an invalid status code '{0}'", _statusCode)); + try + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + CloudError _errorBody = Rest.Serialization.SafeJsonConvert.DeserializeObject(_responseContent, Client.DeserializationSettings); + if (_errorBody != null) + { + ex = new CloudException(_errorBody.Message); + ex.Body = _errorBody; + } + } + catch (JsonException) + { + // Ignore the exception + } + ex.Request = new HttpRequestMessageWrapper(_httpRequest, _requestContent); + ex.Response = new HttpResponseMessageWrapper(_httpResponse, _responseContent); + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + ex.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + if (_shouldTrace) + { + ServiceClientTracing.Error(_invocationId, ex); + } + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw ex; + } + // Create Result + var _result = new AzureOperationResponse>(); + _result.Request = _httpRequest; + _result.Response = _httpResponse; + if (_httpResponse.Headers.Contains("x-ms-request-id")) + { + _result.RequestId = _httpResponse.Headers.GetValues("x-ms-request-id").FirstOrDefault(); + } + // Deserialize Response + if ((int)_statusCode == 200) + { + _responseContent = await _httpResponse.Content.ReadAsStringAsync().ConfigureAwait(false); + try + { + _result.Body = Rest.Serialization.SafeJsonConvert.DeserializeObject>(_responseContent, Client.DeserializationSettings); + } + catch (JsonException ex) + { + _httpRequest.Dispose(); + if (_httpResponse != null) + { + _httpResponse.Dispose(); + } + throw new SerializationException("Unable to deserialize the response.", _responseContent, ex); + } + } + if (_shouldTrace) + { + ServiceClientTracing.Exit(_invocationId, _result); + } + return _result; + } + + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SecurityConnectorsOperationsExtensions.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SecurityConnectorsOperationsExtensions.cs new file mode 100644 index 000000000000..591b99676bec --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SecurityConnectorsOperationsExtensions.cs @@ -0,0 +1,354 @@ +// +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. See License.txt in the project root for +// license information. +// +// Code generated by Microsoft (R) AutoRest Code Generator. +// Changes may cause incorrect behavior and will be lost if the code is +// regenerated. +// + +namespace Microsoft.Azure.Management.Security +{ + using Microsoft.Rest; + using Microsoft.Rest.Azure; + using Models; + using System.Threading; + using System.Threading.Tasks; + + /// + /// Extension methods for SecurityConnectorsOperations. + /// + public static partial class SecurityConnectorsOperationsExtensions + { + /// + /// Lists all the security connectors in the specified subscription. Use the + /// 'nextLink' property in the response to get the next page of security + /// connectors for the specified subscription. + /// + /// + /// The operations group for this extension method. + /// + public static IPage List(this ISecurityConnectorsOperations operations) + { + return operations.ListAsync().GetAwaiter().GetResult(); + } + + /// + /// Lists all the security connectors in the specified subscription. Use the + /// 'nextLink' property in the response to get the next page of security + /// connectors for the specified subscription. + /// + /// + /// The operations group for this extension method. + /// + /// + /// The cancellation token. + /// + public static async Task> ListAsync(this ISecurityConnectorsOperations operations, CancellationToken cancellationToken = default(CancellationToken)) + { + using (var _result = await operations.ListWithHttpMessagesAsync(null, cancellationToken).ConfigureAwait(false)) + { + return _result.Body; + } + } + + /// + /// Lists all the security connectors in the specified resource group. Use the + /// 'nextLink' property in the response to get the next page of security + /// connectors for the specified resource group. + /// + /// + /// The operations group for this extension method. + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + public static IPage ListByResourceGroup(this ISecurityConnectorsOperations operations, string resourceGroupName) + { + return operations.ListByResourceGroupAsync(resourceGroupName).GetAwaiter().GetResult(); + } + + /// + /// Lists all the security connectors in the specified resource group. Use the + /// 'nextLink' property in the response to get the next page of security + /// connectors for the specified resource group. + /// + /// + /// The operations group for this extension method. + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// The cancellation token. + /// + public static async Task> ListByResourceGroupAsync(this ISecurityConnectorsOperations operations, string resourceGroupName, CancellationToken cancellationToken = default(CancellationToken)) + { + using (var _result = await operations.ListByResourceGroupWithHttpMessagesAsync(resourceGroupName, null, cancellationToken).ConfigureAwait(false)) + { + return _result.Body; + } + } + + /// + /// Retrieves details of a specific security connector + /// + /// + /// The operations group for this extension method. + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// The security connector name. + /// + public static SecurityConnector Get(this ISecurityConnectorsOperations operations, string resourceGroupName, string securityConnectorName) + { + return operations.GetAsync(resourceGroupName, securityConnectorName).GetAwaiter().GetResult(); + } + + /// + /// Retrieves details of a specific security connector + /// + /// + /// The operations group for this extension method. + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// The security connector name. + /// + /// + /// The cancellation token. + /// + public static async Task GetAsync(this ISecurityConnectorsOperations operations, string resourceGroupName, string securityConnectorName, CancellationToken cancellationToken = default(CancellationToken)) + { + using (var _result = await operations.GetWithHttpMessagesAsync(resourceGroupName, securityConnectorName, null, cancellationToken).ConfigureAwait(false)) + { + return _result.Body; + } + } + + /// + /// Creates or updates a security connector. If a security connector is already + /// created and a subsequent request is issued for the same security connector + /// id, then it will be updated. + /// + /// + /// The operations group for this extension method. + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// The security connector name. + /// + /// + /// The security connector resource + /// + public static SecurityConnector CreateOrUpdate(this ISecurityConnectorsOperations operations, string resourceGroupName, string securityConnectorName, SecurityConnector securityConnector) + { + return operations.CreateOrUpdateAsync(resourceGroupName, securityConnectorName, securityConnector).GetAwaiter().GetResult(); + } + + /// + /// Creates or updates a security connector. If a security connector is already + /// created and a subsequent request is issued for the same security connector + /// id, then it will be updated. + /// + /// + /// The operations group for this extension method. + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// The security connector name. + /// + /// + /// The security connector resource + /// + /// + /// The cancellation token. + /// + public static async Task CreateOrUpdateAsync(this ISecurityConnectorsOperations operations, string resourceGroupName, string securityConnectorName, SecurityConnector securityConnector, CancellationToken cancellationToken = default(CancellationToken)) + { + using (var _result = await operations.CreateOrUpdateWithHttpMessagesAsync(resourceGroupName, securityConnectorName, securityConnector, null, cancellationToken).ConfigureAwait(false)) + { + return _result.Body; + } + } + + /// + /// Updates a security connector + /// + /// + /// The operations group for this extension method. + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// The security connector name. + /// + /// + /// The security connector resource + /// + public static SecurityConnector Update(this ISecurityConnectorsOperations operations, string resourceGroupName, string securityConnectorName, SecurityConnector securityConnector) + { + return operations.UpdateAsync(resourceGroupName, securityConnectorName, securityConnector).GetAwaiter().GetResult(); + } + + /// + /// Updates a security connector + /// + /// + /// The operations group for this extension method. + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// The security connector name. + /// + /// + /// The security connector resource + /// + /// + /// The cancellation token. + /// + public static async Task UpdateAsync(this ISecurityConnectorsOperations operations, string resourceGroupName, string securityConnectorName, SecurityConnector securityConnector, CancellationToken cancellationToken = default(CancellationToken)) + { + using (var _result = await operations.UpdateWithHttpMessagesAsync(resourceGroupName, securityConnectorName, securityConnector, null, cancellationToken).ConfigureAwait(false)) + { + return _result.Body; + } + } + + /// + /// Deletes a security connector. + /// + /// + /// The operations group for this extension method. + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// The security connector name. + /// + public static void Delete(this ISecurityConnectorsOperations operations, string resourceGroupName, string securityConnectorName) + { + operations.DeleteAsync(resourceGroupName, securityConnectorName).GetAwaiter().GetResult(); + } + + /// + /// Deletes a security connector. + /// + /// + /// The operations group for this extension method. + /// + /// + /// The name of the resource group within the user's subscription. The name is + /// case insensitive. + /// + /// + /// The security connector name. + /// + /// + /// The cancellation token. + /// + public static async Task DeleteAsync(this ISecurityConnectorsOperations operations, string resourceGroupName, string securityConnectorName, CancellationToken cancellationToken = default(CancellationToken)) + { + (await operations.DeleteWithHttpMessagesAsync(resourceGroupName, securityConnectorName, null, cancellationToken).ConfigureAwait(false)).Dispose(); + } + + /// + /// Lists all the security connectors in the specified subscription. Use the + /// 'nextLink' property in the response to get the next page of security + /// connectors for the specified subscription. + /// + /// + /// The operations group for this extension method. + /// + /// + /// The NextLink from the previous successful call to List operation. + /// + public static IPage ListNext(this ISecurityConnectorsOperations operations, string nextPageLink) + { + return operations.ListNextAsync(nextPageLink).GetAwaiter().GetResult(); + } + + /// + /// Lists all the security connectors in the specified subscription. Use the + /// 'nextLink' property in the response to get the next page of security + /// connectors for the specified subscription. + /// + /// + /// The operations group for this extension method. + /// + /// + /// The NextLink from the previous successful call to List operation. + /// + /// + /// The cancellation token. + /// + public static async Task> ListNextAsync(this ISecurityConnectorsOperations operations, string nextPageLink, CancellationToken cancellationToken = default(CancellationToken)) + { + using (var _result = await operations.ListNextWithHttpMessagesAsync(nextPageLink, null, cancellationToken).ConfigureAwait(false)) + { + return _result.Body; + } + } + + /// + /// Lists all the security connectors in the specified resource group. Use the + /// 'nextLink' property in the response to get the next page of security + /// connectors for the specified resource group. + /// + /// + /// The operations group for this extension method. + /// + /// + /// The NextLink from the previous successful call to List operation. + /// + public static IPage ListByResourceGroupNext(this ISecurityConnectorsOperations operations, string nextPageLink) + { + return operations.ListByResourceGroupNextAsync(nextPageLink).GetAwaiter().GetResult(); + } + + /// + /// Lists all the security connectors in the specified resource group. Use the + /// 'nextLink' property in the response to get the next page of security + /// connectors for the specified resource group. + /// + /// + /// The operations group for this extension method. + /// + /// + /// The NextLink from the previous successful call to List operation. + /// + /// + /// The cancellation token. + /// + public static async Task> ListByResourceGroupNextAsync(this ISecurityConnectorsOperations operations, string nextPageLink, CancellationToken cancellationToken = default(CancellationToken)) + { + using (var _result = await operations.ListByResourceGroupNextWithHttpMessagesAsync(nextPageLink, null, cancellationToken).ConfigureAwait(false)) + { + return _result.Body; + } + } + + } +} diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SecuritySolutionsOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SecuritySolutionsOperations.cs index de7706e3ffbb..80b08eaf5878 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SecuritySolutionsOperations.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SecuritySolutionsOperations.cs @@ -240,6 +240,10 @@ internal SecuritySolutionsOperations(SecurityCenterClient client) /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of security solution. /// @@ -264,7 +268,7 @@ internal SecuritySolutionsOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task> GetWithHttpMessagesAsync(string resourceGroupName, string securitySolutionName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task> GetWithHttpMessagesAsync(string resourceGroupName, string ascLocation, string securitySolutionName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -296,9 +300,9 @@ internal SecuritySolutionsOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } if (securitySolutionName == null) { @@ -313,6 +317,7 @@ internal SecuritySolutionsOperations(SecurityCenterClient client) _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); tracingParameters.Add("resourceGroupName", resourceGroupName); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("securitySolutionName", securitySolutionName); tracingParameters.Add("apiVersion", apiVersion); tracingParameters.Add("cancellationToken", cancellationToken); @@ -323,7 +328,7 @@ internal SecuritySolutionsOperations(SecurityCenterClient client) var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/locations/{ascLocation}/securitySolutions/{securitySolutionName}").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); _url = _url.Replace("{securitySolutionName}", System.Uri.EscapeDataString(securitySolutionName)); List _queryParameters = new List(); if (apiVersion != null) diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SecuritySolutionsOperationsExtensions.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SecuritySolutionsOperationsExtensions.cs index cceb5464c183..ee5e260f0cfa 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SecuritySolutionsOperationsExtensions.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SecuritySolutionsOperationsExtensions.cs @@ -59,12 +59,16 @@ public static IPage List(this ISecuritySolutionsOperations ope /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of security solution. /// - public static SecuritySolution Get(this ISecuritySolutionsOperations operations, string resourceGroupName, string securitySolutionName) + public static SecuritySolution Get(this ISecuritySolutionsOperations operations, string resourceGroupName, string ascLocation, string securitySolutionName) { - return operations.GetAsync(resourceGroupName, securitySolutionName).GetAwaiter().GetResult(); + return operations.GetAsync(resourceGroupName, ascLocation, securitySolutionName).GetAwaiter().GetResult(); } /// @@ -77,15 +81,19 @@ public static SecuritySolution Get(this ISecuritySolutionsOperations operations, /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of security solution. /// /// /// The cancellation token. /// - public static async Task GetAsync(this ISecuritySolutionsOperations operations, string resourceGroupName, string securitySolutionName, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task GetAsync(this ISecuritySolutionsOperations operations, string resourceGroupName, string ascLocation, string securitySolutionName, CancellationToken cancellationToken = default(CancellationToken)) { - using (var _result = await operations.GetWithHttpMessagesAsync(resourceGroupName, securitySolutionName, null, cancellationToken).ConfigureAwait(false)) + using (var _result = await operations.GetWithHttpMessagesAsync(resourceGroupName, ascLocation, securitySolutionName, null, cancellationToken).ConfigureAwait(false)) { return _result.Body; } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SecuritySolutionsReferenceDataOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SecuritySolutionsReferenceDataOperations.cs index c71d1fe5707a..25cca109d510 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SecuritySolutionsReferenceDataOperations.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SecuritySolutionsReferenceDataOperations.cs @@ -237,6 +237,10 @@ internal SecuritySolutionsReferenceDataOperations(SecurityCenterClient client) /// Gets list of all supported Security Solutions for subscription and /// location. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Headers that will be added to request. /// @@ -258,7 +262,7 @@ internal SecuritySolutionsReferenceDataOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task> ListByHomeRegionWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task> ListByHomeRegionWithHttpMessagesAsync(string ascLocation, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -271,9 +275,9 @@ internal SecuritySolutionsReferenceDataOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } string apiVersion = "2020-01-01"; // Tracing @@ -283,6 +287,7 @@ internal SecuritySolutionsReferenceDataOperations(SecurityCenterClient client) { _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("apiVersion", apiVersion); tracingParameters.Add("cancellationToken", cancellationToken); ServiceClientTracing.Enter(_invocationId, this, "ListByHomeRegion", tracingParameters); @@ -291,7 +296,7 @@ internal SecuritySolutionsReferenceDataOperations(SecurityCenterClient client) var _baseUrl = Client.BaseUri.AbsoluteUri; var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/providers/Microsoft.Security/locations/{ascLocation}/securitySolutionsReferenceData").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); List _queryParameters = new List(); if (apiVersion != null) { diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SecuritySolutionsReferenceDataOperationsExtensions.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SecuritySolutionsReferenceDataOperationsExtensions.cs index 9209ab0f8048..26e9564ac6c2 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SecuritySolutionsReferenceDataOperationsExtensions.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SecuritySolutionsReferenceDataOperationsExtensions.cs @@ -56,9 +56,13 @@ public static SecuritySolutionsReferenceDataList List(this ISecuritySolutionsRef /// /// The operations group for this extension method. /// - public static SecuritySolutionsReferenceDataList ListByHomeRegion(this ISecuritySolutionsReferenceDataOperations operations) + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// + public static SecuritySolutionsReferenceDataList ListByHomeRegion(this ISecuritySolutionsReferenceDataOperations operations, string ascLocation) { - return operations.ListByHomeRegionAsync().GetAwaiter().GetResult(); + return operations.ListByHomeRegionAsync(ascLocation).GetAwaiter().GetResult(); } /// @@ -68,12 +72,16 @@ public static SecuritySolutionsReferenceDataList ListByHomeRegion(this ISecurity /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// The cancellation token. /// - public static async Task ListByHomeRegionAsync(this ISecuritySolutionsReferenceDataOperations operations, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task ListByHomeRegionAsync(this ISecuritySolutionsReferenceDataOperations operations, string ascLocation, CancellationToken cancellationToken = default(CancellationToken)) { - using (var _result = await operations.ListByHomeRegionWithHttpMessagesAsync(null, cancellationToken).ConfigureAwait(false)) + using (var _result = await operations.ListByHomeRegionWithHttpMessagesAsync(ascLocation, null, cancellationToken).ConfigureAwait(false)) { return _result.Body; } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SettingsOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SettingsOperations.cs index 68953ec2e798..3543d57a74b5 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SettingsOperations.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/SettingsOperations.cs @@ -295,7 +295,7 @@ internal SettingsOperations(SecurityCenterClient client) var _baseUrl = Client.BaseUri.AbsoluteUri; var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/providers/Microsoft.Security/settings/{settingName}").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); - _url = _url.Replace("{settingName}", System.Uri.EscapeDataString(Rest.Serialization.SafeJsonConvert.SerializeObject(settingName, Client.SerializationSettings).Trim('"'))); + _url = _url.Replace("{settingName}", System.Uri.EscapeDataString(settingName)); List _queryParameters = new List(); if (apiVersion != null) { @@ -496,7 +496,7 @@ internal SettingsOperations(SecurityCenterClient client) var _baseUrl = Client.BaseUri.AbsoluteUri; var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/providers/Microsoft.Security/settings/{settingName}").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); - _url = _url.Replace("{settingName}", System.Uri.EscapeDataString(Rest.Serialization.SafeJsonConvert.SerializeObject(settingName, Client.SerializationSettings).Trim('"'))); + _url = _url.Replace("{settingName}", System.Uri.EscapeDataString(settingName)); List _queryParameters = new List(); if (apiVersion != null) { diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/TasksOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/TasksOperations.cs index c987c9b3155a..f87c7877daf7 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/TasksOperations.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/TasksOperations.cs @@ -246,6 +246,10 @@ internal TasksOperations(SecurityCenterClient client) /// Recommended tasks that will help improve the security of the subscription /// proactively /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// OData filter. Optional. /// @@ -270,7 +274,7 @@ internal TasksOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task>> ListByHomeRegionWithHttpMessagesAsync(string filter = default(string), Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task>> ListByHomeRegionWithHttpMessagesAsync(string ascLocation, string filter = default(string), Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -283,9 +287,9 @@ internal TasksOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } string apiVersion = "2015-06-01-preview"; // Tracing @@ -296,6 +300,7 @@ internal TasksOperations(SecurityCenterClient client) _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); tracingParameters.Add("apiVersion", apiVersion); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("filter", filter); tracingParameters.Add("cancellationToken", cancellationToken); ServiceClientTracing.Enter(_invocationId, this, "ListByHomeRegion", tracingParameters); @@ -304,7 +309,7 @@ internal TasksOperations(SecurityCenterClient client) var _baseUrl = Client.BaseUri.AbsoluteUri; var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/providers/Microsoft.Security/locations/{ascLocation}/tasks").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); List _queryParameters = new List(); if (apiVersion != null) { @@ -443,6 +448,10 @@ internal TasksOperations(SecurityCenterClient client) /// Recommended tasks that will help improve the security of the subscription /// proactively /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the task object, will be a GUID /// @@ -467,7 +476,7 @@ internal TasksOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task> GetSubscriptionLevelTaskWithHttpMessagesAsync(string taskName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task> GetSubscriptionLevelTaskWithHttpMessagesAsync(string ascLocation, string taskName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -480,9 +489,9 @@ internal TasksOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } if (taskName == null) { @@ -497,6 +506,7 @@ internal TasksOperations(SecurityCenterClient client) _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); tracingParameters.Add("apiVersion", apiVersion); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("taskName", taskName); tracingParameters.Add("cancellationToken", cancellationToken); ServiceClientTracing.Enter(_invocationId, this, "GetSubscriptionLevelTask", tracingParameters); @@ -505,7 +515,7 @@ internal TasksOperations(SecurityCenterClient client) var _baseUrl = Client.BaseUri.AbsoluteUri; var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/providers/Microsoft.Security/locations/{ascLocation}/tasks/{taskName}").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); _url = _url.Replace("{taskName}", System.Uri.EscapeDataString(taskName)); List _queryParameters = new List(); if (apiVersion != null) @@ -641,6 +651,10 @@ internal TasksOperations(SecurityCenterClient client) /// Recommended tasks that will help improve the security of the subscription /// proactively /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the task object, will be a GUID /// @@ -666,7 +680,7 @@ internal TasksOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task UpdateSubscriptionLevelTaskStateWithHttpMessagesAsync(string taskName, string taskUpdateActionType, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task UpdateSubscriptionLevelTaskStateWithHttpMessagesAsync(string ascLocation, string taskName, string taskUpdateActionType, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -679,9 +693,9 @@ internal TasksOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } if (taskName == null) { @@ -700,6 +714,7 @@ internal TasksOperations(SecurityCenterClient client) _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); tracingParameters.Add("apiVersion", apiVersion); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("taskName", taskName); tracingParameters.Add("taskUpdateActionType", taskUpdateActionType); tracingParameters.Add("cancellationToken", cancellationToken); @@ -709,9 +724,9 @@ internal TasksOperations(SecurityCenterClient client) var _baseUrl = Client.BaseUri.AbsoluteUri; var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/providers/Microsoft.Security/locations/{ascLocation}/tasks/{taskName}/{taskUpdateActionType}").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); _url = _url.Replace("{taskName}", System.Uri.EscapeDataString(taskName)); - _url = _url.Replace("{taskUpdateActionType}", System.Uri.EscapeDataString(Rest.Serialization.SafeJsonConvert.SerializeObject(taskUpdateActionType, Client.SerializationSettings).Trim('"'))); + _url = _url.Replace("{taskUpdateActionType}", System.Uri.EscapeDataString(taskUpdateActionType)); List _queryParameters = new List(); if (apiVersion != null) { @@ -832,6 +847,10 @@ internal TasksOperations(SecurityCenterClient client) /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// OData filter. Optional. /// @@ -856,7 +875,7 @@ internal TasksOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task>> ListByResourceGroupWithHttpMessagesAsync(string resourceGroupName, string filter = default(string), Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task>> ListByResourceGroupWithHttpMessagesAsync(string resourceGroupName, string ascLocation, string filter = default(string), Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -888,9 +907,9 @@ internal TasksOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } string apiVersion = "2015-06-01-preview"; // Tracing @@ -902,6 +921,7 @@ internal TasksOperations(SecurityCenterClient client) Dictionary tracingParameters = new Dictionary(); tracingParameters.Add("apiVersion", apiVersion); tracingParameters.Add("resourceGroupName", resourceGroupName); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("filter", filter); tracingParameters.Add("cancellationToken", cancellationToken); ServiceClientTracing.Enter(_invocationId, this, "ListByResourceGroup", tracingParameters); @@ -911,7 +931,7 @@ internal TasksOperations(SecurityCenterClient client) var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/locations/{ascLocation}/tasks").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); List _queryParameters = new List(); if (apiVersion != null) { @@ -1054,6 +1074,10 @@ internal TasksOperations(SecurityCenterClient client) /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the task object, will be a GUID /// @@ -1078,7 +1102,7 @@ internal TasksOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task> GetResourceGroupLevelTaskWithHttpMessagesAsync(string resourceGroupName, string taskName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task> GetResourceGroupLevelTaskWithHttpMessagesAsync(string resourceGroupName, string ascLocation, string taskName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -1110,9 +1134,9 @@ internal TasksOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } if (taskName == null) { @@ -1128,6 +1152,7 @@ internal TasksOperations(SecurityCenterClient client) Dictionary tracingParameters = new Dictionary(); tracingParameters.Add("apiVersion", apiVersion); tracingParameters.Add("resourceGroupName", resourceGroupName); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("taskName", taskName); tracingParameters.Add("cancellationToken", cancellationToken); ServiceClientTracing.Enter(_invocationId, this, "GetResourceGroupLevelTask", tracingParameters); @@ -1137,7 +1162,7 @@ internal TasksOperations(SecurityCenterClient client) var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/locations/{ascLocation}/tasks/{taskName}").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); _url = _url.Replace("{taskName}", System.Uri.EscapeDataString(taskName)); List _queryParameters = new List(); if (apiVersion != null) @@ -1277,6 +1302,10 @@ internal TasksOperations(SecurityCenterClient client) /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the task object, will be a GUID /// @@ -1302,7 +1331,7 @@ internal TasksOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task UpdateResourceGroupLevelTaskStateWithHttpMessagesAsync(string resourceGroupName, string taskName, string taskUpdateActionType, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task UpdateResourceGroupLevelTaskStateWithHttpMessagesAsync(string resourceGroupName, string ascLocation, string taskName, string taskUpdateActionType, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -1334,9 +1363,9 @@ internal TasksOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } if (taskName == null) { @@ -1356,6 +1385,7 @@ internal TasksOperations(SecurityCenterClient client) Dictionary tracingParameters = new Dictionary(); tracingParameters.Add("apiVersion", apiVersion); tracingParameters.Add("resourceGroupName", resourceGroupName); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("taskName", taskName); tracingParameters.Add("taskUpdateActionType", taskUpdateActionType); tracingParameters.Add("cancellationToken", cancellationToken); @@ -1366,9 +1396,9 @@ internal TasksOperations(SecurityCenterClient client) var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/locations/{ascLocation}/tasks/{taskName}/{taskUpdateActionType}").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); _url = _url.Replace("{taskName}", System.Uri.EscapeDataString(taskName)); - _url = _url.Replace("{taskUpdateActionType}", System.Uri.EscapeDataString(Rest.Serialization.SafeJsonConvert.SerializeObject(taskUpdateActionType, Client.SerializationSettings).Trim('"'))); + _url = _url.Replace("{taskUpdateActionType}", System.Uri.EscapeDataString(taskUpdateActionType)); List _queryParameters = new List(); if (apiVersion != null) { diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/TasksOperationsExtensions.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/TasksOperationsExtensions.cs index 45a9bdd70a7b..26f33558c03c 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/TasksOperationsExtensions.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/TasksOperationsExtensions.cs @@ -64,12 +64,16 @@ public static partial class TasksOperationsExtensions /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// OData filter. Optional. /// - public static IPage ListByHomeRegion(this ITasksOperations operations, string filter = default(string)) + public static IPage ListByHomeRegion(this ITasksOperations operations, string ascLocation, string filter = default(string)) { - return operations.ListByHomeRegionAsync(filter).GetAwaiter().GetResult(); + return operations.ListByHomeRegionAsync(ascLocation, filter).GetAwaiter().GetResult(); } /// @@ -79,15 +83,19 @@ public static partial class TasksOperationsExtensions /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// OData filter. Optional. /// /// /// The cancellation token. /// - public static async Task> ListByHomeRegionAsync(this ITasksOperations operations, string filter = default(string), CancellationToken cancellationToken = default(CancellationToken)) + public static async Task> ListByHomeRegionAsync(this ITasksOperations operations, string ascLocation, string filter = default(string), CancellationToken cancellationToken = default(CancellationToken)) { - using (var _result = await operations.ListByHomeRegionWithHttpMessagesAsync(filter, null, cancellationToken).ConfigureAwait(false)) + using (var _result = await operations.ListByHomeRegionWithHttpMessagesAsync(ascLocation, filter, null, cancellationToken).ConfigureAwait(false)) { return _result.Body; } @@ -100,12 +108,16 @@ public static partial class TasksOperationsExtensions /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the task object, will be a GUID /// - public static SecurityTask GetSubscriptionLevelTask(this ITasksOperations operations, string taskName) + public static SecurityTask GetSubscriptionLevelTask(this ITasksOperations operations, string ascLocation, string taskName) { - return operations.GetSubscriptionLevelTaskAsync(taskName).GetAwaiter().GetResult(); + return operations.GetSubscriptionLevelTaskAsync(ascLocation, taskName).GetAwaiter().GetResult(); } /// @@ -115,15 +127,19 @@ public static SecurityTask GetSubscriptionLevelTask(this ITasksOperations operat /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the task object, will be a GUID /// /// /// The cancellation token. /// - public static async Task GetSubscriptionLevelTaskAsync(this ITasksOperations operations, string taskName, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task GetSubscriptionLevelTaskAsync(this ITasksOperations operations, string ascLocation, string taskName, CancellationToken cancellationToken = default(CancellationToken)) { - using (var _result = await operations.GetSubscriptionLevelTaskWithHttpMessagesAsync(taskName, null, cancellationToken).ConfigureAwait(false)) + using (var _result = await operations.GetSubscriptionLevelTaskWithHttpMessagesAsync(ascLocation, taskName, null, cancellationToken).ConfigureAwait(false)) { return _result.Body; } @@ -136,6 +152,10 @@ public static SecurityTask GetSubscriptionLevelTask(this ITasksOperations operat /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the task object, will be a GUID /// @@ -143,9 +163,9 @@ public static SecurityTask GetSubscriptionLevelTask(this ITasksOperations operat /// Type of the action to do on the task. Possible values include: 'Activate', /// 'Dismiss', 'Start', 'Resolve', 'Close' /// - public static void UpdateSubscriptionLevelTaskState(this ITasksOperations operations, string taskName, string taskUpdateActionType) + public static void UpdateSubscriptionLevelTaskState(this ITasksOperations operations, string ascLocation, string taskName, string taskUpdateActionType) { - operations.UpdateSubscriptionLevelTaskStateAsync(taskName, taskUpdateActionType).GetAwaiter().GetResult(); + operations.UpdateSubscriptionLevelTaskStateAsync(ascLocation, taskName, taskUpdateActionType).GetAwaiter().GetResult(); } /// @@ -155,6 +175,10 @@ public static void UpdateSubscriptionLevelTaskState(this ITasksOperations operat /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the task object, will be a GUID /// @@ -165,9 +189,9 @@ public static void UpdateSubscriptionLevelTaskState(this ITasksOperations operat /// /// The cancellation token. /// - public static async Task UpdateSubscriptionLevelTaskStateAsync(this ITasksOperations operations, string taskName, string taskUpdateActionType, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task UpdateSubscriptionLevelTaskStateAsync(this ITasksOperations operations, string ascLocation, string taskName, string taskUpdateActionType, CancellationToken cancellationToken = default(CancellationToken)) { - (await operations.UpdateSubscriptionLevelTaskStateWithHttpMessagesAsync(taskName, taskUpdateActionType, null, cancellationToken).ConfigureAwait(false)).Dispose(); + (await operations.UpdateSubscriptionLevelTaskStateWithHttpMessagesAsync(ascLocation, taskName, taskUpdateActionType, null, cancellationToken).ConfigureAwait(false)).Dispose(); } /// @@ -181,12 +205,16 @@ public static void UpdateSubscriptionLevelTaskState(this ITasksOperations operat /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// OData filter. Optional. /// - public static IPage ListByResourceGroup(this ITasksOperations operations, string resourceGroupName, string filter = default(string)) + public static IPage ListByResourceGroup(this ITasksOperations operations, string resourceGroupName, string ascLocation, string filter = default(string)) { - return operations.ListByResourceGroupAsync(resourceGroupName, filter).GetAwaiter().GetResult(); + return operations.ListByResourceGroupAsync(resourceGroupName, ascLocation, filter).GetAwaiter().GetResult(); } /// @@ -200,15 +228,19 @@ public static void UpdateSubscriptionLevelTaskState(this ITasksOperations operat /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// OData filter. Optional. /// /// /// The cancellation token. /// - public static async Task> ListByResourceGroupAsync(this ITasksOperations operations, string resourceGroupName, string filter = default(string), CancellationToken cancellationToken = default(CancellationToken)) + public static async Task> ListByResourceGroupAsync(this ITasksOperations operations, string resourceGroupName, string ascLocation, string filter = default(string), CancellationToken cancellationToken = default(CancellationToken)) { - using (var _result = await operations.ListByResourceGroupWithHttpMessagesAsync(resourceGroupName, filter, null, cancellationToken).ConfigureAwait(false)) + using (var _result = await operations.ListByResourceGroupWithHttpMessagesAsync(resourceGroupName, ascLocation, filter, null, cancellationToken).ConfigureAwait(false)) { return _result.Body; } @@ -225,12 +257,16 @@ public static void UpdateSubscriptionLevelTaskState(this ITasksOperations operat /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the task object, will be a GUID /// - public static SecurityTask GetResourceGroupLevelTask(this ITasksOperations operations, string resourceGroupName, string taskName) + public static SecurityTask GetResourceGroupLevelTask(this ITasksOperations operations, string resourceGroupName, string ascLocation, string taskName) { - return operations.GetResourceGroupLevelTaskAsync(resourceGroupName, taskName).GetAwaiter().GetResult(); + return operations.GetResourceGroupLevelTaskAsync(resourceGroupName, ascLocation, taskName).GetAwaiter().GetResult(); } /// @@ -244,15 +280,19 @@ public static SecurityTask GetResourceGroupLevelTask(this ITasksOperations opera /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the task object, will be a GUID /// /// /// The cancellation token. /// - public static async Task GetResourceGroupLevelTaskAsync(this ITasksOperations operations, string resourceGroupName, string taskName, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task GetResourceGroupLevelTaskAsync(this ITasksOperations operations, string resourceGroupName, string ascLocation, string taskName, CancellationToken cancellationToken = default(CancellationToken)) { - using (var _result = await operations.GetResourceGroupLevelTaskWithHttpMessagesAsync(resourceGroupName, taskName, null, cancellationToken).ConfigureAwait(false)) + using (var _result = await operations.GetResourceGroupLevelTaskWithHttpMessagesAsync(resourceGroupName, ascLocation, taskName, null, cancellationToken).ConfigureAwait(false)) { return _result.Body; } @@ -269,6 +309,10 @@ public static SecurityTask GetResourceGroupLevelTask(this ITasksOperations opera /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the task object, will be a GUID /// @@ -276,9 +320,9 @@ public static SecurityTask GetResourceGroupLevelTask(this ITasksOperations opera /// Type of the action to do on the task. Possible values include: 'Activate', /// 'Dismiss', 'Start', 'Resolve', 'Close' /// - public static void UpdateResourceGroupLevelTaskState(this ITasksOperations operations, string resourceGroupName, string taskName, string taskUpdateActionType) + public static void UpdateResourceGroupLevelTaskState(this ITasksOperations operations, string resourceGroupName, string ascLocation, string taskName, string taskUpdateActionType) { - operations.UpdateResourceGroupLevelTaskStateAsync(resourceGroupName, taskName, taskUpdateActionType).GetAwaiter().GetResult(); + operations.UpdateResourceGroupLevelTaskStateAsync(resourceGroupName, ascLocation, taskName, taskUpdateActionType).GetAwaiter().GetResult(); } /// @@ -292,6 +336,10 @@ public static void UpdateResourceGroupLevelTaskState(this ITasksOperations opera /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of the task object, will be a GUID /// @@ -302,9 +350,9 @@ public static void UpdateResourceGroupLevelTaskState(this ITasksOperations opera /// /// The cancellation token. /// - public static async Task UpdateResourceGroupLevelTaskStateAsync(this ITasksOperations operations, string resourceGroupName, string taskName, string taskUpdateActionType, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task UpdateResourceGroupLevelTaskStateAsync(this ITasksOperations operations, string resourceGroupName, string ascLocation, string taskName, string taskUpdateActionType, CancellationToken cancellationToken = default(CancellationToken)) { - (await operations.UpdateResourceGroupLevelTaskStateWithHttpMessagesAsync(resourceGroupName, taskName, taskUpdateActionType, null, cancellationToken).ConfigureAwait(false)).Dispose(); + (await operations.UpdateResourceGroupLevelTaskStateWithHttpMessagesAsync(resourceGroupName, ascLocation, taskName, taskUpdateActionType, null, cancellationToken).ConfigureAwait(false)).Dispose(); } /// diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/TopologyOperations.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/TopologyOperations.cs index 4a971359baa8..361834d225ab 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/TopologyOperations.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/TopologyOperations.cs @@ -237,6 +237,10 @@ internal TopologyOperations(SecurityCenterClient client) /// Gets a list that allows to build a topology view of a subscription and /// location. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Headers that will be added to request. /// @@ -258,7 +262,7 @@ internal TopologyOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task>> ListByHomeRegionWithHttpMessagesAsync(Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task>> ListByHomeRegionWithHttpMessagesAsync(string ascLocation, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -271,9 +275,9 @@ internal TopologyOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "Client.SubscriptionId", "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } string apiVersion = "2020-01-01"; // Tracing @@ -283,6 +287,7 @@ internal TopologyOperations(SecurityCenterClient client) { _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("apiVersion", apiVersion); tracingParameters.Add("cancellationToken", cancellationToken); ServiceClientTracing.Enter(_invocationId, this, "ListByHomeRegion", tracingParameters); @@ -291,7 +296,7 @@ internal TopologyOperations(SecurityCenterClient client) var _baseUrl = Client.BaseUri.AbsoluteUri; var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/providers/Microsoft.Security/locations/{ascLocation}/topologies").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); List _queryParameters = new List(); if (apiVersion != null) { @@ -429,6 +434,10 @@ internal TopologyOperations(SecurityCenterClient client) /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of a topology resources collection. /// @@ -453,7 +462,7 @@ internal TopologyOperations(SecurityCenterClient client) /// /// A response object containing the response body and response headers. /// - public async Task> GetWithHttpMessagesAsync(string resourceGroupName, string topologyResourceName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) + public async Task> GetWithHttpMessagesAsync(string resourceGroupName, string ascLocation, string topologyResourceName, Dictionary> customHeaders = null, CancellationToken cancellationToken = default(CancellationToken)) { if (Client.SubscriptionId == null) { @@ -485,9 +494,9 @@ internal TopologyOperations(SecurityCenterClient client) throw new ValidationException(ValidationRules.Pattern, "resourceGroupName", "^[-\\w\\._\\(\\)]+$"); } } - if (Client.AscLocation == null) + if (ascLocation == null) { - throw new ValidationException(ValidationRules.CannotBeNull, "this.Client.AscLocation"); + throw new ValidationException(ValidationRules.CannotBeNull, "ascLocation"); } if (topologyResourceName == null) { @@ -502,6 +511,7 @@ internal TopologyOperations(SecurityCenterClient client) _invocationId = ServiceClientTracing.NextInvocationId.ToString(); Dictionary tracingParameters = new Dictionary(); tracingParameters.Add("resourceGroupName", resourceGroupName); + tracingParameters.Add("ascLocation", ascLocation); tracingParameters.Add("topologyResourceName", topologyResourceName); tracingParameters.Add("apiVersion", apiVersion); tracingParameters.Add("cancellationToken", cancellationToken); @@ -512,7 +522,7 @@ internal TopologyOperations(SecurityCenterClient client) var _url = new System.Uri(new System.Uri(_baseUrl + (_baseUrl.EndsWith("/") ? "" : "/")), "subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/locations/{ascLocation}/topologies/{topologyResourceName}").ToString(); _url = _url.Replace("{subscriptionId}", System.Uri.EscapeDataString(Client.SubscriptionId)); _url = _url.Replace("{resourceGroupName}", System.Uri.EscapeDataString(resourceGroupName)); - _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(Client.AscLocation)); + _url = _url.Replace("{ascLocation}", System.Uri.EscapeDataString(ascLocation)); _url = _url.Replace("{topologyResourceName}", System.Uri.EscapeDataString(topologyResourceName)); List _queryParameters = new List(); if (apiVersion != null) diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/TopologyOperationsExtensions.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/TopologyOperationsExtensions.cs index a9873ee82612..76750f606d44 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/TopologyOperationsExtensions.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Generated/TopologyOperationsExtensions.cs @@ -56,9 +56,13 @@ public static IPage List(this ITopologyOperations operations) /// /// The operations group for this extension method. /// - public static IPage ListByHomeRegion(this ITopologyOperations operations) + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// + public static IPage ListByHomeRegion(this ITopologyOperations operations, string ascLocation) { - return operations.ListByHomeRegionAsync().GetAwaiter().GetResult(); + return operations.ListByHomeRegionAsync(ascLocation).GetAwaiter().GetResult(); } /// @@ -68,12 +72,16 @@ public static IPage ListByHomeRegion(this ITopologyOperations /// /// The operations group for this extension method. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// The cancellation token. /// - public static async Task> ListByHomeRegionAsync(this ITopologyOperations operations, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task> ListByHomeRegionAsync(this ITopologyOperations operations, string ascLocation, CancellationToken cancellationToken = default(CancellationToken)) { - using (var _result = await operations.ListByHomeRegionWithHttpMessagesAsync(null, cancellationToken).ConfigureAwait(false)) + using (var _result = await operations.ListByHomeRegionWithHttpMessagesAsync(ascLocation, null, cancellationToken).ConfigureAwait(false)) { return _result.Body; } @@ -89,12 +97,16 @@ public static IPage ListByHomeRegion(this ITopologyOperations /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of a topology resources collection. /// - public static TopologyResource Get(this ITopologyOperations operations, string resourceGroupName, string topologyResourceName) + public static TopologyResource Get(this ITopologyOperations operations, string resourceGroupName, string ascLocation, string topologyResourceName) { - return operations.GetAsync(resourceGroupName, topologyResourceName).GetAwaiter().GetResult(); + return operations.GetAsync(resourceGroupName, ascLocation, topologyResourceName).GetAwaiter().GetResult(); } /// @@ -107,15 +119,19 @@ public static TopologyResource Get(this ITopologyOperations operations, string r /// The name of the resource group within the user's subscription. The name is /// case insensitive. /// + /// + /// The location where ASC stores the data of the subscription. can be + /// retrieved from Get locations + /// /// /// Name of a topology resources collection. /// /// /// The cancellation token. /// - public static async Task GetAsync(this ITopologyOperations operations, string resourceGroupName, string topologyResourceName, CancellationToken cancellationToken = default(CancellationToken)) + public static async Task GetAsync(this ITopologyOperations operations, string resourceGroupName, string ascLocation, string topologyResourceName, CancellationToken cancellationToken = default(CancellationToken)) { - using (var _result = await operations.GetWithHttpMessagesAsync(resourceGroupName, topologyResourceName, null, cancellationToken).ConfigureAwait(false)) + using (var _result = await operations.GetWithHttpMessagesAsync(resourceGroupName, ascLocation, topologyResourceName, null, cancellationToken).ConfigureAwait(false)) { return _result.Body; } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Microsoft.Azure.Management.SecurityCenter.csproj b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Microsoft.Azure.Management.SecurityCenter.csproj index 2607b8ebc075..baf546429bc1 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Microsoft.Azure.Management.SecurityCenter.csproj +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/src/Microsoft.Azure.Management.SecurityCenter.csproj @@ -5,11 +5,11 @@ Microsoft.Azure.Management.SecurityCenter - Provides developers with libraries for the updated Azure Security Center platform under Azure Resource manager to view and manage security posture in and outside Azure. - 3.0.0 + Provides developers with libraries for the updated Microsoft Defender for Cloud under Azure Resource manager to view and manage security posture in and outside Azure. + 4.0.0 Microsoft.Azure.Management.SecurityCenter management;security center;security;IoT security; - Updated SDK client. Bumpes settings API Version + Updated SDK client. $(SdkTargetFx) diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/AdaptiveApplicationControls/AdaptiveApplicationControlsTests.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/AdaptiveApplicationControls/AdaptiveApplicationControlsTests.cs index 48504b2476c0..d5ee9ec9ee49 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/AdaptiveApplicationControls/AdaptiveApplicationControlsTests.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/AdaptiveApplicationControls/AdaptiveApplicationControlsTests.cs @@ -14,6 +14,8 @@ public class AdaptiveApplicationControlsTests : TestBase public static TestEnvironment TestEnvironment { get; private set; } + public const string _ascLocation = "centralus"; + private static SecurityCenterClient GetSecurityCenterClient(MockContext context) { if (TestEnvironment == null && HttpMockServer.Mode == HttpRecorderMode.Record) @@ -27,8 +29,6 @@ private static SecurityCenterClient GetSecurityCenterClient(MockContext context) ? context.GetServiceClient(TestEnvironment, handlers: handler) : context.GetServiceClient(handlers: handler); - securityCenterClient.AscLocation = "centralus"; - return securityCenterClient; } @@ -58,9 +58,9 @@ public void AdaptiveApplicationControls_Put() configurationStatus: "NoStatus", sourceSystem: "Azure_AppLocker"); - var createdGroup = securityCenterClient.AdaptiveApplicationControls.Put("TestGroup", adaptiveApplicationControlGroup); + var createdGroup = securityCenterClient.AdaptiveApplicationControls.Put(_ascLocation, "TestGroup", adaptiveApplicationControlGroup); - ValidateCreatedAdaptiveApplicationControlGroup(createdGroup, securityCenterClient.AscLocation, "TestGroup"); + ValidateCreatedAdaptiveApplicationControlGroup(createdGroup, _ascLocation, "TestGroup"); } } @@ -70,7 +70,7 @@ public void AdaptiveApplicationControls_Get() using (var context = MockContext.Start(this.GetType())) { var securityCenterClient = GetSecurityCenterClient(context); - var group = securityCenterClient.AdaptiveApplicationControls.Get("TestGroup"); + var group = securityCenterClient.AdaptiveApplicationControls.Get(_ascLocation, "TestGroup"); ValidateAdaptiveApplicationControlGroup(group); } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/AdaptiveNetworkHardenings/AdaptiveNetworkHardeningsTests.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/AdaptiveNetworkHardenings/AdaptiveNetworkHardeningsTests.cs index 2d8ac7aceb08..d78f31243766 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/AdaptiveNetworkHardenings/AdaptiveNetworkHardeningsTests.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/AdaptiveNetworkHardenings/AdaptiveNetworkHardeningsTests.cs @@ -15,7 +15,7 @@ public class AdaptiveNetworkHardeningsTests : TestBase #region Test setup public static TestEnvironment TestEnvironment { get; private set; } - + private static SecurityCenterClient GetSecurityCenterClient(MockContext context) { if (TestEnvironment == null && HttpMockServer.Mode == HttpRecorderMode.Record) @@ -29,8 +29,6 @@ private static SecurityCenterClient GetSecurityCenterClient(MockContext context) ? context.GetServiceClient(TestEnvironment, handlers: handler) : context.GetServiceClient(handlers: handler); - securityCenterClient.AscLocation = "westcentralus"; - return securityCenterClient; } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/AdvancedThreatProtection/AdvancedThreatProtectionTests.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/AdvancedThreatProtection/AdvancedThreatProtectionTests.cs index 20f350912b55..73f60598fd46 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/AdvancedThreatProtection/AdvancedThreatProtectionTests.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/AdvancedThreatProtection/AdvancedThreatProtectionTests.cs @@ -35,8 +35,6 @@ private static SecurityCenterClient GetSecurityCenterClient(MockContext context) ? context.GetServiceClient(TestEnvironment, handlers: handler) : context.GetServiceClient(handlers: handler); - securityCenterClient.AscLocation = "centralus"; - return securityCenterClient; } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Alerts/SecurityAlertsTests.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Alerts/SecurityAlertsTests.cs index 2742bf90677a..5d72e5741ab5 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Alerts/SecurityAlertsTests.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Alerts/SecurityAlertsTests.cs @@ -1,6 +1,7 @@ // Copyright (c) Microsoft Corporation. All rights reserved. // Licensed under the MIT License. See License.txt in the project root for license information. +using System.Collections.Generic; using System.IO; using System.Linq; using System.Net; @@ -20,6 +21,8 @@ public class SecurityAlertsTests : TestBase { #region Test setup + private const string _ascLocation = "westeurope"; + private static string SubscriptionId = "487bb485-b5b0-471e-9c0d-10717612f869"; public static TestEnvironment TestEnvironment { get; private set; } @@ -38,20 +41,9 @@ private static SecurityCenterClient GetSecurityCenterClient(MockContext context) ? context.GetServiceClient(TestEnvironment, handlers: handler) : context.GetServiceClient(handlers: handler); - securityCenterClient.AscLocation = "westeurope"; - return securityCenterClient; } - private static SecurityCenterClient GetSecurityCenterClientWithLocation(MockContext context, string location) - { - var client = GetSecurityCenterClient(context); - - client.AscLocation = location; - - return client; - } - #endregion #region Alerts @@ -79,12 +71,11 @@ public async Task SecurityAlerts_GetResourceGroupLevelAlerts() var firstAlert = alerts.First(); var alertLocation = GetAlertLocation(firstAlert.Id); - var clientWithLocation = GetSecurityCenterClientWithLocation(context, alertLocation); var alertName = firstAlert.Name; var resourceGroupName = Regex.Match(firstAlert.Id, @"(?<=resourceGroups/)[^/]+?(?=/)").Value; //var foundAlert = await clientWithLocation.Alerts.GetResourceGroupLevelAlertsAsync(alertName, resourceGroupName); - var foundAlert = await clientWithLocation.Alerts.GetResourceGroupLevelAsync(alertName, resourceGroupName); + var foundAlert = await securityCenterClient.Alerts.GetResourceGroupLevelAsync(alertLocation, alertName, resourceGroupName); ValidateAlert(foundAlert); } } @@ -101,9 +92,8 @@ public async Task SecurityAlerts_GetSubscriptionLevelAlert() var firstAlert = alerts.First(); var alertLocation = GetAlertLocation(firstAlert.Id); - var clientWithLocation = GetSecurityCenterClientWithLocation(context, alertLocation); - //var alert = clientWithLocation.Alerts.GetSubscriptionLevelAlert(firstAlert.Name); - var alert = clientWithLocation.Alerts.GetSubscriptionLevel(firstAlert.Name); + + var alert = securityCenterClient.Alerts.GetSubscriptionLevel(alertLocation, firstAlert.Name); ValidateAlert(alert); } @@ -140,9 +130,9 @@ public async Task SecurityAlerts_ListResourceGroupLevelAlertsByRegion() while (!enumerator.Current.Id.Contains("resourceGroups") && enumerator.MoveNext()) ; - securityCenterClient.AscLocation = Regex.Match(enumerator.Current.Id, @"(?<=locations/)[^/]+?(?=/)").Value; + var location = Regex.Match(enumerator.Current.Id, @"(?<=locations/)[^/]+?(?=/)").Value; //var rgAlerts = securityCenterClient.Alerts.ListResourceGroupLevelAlertsByRegion(Regex.Match(enumerator.Current.Id, @"(?<=resourceGroups/)[^/]+?(?=/)").Value); - var rgAlerts = securityCenterClient.Alerts.ListResourceGroupLevelByRegion(Regex.Match(enumerator.Current.Id, @"(?<=resourceGroups/)[^/]+?(?=/)").Value); + var rgAlerts = securityCenterClient.Alerts.ListResourceGroupLevelByRegion(location, Regex.Match(enumerator.Current.Id, @"(?<=resourceGroups/)[^/]+?(?=/)").Value); ValidateAlerts(rgAlerts); } } @@ -156,10 +146,10 @@ public async Task SecurityAlerts_ListSubscriptionLevelAlertsByRegion() var alerts = await securityCenterClient.Alerts.ListAsync(); ValidateAlerts(alerts); - securityCenterClient.AscLocation = Regex.Match(alerts.First().Id, @"(?<=locations/)[^/]+?(?=/)").Value; + var location = Regex.Match(alerts.First().Id, @"(?<=locations/)[^/]+?(?=/)").Value; //var regionAlerts = securityCenterClient.Alerts.ListSubscriptionLevelAlertsByRegion(); - var regionAlerts = securityCenterClient.Alerts.ListSubscriptionLevelByRegion(); + var regionAlerts = securityCenterClient.Alerts.ListSubscriptionLevelByRegion(location); ValidateAlerts(regionAlerts); } } @@ -173,10 +163,10 @@ public async Task SecurityAlerts_UpdateResourceGroupLevelAlertState() var alerts = await securityCenterClient.Alerts.ListAsync(); ValidateAlerts(alerts); - securityCenterClient.AscLocation = Regex.Match(alerts.First().Id, @"(?<=locations/)[^/]+?(?=/)").Value; + var location = Regex.Match(alerts.First().Id, @"(?<=locations/)[^/]+?(?=/)").Value; //securityCenterClient.Alerts.UpdateResourceGroupLevelAlertStateToDismiss(alerts.First().Name, Regex.Match(alerts.First().Id, @"(?<=resourceGroups/)[^/]+?(?=/)").Value); - securityCenterClient.Alerts.UpdateResourceGroupLevelStateToDismiss(alerts.First().Name, Regex.Match(alerts.First().Id, @"(?<=resourceGroups/)[^/]+?(?=/)").Value); + securityCenterClient.Alerts.UpdateResourceGroupLevelStateToDismiss(location, alerts.First().Name, Regex.Match(alerts.First().Id, @"(?<=resourceGroups/)[^/]+?(?=/)").Value); } } @@ -189,10 +179,29 @@ public async Task SecurityAlerts_UpdateSubscriptionLevelAlertState() var alerts = await securityCenterClient.Alerts.ListAsync(); ValidateAlerts(alerts); - securityCenterClient.AscLocation = Regex.Match(alerts.First().Id, @"(?<=locations/)[^/]+?(?=/)").Value; + var location = Regex.Match(alerts.First().Id, @"(?<=locations/)[^/]+?(?=/)").Value; //securityCenterClient.Alerts.UpdateSubscriptionLevelAlertStateToDismiss(alerts.First().Name); - securityCenterClient.Alerts.UpdateSubscriptionLevelStateToDismiss(alerts.First().Name); + securityCenterClient.Alerts.UpdateSubscriptionLevelStateToDismiss(location, alerts.First().Name); + } + } + + [Fact] + public async Task SecurityAlerts_SimulateAlert() + { + using (var context = MockContext.Start(this.GetType())) + { + var securityCenterClient = GetSecurityCenterClient(context); + await securityCenterClient.Alerts.SimulateAsync( + "centralus", + new AlertSimulatorRequestProperties( + new Dictionary{ + { "kind", "Bundles"}, + { "bundles", new List { "StorageAccounts" } } + })); + + // Assert + // No exception } } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/AllowedConnections/AllowedConnectionsTests.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/AllowedConnections/AllowedConnectionsTests.cs index 9a53d225cf35..b68b8f3c0262 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/AllowedConnections/AllowedConnectionsTests.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/AllowedConnections/AllowedConnectionsTests.cs @@ -15,6 +15,8 @@ public class AllowedConnectionsTests : TestBase public static TestEnvironment TestEnvironment { get; private set; } + private const string _ascLocation = "westcentralus"; + private static SecurityCenterClient GetSecurityCenterClient(MockContext context) { if (TestEnvironment == null && HttpMockServer.Mode == HttpRecorderMode.Record) @@ -28,7 +30,6 @@ private static SecurityCenterClient GetSecurityCenterClient(MockContext context) ? context.GetServiceClient(TestEnvironment, handlers: handler) : context.GetServiceClient(handlers: handler); - securityCenterClient.AscLocation = "westcentralus"; return securityCenterClient; } @@ -54,7 +55,7 @@ public void AllowedConnections_Get() using (var context = MockContext.Start(this.GetType())) { var securityCenterClient = GetSecurityCenterClient(context); - var allowedConnectionsResource = securityCenterClient.AllowedConnections.Get("MyResourceGroup", "internal"); + var allowedConnectionsResource = securityCenterClient.AllowedConnections.Get("MyResourceGroup", _ascLocation, "internal"); ValidateAllowedConnectionsResource(allowedConnectionsResource); } } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Assessments/AssessmentsTests.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Assessments/AssessmentsTests.cs index fa0966043a28..5b43695a7dae 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Assessments/AssessmentsTests.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Assessments/AssessmentsTests.cs @@ -20,7 +20,6 @@ public class AssessmentsTests : TestBase private static readonly string ResourceGroupName = "subAssessments_sdk_tests"; // A maximum of 3 owners should be designated for your subscription private static readonly string AssessmentName = "6f90a6d6-d4d6-0794-0ec1-98fa77878c2e"; - private static readonly string AscLocation = "centralus"; private static TestEnvironment TestEnvironment { get; set; } #endregion @@ -37,8 +36,6 @@ private static SecurityCenterClient GetSecurityCenterClient(MockContext context) ? context.GetServiceClient(TestEnvironment, handlers: handler) : context.GetServiceClient(handlers: handler); - securityCenterClient.AscLocation = AscLocation; - return securityCenterClient; } @@ -120,7 +117,7 @@ public void Assessments_CreateOrUpdate_ResourceGroup_Scope() } }; - var assessmentMetadata = new SecurityAssessmentMetadata() + var assessmentMetadata = new SecurityAssessmentMetadataResponse() { DisplayName = "Customer managed metadata", Description = "Customer managed description", @@ -139,7 +136,7 @@ public void Assessments_CreateOrUpdate_ResourceGroup_Scope() #endregion #region Validations - private static void Validate(IPage ret) + private static void Validate(IPage ret) { Assert.True(ret.IsAny(), "Got empty list"); foreach (var item in ret) @@ -153,7 +150,7 @@ private static void Validate(IPage ret) /// assignable means not null: serialization \ deserialization was successful /// /// - private static void ValidateResourceDetails(IPage ret) + private static void ValidateResourceDetails(IPage ret) { foreach (var item in ret) { @@ -166,7 +163,7 @@ private static void ValidateResourceDetails(IPage ret) /// assignable means not null: serialization \ deserialization was successful /// /// - private static void ValidateResourceDetails(SecurityAssessment item) + private static void ValidateResourceDetails(SecurityAssessmentResponse item) { Assert.NotNull(item); ValidateResourceDetails(item.ResourceDetails); diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/AutoProvisionningSettings/AutoProvisioningSettingsTests.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/AutoProvisionningSettings/AutoProvisioningSettingsTests.cs index d3c5df10eb45..8e98834886e3 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/AutoProvisionningSettings/AutoProvisioningSettingsTests.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/AutoProvisionningSettings/AutoProvisioningSettingsTests.cs @@ -32,8 +32,6 @@ private static SecurityCenterClient GetSecurityCenterClient(MockContext context) ? context.GetServiceClient(TestEnvironment, handlers: handler) : context.GetServiceClient(handlers: handler); - securityCenterClient.AscLocation = "centralus"; - return securityCenterClient; } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Compliances/CompliancesTests.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Compliances/CompliancesTests.cs index c06c72d83a67..62667df0334f 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Compliances/CompliancesTests.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Compliances/CompliancesTests.cs @@ -34,8 +34,6 @@ private static SecurityCenterClient GetSecurityCenterClient(MockContext context) ? context.GetServiceClient(TestEnvironment, handlers: handler) : context.GetServiceClient(handlers: handler); - securityCenterClient.AscLocation = "centralus"; - return securityCenterClient; } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/DiscoveredSecuritySolutions/DiscoveredSecuritySolutionsTests.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/DiscoveredSecuritySolutions/DiscoveredSecuritySolutionsTests.cs index 60a57e1072e0..b452a992b25b 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/DiscoveredSecuritySolutions/DiscoveredSecuritySolutionsTests.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/DiscoveredSecuritySolutions/DiscoveredSecuritySolutionsTests.cs @@ -19,6 +19,8 @@ public class DiscoveredSecuritySolutionsTests : TestBase public static TestEnvironment TestEnvironment { get; private set; } + private const string _ascLocation = "centralus"; + private static SecurityCenterClient GetSecurityCenterClient(MockContext context) { if (TestEnvironment == null && HttpMockServer.Mode == HttpRecorderMode.Record) @@ -32,7 +34,6 @@ private static SecurityCenterClient GetSecurityCenterClient(MockContext context) ? context.GetServiceClient(TestEnvironment, handlers: handler) : context.GetServiceClient(handlers: handler); - securityCenterClient.AscLocation = "centralus"; return securityCenterClient; } @@ -58,7 +59,7 @@ public void DiscoveredSecuritySolutions_Get() using (var context = MockContext.Start(this.GetType())) { var securityCenterClient = GetSecurityCenterClient(context); - var discoveredSecuritySolution = securityCenterClient.DiscoveredSecuritySolutions.Get("myService1", "ContosoWAF2"); + var discoveredSecuritySolution = securityCenterClient.DiscoveredSecuritySolutions.Get("myService1", _ascLocation, "ContosoWAF2"); ValidateDiscoveredSecuritySolution(discoveredSecuritySolution); } } @@ -69,7 +70,7 @@ public void DiscoveredSecuritySolutions_ListByHomeRegion() using (var context = MockContext.Start(this.GetType())) { var securityCenterClient = GetSecurityCenterClient(context); - var discoveredSecuritySolutions = securityCenterClient.DiscoveredSecuritySolutions.ListByHomeRegion(); + var discoveredSecuritySolutions = securityCenterClient.DiscoveredSecuritySolutions.ListByHomeRegion(_ascLocation); ValidateDiscoveredSecuritySolutions(discoveredSecuritySolutions); } } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/ExternalSecuritySolutions/ExternalSecuritySolutionsTests.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/ExternalSecuritySolutions/ExternalSecuritySolutionsTests.cs index 1ede14895f24..8dc073b84f00 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/ExternalSecuritySolutions/ExternalSecuritySolutionsTests.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/ExternalSecuritySolutions/ExternalSecuritySolutionsTests.cs @@ -19,6 +19,8 @@ public class ExternalSecuritySolutionsTests : TestBase public static TestEnvironment TestEnvironment { get; private set; } + private const string _ascLocation = "centralus"; + private static SecurityCenterClient GetSecurityCenterClient(MockContext context) { if (TestEnvironment == null && HttpMockServer.Mode == HttpRecorderMode.Record) @@ -32,7 +34,6 @@ private static SecurityCenterClient GetSecurityCenterClient(MockContext context) ? context.GetServiceClient(TestEnvironment, handlers: handler) : context.GetServiceClient(handlers: handler); - securityCenterClient.AscLocation = "centralus"; return securityCenterClient; } @@ -67,7 +68,9 @@ public void ExternalSecuritySolutions_Get() Assert.Throws(() => { var externalSecuritySolution = securityCenterClient.ExternalSecuritySolutions.Get( - "defaultresourcegroup-eus", "aad_defaultworkspace-487bb485-b5b0-471e-9c0d-10717612f869-eus"); + "defaultresourcegroup-eus", + _ascLocation, + "aad_defaultworkspace-487bb485-b5b0-471e-9c0d-10717612f869-eus"); ValidateExternalSecuritySolution(externalSecuritySolution); }); @@ -83,7 +86,7 @@ public void ExternalSecuritySolutions_ListByHomeRegion() Assert.Throws(() => { var securityCenterClient = GetSecurityCenterClient(context); - var externalSecuritySolutions = securityCenterClient.ExternalSecuritySolutions.ListByHomeRegion(); + var externalSecuritySolutions = securityCenterClient.ExternalSecuritySolutions.ListByHomeRegion(_ascLocation); ValidateExternalSecuritySolutions(externalSecuritySolutions); }); } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/IoTSecuritySolution/IoTSecuritySolutionsTests.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/IoTSecuritySolution/IoTSecuritySolutionsTests.cs index a945a33663fc..2971bef4c3eb 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/IoTSecuritySolution/IoTSecuritySolutionsTests.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/IoTSecuritySolution/IoTSecuritySolutionsTests.cs @@ -39,8 +39,6 @@ private static SecurityCenterClient GetSecurityCenterClient(MockContext context) ? context.GetServiceClient(TestEnvironment, handlers: handler) : context.GetServiceClient(handlers: handler); - securityCenterClient.AscLocation = AscLocation; - return securityCenterClient; } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/IotSecuritySolutionAnalytics/IotSecuritySolutionAnalyticsTests.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/IotSecuritySolutionAnalytics/IotSecuritySolutionAnalyticsTests.cs index 486429953c71..a16318667d43 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/IotSecuritySolutionAnalytics/IotSecuritySolutionAnalyticsTests.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/IotSecuritySolutionAnalytics/IotSecuritySolutionAnalyticsTests.cs @@ -19,7 +19,6 @@ public class IotSecuritySolutionAnalyticsTests : TestBase private static readonly string ResourceGroupName = "IOT-ResourceGroup-CUS"; private static readonly string SolutionName = "securitySolution"; - private static readonly string AscLocation = "centralus"; private static TestEnvironment TestEnvironment { get; set; } private static SecurityCenterClient GetSecurityCenterClient(MockContext context) @@ -35,8 +34,6 @@ private static SecurityCenterClient GetSecurityCenterClient(MockContext context) ? context.GetServiceClient(TestEnvironment, handlers: handler) : context.GetServiceClient(handlers: handler); - securityCenterClient.AscLocation = AscLocation; - return securityCenterClient; } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/IotSecuritySolutionsAnalyticsAggregatedAlert/IotSecuritySolutionsAnalyticsAggregatedAlertTests.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/IotSecuritySolutionsAnalyticsAggregatedAlert/IotSecuritySolutionsAnalyticsAggregatedAlertTests.cs index 8db327a31e08..c774a5658b22 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/IotSecuritySolutionsAnalyticsAggregatedAlert/IotSecuritySolutionsAnalyticsAggregatedAlertTests.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/IotSecuritySolutionsAnalyticsAggregatedAlert/IotSecuritySolutionsAnalyticsAggregatedAlertTests.cs @@ -20,7 +20,6 @@ public class IotSecuritySolutionsAnalyticsAggregatedAlertTests : TestBase private static readonly string AggregatedAlertName = "IoT_AgentDroppedEvents/2019-05-26"; private static readonly string ResourceGroupName = "nir-test"; private static readonly string SolutionName = "singahub"; - private static readonly string AscLocation = "southeastasia"; private static TestEnvironment TestEnvironment { get; set; } private static SecurityCenterClient GetSecurityCenterClient(MockContext context) @@ -36,8 +35,6 @@ private static SecurityCenterClient GetSecurityCenterClient(MockContext context) ? context.GetServiceClient(TestEnvironment, handlers: handler) : context.GetServiceClient(handlers: handler); - securityCenterClient.AscLocation = AscLocation; - return securityCenterClient; } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/IotSecuritySolutionsAnalyticsRecommendation/IotSecuritySolutionsAnalyticsRecommendationTests.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/IotSecuritySolutionsAnalyticsRecommendation/IotSecuritySolutionsAnalyticsRecommendationTests.cs index a7587600c3f5..bb0b6222c444 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/IotSecuritySolutionsAnalyticsRecommendation/IotSecuritySolutionsAnalyticsRecommendationTests.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/IotSecuritySolutionsAnalyticsRecommendation/IotSecuritySolutionsAnalyticsRecommendationTests.cs @@ -21,7 +21,6 @@ public class IotSecuritySolutionsAnalyticsRecommendationTests : TestBase private static readonly string AggregatedRecommendationName = "IoT_OpenPorts"; private static readonly string ResourceGroupName = "ResourceGroup-CUS"; private static readonly string SolutionName = "IotHub-CUS"; - private static readonly string AscLocation = "centralus"; private static TestEnvironment TestEnvironment { get; set; } private static SecurityCenterClient GetSecurityCenterClient(MockContext context) @@ -38,8 +37,6 @@ private static SecurityCenterClient GetSecurityCenterClient(MockContext context) ? context.GetServiceClient(TestEnvironment, handlers: handler) : context.GetServiceClient(handlers: handler); - securityCenterClient.AscLocation = AscLocation; - return securityCenterClient; } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/IotSecuritySolutionsDeviceSecurityGroups/IotSecuritySolutionsDeviceSecurityGroupsTests.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/IotSecuritySolutionsDeviceSecurityGroups/IotSecuritySolutionsDeviceSecurityGroupsTests.cs index 0b0fa79a4a5c..bdd38f23cb50 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/IotSecuritySolutionsDeviceSecurityGroups/IotSecuritySolutionsDeviceSecurityGroupsTests.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/IotSecuritySolutionsDeviceSecurityGroups/IotSecuritySolutionsDeviceSecurityGroupsTests.cs @@ -19,7 +19,6 @@ public class IotSecuritySolutionsDeviceSecurityGroupsTests : TestBase private static readonly string SubscriptionId = "487bb485-b5b0-471e-9c0d-10717612f869"; private static readonly string ResourceGroupName = "IOT-ResourceGroup-CUS"; private static readonly string IotHubName = "SDK-IotHub-CUS"; - private static readonly string AscLocation = "centralus"; private static readonly string IotHubResourceId = $"/subscriptions/{SubscriptionId}/resourceGroups/{ResourceGroupName}/providers/Microsoft.Devices/IotHubs/{IotHubName}"; private static readonly string DeviceSecurityGroupName = "TestDeviceSecurityGroupName"; @@ -38,8 +37,6 @@ private static SecurityCenterClient GetSecurityCenterClient(MockContext context) ? context.GetServiceClient(TestEnvironment, handlers: handler) : context.GetServiceClient(handlers: handler); - securityCenterClient.AscLocation = AscLocation; - return securityCenterClient; } #endregion diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/JitNetworkAccessPolicies/JitNetworkAccessPoliciesTests.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/JitNetworkAccessPolicies/JitNetworkAccessPoliciesTests.cs index bef0c7a14b1e..1b49299a98e3 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/JitNetworkAccessPolicies/JitNetworkAccessPoliciesTests.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/JitNetworkAccessPolicies/JitNetworkAccessPoliciesTests.cs @@ -20,6 +20,8 @@ public class JitNetworkAccessPoliciesTests : TestBase public static TestEnvironment TestEnvironment { get; private set; } + private const string _ascLocation = "northeurope"; + private static SecurityCenterClient GetSecurityCenterClient(MockContext context) { if (TestEnvironment == null && HttpMockServer.Mode == HttpRecorderMode.Record) @@ -33,8 +35,6 @@ private static SecurityCenterClient GetSecurityCenterClient(MockContext context) ? context.GetServiceClient(TestEnvironment, handlers: handler) : context.GetServiceClient(handlers: handler); - securityCenterClient.AscLocation = "northeurope"; - return securityCenterClient; } @@ -59,7 +59,7 @@ public void JitNetworkAccessPolicies_Delete() using (var context = MockContext.Start(this.GetType())) { var securityCenterClient = GetSecurityCenterClient(context); - securityCenterClient.JitNetworkAccessPolicies.Delete("mainWS", "default"); + securityCenterClient.JitNetworkAccessPolicies.Delete("mainWS", _ascLocation, "default"); } } @@ -69,7 +69,7 @@ public void JitNetworkAccessPolicies_Get() using (var context = MockContext.Start(this.GetType())) { var securityCenterClient = GetSecurityCenterClient(context); - var jitNetworkAccessPolicy = securityCenterClient.JitNetworkAccessPolicies.Get("myService1", "default"); + var jitNetworkAccessPolicy = securityCenterClient.JitNetworkAccessPolicies.Get("myService1", _ascLocation, "default"); ValidateJitNetworkAccessPolicy(jitNetworkAccessPolicy); } } @@ -88,7 +88,7 @@ public void JitNetworkAccessPolicies_Initiate() } }; var virtualMachines = new List() { vm }; - securityCenterClient.JitNetworkAccessPolicies.Initiate("myService1", "default", virtualMachines); + securityCenterClient.JitNetworkAccessPolicies.Initiate("myService1", _ascLocation, "default", virtualMachines); } } @@ -98,7 +98,7 @@ public void JitNetworkAccessPolicies_ListByRegion() using (var context = MockContext.Start(this.GetType())) { var securityCenterClient = GetSecurityCenterClient(context); - var jitNetworkAccessPolicy = securityCenterClient.JitNetworkAccessPolicies.ListByRegion(); + var jitNetworkAccessPolicy = securityCenterClient.JitNetworkAccessPolicies.ListByRegion(_ascLocation); } } @@ -115,7 +115,7 @@ public void JitNetworkAccessPolicies_CreateOrUpdate() VirtualMachines = vm }; - var jitNetworkAccessPolicy = securityCenterClient.JitNetworkAccessPolicies.CreateOrUpdate("mainWS", "default", policy); + var jitNetworkAccessPolicy = securityCenterClient.JitNetworkAccessPolicies.CreateOrUpdate("mainWS", _ascLocation, "default", policy); ValidateJitNetworkAccessPolicy(jitNetworkAccessPolicy); } } @@ -137,7 +137,7 @@ public void JitNetworkAccessPolicies_ListByResourceGroupAndRegion() using (var context = MockContext.Start(this.GetType())) { var securityCenterClient = GetSecurityCenterClient(context); - var jitNetworkAccessPolicies = securityCenterClient.JitNetworkAccessPolicies.ListByResourceGroupAndRegion("myService1"); + var jitNetworkAccessPolicies = securityCenterClient.JitNetworkAccessPolicies.ListByResourceGroupAndRegion("myService1", _ascLocation); ValidateJitNetworkAccessPolicies(jitNetworkAccessPolicies); } } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Locations/LocationsTests.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Locations/LocationsTests.cs index 385cb57d7f9d..d08f5d7474cf 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Locations/LocationsTests.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Locations/LocationsTests.cs @@ -19,6 +19,8 @@ public class LocationsTests : TestBase public static TestEnvironment TestEnvironment { get; private set; } + private const string _ascLocation = "centralus"; + private static SecurityCenterClient GetSecurityCenterClient(MockContext context) { if (TestEnvironment == null && HttpMockServer.Mode == HttpRecorderMode.Record) @@ -32,8 +34,6 @@ private static SecurityCenterClient GetSecurityCenterClient(MockContext context) ? context.GetServiceClient(TestEnvironment, handlers: handler) : context.GetServiceClient(handlers: handler); - securityCenterClient.AscLocation = "centralus"; - return securityCenterClient; } @@ -58,7 +58,7 @@ public void SecurityLocations_Get() using (var context = MockContext.Start(this.GetType())) { var securityCenterClient = GetSecurityCenterClient(context); - var location = securityCenterClient.Locations.Get(); + var location = securityCenterClient.Locations.Get(_ascLocation); ValidateLocation(location); } } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Microsoft.Azure.Management.SecurityCenter.Tests.csproj b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Microsoft.Azure.Management.SecurityCenter.Tests.csproj index 9724f58a8a0b..c8e04f1d8bb7 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Microsoft.Azure.Management.SecurityCenter.Tests.csproj +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Microsoft.Azure.Management.SecurityCenter.Tests.csproj @@ -11,6 +11,9 @@ true true + + + diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Operations/OperationsTests.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Operations/OperationsTests.cs index 942ead0a9c5f..01c0b4fac59b 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Operations/OperationsTests.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Operations/OperationsTests.cs @@ -32,8 +32,6 @@ private static SecurityCenterClient GetSecurityCenterClient(MockContext context) ? context.GetServiceClient(TestEnvironment, handlers: handler) : context.GetServiceClient(handlers: handler); - securityCenterClient.AscLocation = "centralus"; - return securityCenterClient; } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Pricings/PricingsTests.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Pricings/PricingsTests.cs index 4e240cd1f0c8..3d5b320c431b 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Pricings/PricingsTests.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Pricings/PricingsTests.cs @@ -31,8 +31,6 @@ private static SecurityCenterClient GetSecurityCenterClient(MockContext context) ? context.GetServiceClient(TestEnvironment, handlers: handler) : context.GetServiceClient(handlers: handler); - securityCenterClient.AscLocation = "centralus"; - return securityCenterClient; } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/RegulatoryCompliance/RegulatoryComplianceAssessmentsTests.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/RegulatoryCompliance/RegulatoryComplianceAssessmentsTests.cs index 4217f2591f52..ad595fa4b658 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/RegulatoryCompliance/RegulatoryComplianceAssessmentsTests.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/RegulatoryCompliance/RegulatoryComplianceAssessmentsTests.cs @@ -17,7 +17,6 @@ public class RegulatoryComplianceAssessmentsTests : TestBase private static readonly string regulatoryComplianceStandardName = "PCI-DSS-3.2.1"; private static readonly string regulatoryComplianceControlName = "1.2.1"; private static readonly string regulatoryComplianceAssessmentName = "03a939af-16c9-467d-a68b-25e6c227eed3"; - private static readonly string AscLocation = "centralus"; private static TestEnvironment TestEnvironment { get; set; } #endregion @@ -34,8 +33,6 @@ private static SecurityCenterClient GetSecurityCenterClient(MockContext context) ? context.GetServiceClient(TestEnvironment, handlers: handler) : context.GetServiceClient(handlers: handler); - securityCenterClient.AscLocation = AscLocation; - return securityCenterClient; } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/RegulatoryCompliance/RegulatoryComplianceControlsTests.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/RegulatoryCompliance/RegulatoryComplianceControlsTests.cs index ff97cbebbf91..452c99b92150 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/RegulatoryCompliance/RegulatoryComplianceControlsTests.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/RegulatoryCompliance/RegulatoryComplianceControlsTests.cs @@ -16,7 +16,6 @@ public class RegulatoryComplianceControlsTests : TestBase #region Test setup private static readonly string regulatoryComplianceStandardName = "PCI-DSS-3.2.1"; private static readonly string regulatoryComplianceControlName = "1.2.1"; - private static readonly string AscLocation = "centralus"; private static TestEnvironment TestEnvironment { get; set; } #endregion @@ -33,8 +32,6 @@ private static SecurityCenterClient GetSecurityCenterClient(MockContext context) ? context.GetServiceClient(TestEnvironment, handlers: handler) : context.GetServiceClient(handlers: handler); - securityCenterClient.AscLocation = AscLocation; - return securityCenterClient; } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/RegulatoryCompliance/RegulatoryComplianceStandardsTests.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/RegulatoryCompliance/RegulatoryComplianceStandardsTests.cs index 0790236f2d14..d8309bdbdfcf 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/RegulatoryCompliance/RegulatoryComplianceStandardsTests.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/RegulatoryCompliance/RegulatoryComplianceStandardsTests.cs @@ -15,7 +15,6 @@ public class RegulatoryComplianceStandardsTests: TestBase { #region Test setup private static readonly string regulatoryComplianceStandardName = "PCI-DSS-3.2.1"; - private static readonly string AscLocation = "centralus"; private static TestEnvironment TestEnvironment { get; set; } #endregion @@ -32,8 +31,6 @@ private static SecurityCenterClient GetSecurityCenterClient(MockContext context) ? context.GetServiceClient(TestEnvironment, handlers: handler) : context.GetServiceClient(handlers: handler); - securityCenterClient.AscLocation = AscLocation; - return securityCenterClient; } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SecureScores/SecureScoreControlDefinitionsTests.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SecureScores/SecureScoreControlDefinitionsTests.cs index e2bfb9396bf5..efc8b4138ba7 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SecureScores/SecureScoreControlDefinitionsTests.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SecureScores/SecureScoreControlDefinitionsTests.cs @@ -12,7 +12,6 @@ namespace Microsoft.Azure.Management.SecurityCenter.Tests.SecureScores public class SecureScoreControlDefinitionsTests : TestBase { #region Test setup - private static readonly string AscLocation = "centralus"; private static TestEnvironment TestEnvironment { get; set; } #endregion @@ -29,8 +28,6 @@ private static SecurityCenterClient GetSecurityCenterClient(MockContext context) ? context.GetServiceClient(TestEnvironment, handlers: handler) : context.GetServiceClient(handlers: handler); - securityCenterClient.AscLocation = AscLocation; - return securityCenterClient; } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SecureScores/SecureScoreControlTests.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SecureScores/SecureScoreControlTests.cs index 5e07e292d2f0..1181bd899fa9 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SecureScores/SecureScoreControlTests.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SecureScores/SecureScoreControlTests.cs @@ -12,7 +12,6 @@ namespace Microsoft.Azure.Management.SecurityCenter.Tests.SecureScores public class SecureScoreControlTests : TestBase { #region Test setup - private static readonly string AscLocation = "centralus"; private static TestEnvironment TestEnvironment { get; set; } #endregion @@ -29,8 +28,6 @@ private static SecurityCenterClient GetSecurityCenterClient(MockContext context) ? context.GetServiceClient(TestEnvironment, handlers: handler) : context.GetServiceClient(handlers: handler); - securityCenterClient.AscLocation = AscLocation; - return securityCenterClient; } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SecureScores/SecureScoreTests.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SecureScores/SecureScoreTests.cs index 6d1cb293d08e..243d444b1878 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SecureScores/SecureScoreTests.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SecureScores/SecureScoreTests.cs @@ -12,7 +12,6 @@ namespace Microsoft.Azure.Management.SecurityCenter.Tests.SecureScores public class SecureScoreTests : TestBase { #region Test setup - private static readonly string AscLocation = "centralus"; private static TestEnvironment TestEnvironment { get; set; } #endregion @@ -29,8 +28,6 @@ private static SecurityCenterClient GetSecurityCenterClient(MockContext context) ? context.GetServiceClient(TestEnvironment, handlers: handler) : context.GetServiceClient(handlers: handler); - securityCenterClient.AscLocation = AscLocation; - return securityCenterClient; } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SecurityContacts/SecurityContactsTests.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SecurityContacts/SecurityContactsTests.cs index 77f57f0fc8a0..8071165d71a7 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SecurityContacts/SecurityContactsTests.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SecurityContacts/SecurityContactsTests.cs @@ -32,8 +32,6 @@ private static SecurityCenterClient GetSecurityCenterClient(MockContext context) ? context.GetServiceClient(TestEnvironment, handlers: handler) : context.GetServiceClient(handlers: handler); - securityCenterClient.AscLocation = "centralus"; - return securityCenterClient; } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/AssessmentsTests/Assessments_CreateOrUpdate_ResourceGroup_Scope.json b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/AssessmentsTests/Assessments_CreateOrUpdate_ResourceGroup_Scope.json index f5c6188f4ab0..65833dd45c2b 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/AssessmentsTests/Assessments_CreateOrUpdate_ResourceGroup_Scope.json +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/AssessmentsTests/Assessments_CreateOrUpdate_ResourceGroup_Scope.json @@ -1,22 +1,22 @@ { "Entries": [ { - "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessmentMetadata/9b0c3939-c9db-4ffc-ad4b-4673ff25cdd8?api-version=2020-01-01", - "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvYXNzZXNzbWVudE1ldGFkYXRhLzliMGMzOTM5LWM5ZGItNGZmYy1hZDRiLTQ2NzNmZjI1Y2RkOD9hcGktdmVyc2lvbj0yMDIwLTAxLTAx", + "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessmentMetadata/9b0c3939-c9db-4ffc-ad4b-4673ff25cdd8?api-version=2021-06-01", + "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvYXNzZXNzbWVudE1ldGFkYXRhLzliMGMzOTM5LWM5ZGItNGZmYy1hZDRiLTQ2NzNmZjI1Y2RkOD9hcGktdmVyc2lvbj0yMDIxLTA2LTAx", "RequestMethod": "PUT", "RequestBody": "{\r\n \"properties\": {\r\n \"displayName\": \"Customer managed metadata\",\r\n \"description\": \"Customer managed description\",\r\n \"severity\": \"Low\",\r\n \"assessmentType\": \"CustomerManaged\"\r\n }\r\n}", "RequestHeaders": { "x-ms-client-request-id": [ - "dc6391d7-e470-4b6e-8e51-70e2a0b37fda" + "a465b9eb-4544-4d2c-b4ed-554064f78f59" ], "Accept-Language": [ "en-US" ], "User-Agent": [ - "FxVersion/4.6.29321.03", + "FxVersion/4.700.22.11601", "OSName/Windows", - "OSVersion/Microsoft.Windows.10.0.19042.", - "Microsoft.Azure.Management.Security.SecurityCenterClient/2.2.0.0" + "OSVersion/Microsoft.Windows.10.0.22000", + "Microsoft.Azure.Management.Security.SecurityCenterClient/3.0.0.0" ], "Content-Type": [ "application/json; charset=utf-8" @@ -33,16 +33,16 @@ "no-cache" ], "x-ms-ratelimit-remaining-subscription-writes": [ - "1196" + "1199" ], "x-ms-request-id": [ - "1cd5aeb2-7f9a-4c6d-88db-4beaae11b0af" + "6b5d2e6c-03a4-42d0-9312-a2f1afc2e5a4" ], "x-ms-correlation-request-id": [ - "1cd5aeb2-7f9a-4c6d-88db-4beaae11b0af" + "6b5d2e6c-03a4-42d0-9312-a2f1afc2e5a4" ], "x-ms-routing-request-id": [ - "UKSOUTH:20201202T194908Z:1cd5aeb2-7f9a-4c6d-88db-4beaae11b0af" + "FRANCESOUTH:20220323T162211Z:6b5d2e6c-03a4-42d0-9312-a2f1afc2e5a4" ], "Strict-Transport-Security": [ "max-age=31536000; includeSubDomains" @@ -51,7 +51,7 @@ "nosniff" ], "Date": [ - "Wed, 02 Dec 2020 19:49:07 GMT" + "Wed, 23 Mar 2022 16:22:11 GMT" ], "Content-Length": [ "417" @@ -67,22 +67,22 @@ "StatusCode": 200 }, { - "RequestUri": "//subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.OperationalInsights/workspaces/TestServiceWS/providers/Microsoft.Security/assessments/9b0c3939-c9db-4ffc-ad4b-4673ff25cdd8?api-version=2020-01-01", - "EncodedRequestUri": "Ly9zdWJzY3JpcHRpb25zLzQ4N2JiNDg1LWI1YjAtNDcxZS05YzBkLTEwNzE3NjEyZjg2OS9yZXNvdXJjZUdyb3Vwcy9teVNlcnZpY2UxL3Byb3ZpZGVycy9NaWNyb3NvZnQuT3BlcmF0aW9uYWxJbnNpZ2h0cy93b3Jrc3BhY2VzL1Rlc3RTZXJ2aWNlV1MvcHJvdmlkZXJzL01pY3Jvc29mdC5TZWN1cml0eS9hc3Nlc3NtZW50cy85YjBjMzkzOS1jOWRiLTRmZmMtYWQ0Yi00NjczZmYyNWNkZDg/YXBpLXZlcnNpb249MjAyMC0wMS0wMQ==", + "RequestUri": "//subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.OperationalInsights/workspaces/TestServiceWS/providers/Microsoft.Security/assessments/9b0c3939-c9db-4ffc-ad4b-4673ff25cdd8?api-version=2021-06-01", + "EncodedRequestUri": "Ly9zdWJzY3JpcHRpb25zLzQ4N2JiNDg1LWI1YjAtNDcxZS05YzBkLTEwNzE3NjEyZjg2OS9yZXNvdXJjZUdyb3Vwcy9teVNlcnZpY2UxL3Byb3ZpZGVycy9NaWNyb3NvZnQuT3BlcmF0aW9uYWxJbnNpZ2h0cy93b3Jrc3BhY2VzL1Rlc3RTZXJ2aWNlV1MvcHJvdmlkZXJzL01pY3Jvc29mdC5TZWN1cml0eS9hc3Nlc3NtZW50cy85YjBjMzkzOS1jOWRiLTRmZmMtYWQ0Yi00NjczZmYyNWNkZDg/YXBpLXZlcnNpb249MjAyMS0wNi0wMQ==", "RequestMethod": "PUT", "RequestBody": "{\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\"\r\n },\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"cause\": \"NA\",\r\n \"description\": \"NA\"\r\n }\r\n }\r\n}", "RequestHeaders": { "x-ms-client-request-id": [ - "60afa5ee-f00c-4237-b69b-dd2aee42fd09" + "d189e289-c63b-4fa3-b489-a66da9a3e004" ], "Accept-Language": [ "en-US" ], "User-Agent": [ - "FxVersion/4.6.29321.03", + "FxVersion/4.700.22.11601", "OSName/Windows", - "OSVersion/Microsoft.Windows.10.0.19042.", - "Microsoft.Azure.Management.Security.SecurityCenterClient/2.2.0.0" + "OSVersion/Microsoft.Windows.10.0.22000", + "Microsoft.Azure.Management.Security.SecurityCenterClient/3.0.0.0" ], "Content-Type": [ "application/json; charset=utf-8" @@ -98,17 +98,17 @@ "Pragma": [ "no-cache" ], - "x-ms-ratelimit-remaining-subscription-writes": [ - "1195" + "x-ms-ratelimit-remaining-subscription-resource-requests": [ + "299" ], "x-ms-request-id": [ - "8c797140-5c7e-4574-ade6-798506cfa160" + "6e18ec89-7af4-4650-a016-93c240a1e25e" ], "x-ms-correlation-request-id": [ - "8c797140-5c7e-4574-ade6-798506cfa160" + "6e18ec89-7af4-4650-a016-93c240a1e25e" ], "x-ms-routing-request-id": [ - "UKSOUTH:20201202T194908Z:8c797140-5c7e-4574-ade6-798506cfa160" + "FRANCESOUTH:20220323T162213Z:6e18ec89-7af4-4650-a016-93c240a1e25e" ], "Strict-Transport-Security": [ "max-age=31536000; includeSubDomains" @@ -117,10 +117,10 @@ "nosniff" ], "Date": [ - "Wed, 02 Dec 2020 19:49:07 GMT" + "Wed, 23 Mar 2022 16:22:12 GMT" ], "Content-Length": [ - "619" + "704" ], "Content-Type": [ "application/json; charset=utf-8" @@ -129,12 +129,10 @@ "-1" ] }, - "ResponseBody": "{\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.OperationalInsights/workspaces/TestServiceWS/providers/Microsoft.Security/assessments/9b0c3939-c9db-4ffc-ad4b-4673ff25cdd8\",\r\n \"name\": \"9b0c3939-c9db-4ffc-ad4b-4673ff25cdd8\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.OperationalInsights/workspaces/TestServiceWS\"\r\n },\r\n \"displayName\": \"Customer managed metadata\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"cause\": \"NA\",\r\n \"description\": \"NA\"\r\n }\r\n }\r\n}", + "ResponseBody": "{\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.OperationalInsights/workspaces/TestServiceWS/providers/Microsoft.Security/assessments/9b0c3939-c9db-4ffc-ad4b-4673ff25cdd8\",\r\n \"name\": \"9b0c3939-c9db-4ffc-ad4b-4673ff25cdd8\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.OperationalInsights/workspaces/TestServiceWS\"\r\n },\r\n \"displayName\": \"Customer managed metadata\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"cause\": \"NA\",\r\n \"description\": \"NA\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n}", "StatusCode": 200 } ], "Names": {}, - "Variables": { - "SubscriptionId": "487bb485-b5b0-471e-9c0d-10717612f869" - } -} + "Variables": {} +} \ No newline at end of file diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/AssessmentsTests/Assessments_Get.json b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/AssessmentsTests/Assessments_Get.json index ef091b9dd951..a9e7c270ae9b 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/AssessmentsTests/Assessments_Get.json +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/AssessmentsTests/Assessments_Get.json @@ -1,22 +1,22 @@ { "Entries": [ { - "RequestUri": "//subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/6f90a6d6-d4d6-0794-0ec1-98fa77878c2e?api-version=2020-01-01", - "EncodedRequestUri": "Ly9zdWJzY3JpcHRpb25zLzQ4N2JiNDg1LWI1YjAtNDcxZS05YzBkLTEwNzE3NjEyZjg2OS9wcm92aWRlcnMvTWljcm9zb2Z0LlNlY3VyaXR5L2Fzc2Vzc21lbnRzLzZmOTBhNmQ2LWQ0ZDYtMDc5NC0wZWMxLTk4ZmE3Nzg3OGMyZT9hcGktdmVyc2lvbj0yMDIwLTAxLTAx", + "RequestUri": "//subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/6f90a6d6-d4d6-0794-0ec1-98fa77878c2e?api-version=2021-06-01", + "EncodedRequestUri": "Ly9zdWJzY3JpcHRpb25zLzQ4N2JiNDg1LWI1YjAtNDcxZS05YzBkLTEwNzE3NjEyZjg2OS9wcm92aWRlcnMvTWljcm9zb2Z0LlNlY3VyaXR5L2Fzc2Vzc21lbnRzLzZmOTBhNmQ2LWQ0ZDYtMDc5NC0wZWMxLTk4ZmE3Nzg3OGMyZT9hcGktdmVyc2lvbj0yMDIxLTA2LTAx", "RequestMethod": "GET", "RequestBody": "", "RequestHeaders": { "x-ms-client-request-id": [ - "6dab1e7e-cd22-4345-bf6d-763bda8bfa33" + "ab502404-3423-4da8-abb6-16dba7ee3b77" ], "Accept-Language": [ "en-US" ], "User-Agent": [ - "FxVersion/4.6.29321.03", + "FxVersion/4.700.22.11601", "OSName/Windows", - "OSVersion/Microsoft.Windows.10.0.19042.", - "Microsoft.Azure.Management.Security.SecurityCenterClient/2.1.0.0" + "OSVersion/Microsoft.Windows.10.0.22000", + "Microsoft.Azure.Management.Security.SecurityCenterClient/3.0.0.0" ] }, "ResponseHeaders": { @@ -30,13 +30,13 @@ "749" ], "x-ms-request-id": [ - "9fda7bac-dfaa-4af3-aa18-2ca4e8c49fbc" + "61cbf317-f01f-4a28-a036-ca8cdb3ae6d9" ], "x-ms-correlation-request-id": [ - "9fda7bac-dfaa-4af3-aa18-2ca4e8c49fbc" + "61cbf317-f01f-4a28-a036-ca8cdb3ae6d9" ], "x-ms-routing-request-id": [ - "UKSOUTH:20201105T085629Z:9fda7bac-dfaa-4af3-aa18-2ca4e8c49fbc" + "FRANCESOUTH:20220323T162210Z:61cbf317-f01f-4a28-a036-ca8cdb3ae6d9" ], "Strict-Transport-Security": [ "max-age=31536000; includeSubDomains" @@ -45,10 +45,10 @@ "nosniff" ], "Date": [ - "Thu, 05 Nov 2020 08:56:28 GMT" + "Wed, 23 Mar 2022 16:22:10 GMT" ], "Content-Length": [ - "637" + "779" ], "Content-Type": [ "application/json; charset=utf-8" @@ -57,7 +57,7 @@ "-1" ] }, - "ResponseBody": "{\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/6f90a6d6-d4d6-0794-0ec1-98fa77878c2e\",\r\n \"name\": \"6f90a6d6-d4d6-0794-0ec1-98fa77878c2e\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"A maximum of 3 owners should be designated for your subscription\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"identityDesignateLessThanXOwnersObjectIdList\": \"[\\\"56b8f04c-b471-415a-bbc2-74570bd022de\\\",\\\"870e8d5e-f9b0-48eb-9893-ad00767f3b16\\\",\\\"af29e494-977e-4749-acb6-6fe3a10c56aa\\\"]\"\r\n }\r\n }\r\n}", + "ResponseBody": "{\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/6f90a6d6-d4d6-0794-0ec1-98fa77878c2e\",\r\n \"name\": \"6f90a6d6-d4d6-0794-0ec1-98fa77878c2e\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"A maximum of 3 owners should be designated for subscriptions\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-09-19T20:32:53.6059449Z\",\r\n \"firstEvaluationDate\": \"2021-09-19T20:32:53.6059449Z\"\r\n },\r\n \"additionalData\": {\r\n \"identityDesignateLessThanXOwnersObjectIdList\": \"[\\\"56b8f04c-b471-415a-bbc2-74570bd022de\\\",\\\"af29e494-977e-4749-acb6-6fe3a10c56aa\\\",\\\"25b2be9f-65f7-491e-9e53-61fa1b39fa8a\\\",\\\"08ebb2ca-8554-40f6-91a8-f274313fc8ae\\\"]\"\r\n }\r\n }\r\n}", "StatusCode": 200 } ], diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/AssessmentsTests/Assessments_List_ResourceGroup_Scope.json b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/AssessmentsTests/Assessments_List_ResourceGroup_Scope.json index c48ab9764b2c..6d24d601c857 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/AssessmentsTests/Assessments_List_ResourceGroup_Scope.json +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/AssessmentsTests/Assessments_List_ResourceGroup_Scope.json @@ -1,22 +1,22 @@ { "Entries": [ { - "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/subAssessments_sdk_tests/providers/Microsoft.Security/assessments?api-version=2020-01-01", - "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Jlc291cmNlR3JvdXBzL3N1YkFzc2Vzc21lbnRzX3Nka190ZXN0cy9wcm92aWRlcnMvTWljcm9zb2Z0LlNlY3VyaXR5L2Fzc2Vzc21lbnRzP2FwaS12ZXJzaW9uPTIwMjAtMDEtMDE=", + "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/subAssessments_sdk_tests/providers/Microsoft.Security/assessments?api-version=2021-06-01", + "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Jlc291cmNlR3JvdXBzL3N1YkFzc2Vzc21lbnRzX3Nka190ZXN0cy9wcm92aWRlcnMvTWljcm9zb2Z0LlNlY3VyaXR5L2Fzc2Vzc21lbnRzP2FwaS12ZXJzaW9uPTIwMjEtMDYtMDE=", "RequestMethod": "GET", "RequestBody": "", "RequestHeaders": { "x-ms-client-request-id": [ - "266cf7f3-78c3-457b-a7de-9d3e0a0b75fa" + "2182cc4d-2b4b-4aa2-a86c-b774b8c80768" ], "Accept-Language": [ "en-US" ], "User-Agent": [ - "FxVersion/4.6.29321.03", + "FxVersion/4.700.22.11601", "OSName/Windows", - "OSVersion/Microsoft.Windows.10.0.19042.", - "Microsoft.Azure.Management.Security.SecurityCenterClient/2.1.0.0" + "OSVersion/Microsoft.Windows.10.0.22000", + "Microsoft.Azure.Management.Security.SecurityCenterClient/3.0.0.0" ] }, "ResponseHeaders": { @@ -30,13 +30,13 @@ "749" ], "x-ms-request-id": [ - "ff32f440-64d8-4240-a9d1-86e99044a9e3" + "7f7d9b30-ca56-4c96-b648-583b87074454" ], "x-ms-correlation-request-id": [ - "ff32f440-64d8-4240-a9d1-86e99044a9e3" + "7f7d9b30-ca56-4c96-b648-583b87074454" ], "x-ms-routing-request-id": [ - "UKSOUTH:20201105T085628Z:ff32f440-64d8-4240-a9d1-86e99044a9e3" + "FRANCESOUTH:20220323T162207Z:7f7d9b30-ca56-4c96-b648-583b87074454" ], "Strict-Transport-Security": [ "max-age=31536000; includeSubDomains" @@ -45,10 +45,10 @@ "nosniff" ], "Date": [ - "Thu, 05 Nov 2020 08:56:27 GMT" + "Wed, 23 Mar 2022 16:22:07 GMT" ], "Content-Length": [ - "958" + "7647" ], "Content-Type": [ "application/json; charset=utf-8" @@ -57,7 +57,7 @@ "-1" ] }, - "ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/subAssessments_sdk_tests/providers/Microsoft.ContainerRegistry/registries/sdkRef/providers/Microsoft.Security/assessments/dbd0cb49-b563-45e7-9724-889e799fa648\",\r\n \"name\": \"dbd0cb49-b563-45e7-9724-889e799fa648\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/subAssessments_sdk_tests/providers/Microsoft.ContainerRegistry/registries/sdkRef\"\r\n },\r\n \"displayName\": \"Vulnerabilities in Azure Container Registry images should be remediated (powered by Qualys)\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/subAssessments_sdk_tests/providers/Microsoft.ContainerRegistry/registries/sdkRef/providers/Microsoft.Security/assessments/dbd0cb49-b563-45e7-9724-889e799fa648/subAssessments\"\r\n }\r\n }\r\n }\r\n ]\r\n}", + "ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/subAssessments_sdk_tests/providers/Microsoft.ContainerRegistry/registries/sdkRef/providers/Microsoft.Security/assessments/dbd0cb49-b563-45e7-9724-889e799fa648\",\r\n \"name\": \"dbd0cb49-b563-45e7-9724-889e799fa648\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/subAssessments_sdk_tests/providers/Microsoft.ContainerRegistry/registries/sdkRef\"\r\n },\r\n \"displayName\": \"Container registry images should have vulnerability findings resolved\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/subAssessments_sdk_tests/providers/Microsoft.ContainerRegistry/registries/sdkRef/providers/Microsoft.Security/assessments/dbd0cb49-b563-45e7-9724-889e799fa648/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/microsoft.containerregistry/registries/sdkref/providers/Microsoft.Security/assessments/13e7d036-6903-821c-6018-962938929bf0\",\r\n \"name\": \"13e7d036-6903-821c-6018-962938929bf0\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/microsoft.containerregistry/registries/sdkref\"\r\n },\r\n \"displayName\": \"Container registries should use private link\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/microsoft.containerregistry/registries/sdkref/providers/Microsoft.Security/assessments/9b828565-a0ed-61c2-6bf3-1afc99a9b2ca\",\r\n \"name\": \"9b828565-a0ed-61c2-6bf3-1afc99a9b2ca\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/microsoft.containerregistry/registries/sdkref\"\r\n },\r\n \"displayName\": \"Container registries should not allow unrestricted network access\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests/providers/Microsoft.Security/assessments/75396512-3323-9be4-059d-32ecb113c3de\",\r\n \"name\": \"75396512-3323-9be4-059d-32ecb113c3de\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests\"\r\n },\r\n \"displayName\": \"Private endpoint connections on Azure SQL Database should be enabled\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests/providers/Microsoft.Security/assessments/22e93e92-4a31-b4cd-d640-3ef908430aa6\",\r\n \"name\": \"22e93e92-4a31-b4cd-d640-3ef908430aa6\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests\"\r\n },\r\n \"displayName\": \"Public network access on Azure SQL Database should be disabled\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests/providers/Microsoft.Security/assessments/f0553104-cfdb-65e6-759c-002812e38500\",\r\n \"name\": \"f0553104-cfdb-65e6-759c-002812e38500\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests\"\r\n },\r\n \"displayName\": \"SQL servers should have an Azure Active Directory administrator provisioned\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:03.9693764Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:03.9693764Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests/providers/Microsoft.Security/assessments/400a6682-992c-4726-9549-629fbc3b988f\",\r\n \"name\": \"400a6682-992c-4726-9549-629fbc3b988f\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests\"\r\n },\r\n \"displayName\": \"Microsoft Defender for SQL should be enabled for unprotected Azure SQL servers\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:03.9984018Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:03.9984018Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests/providers/Microsoft.Security/assessments/1db4f204-cb5a-4c9c-9254-7556403ce51c\",\r\n \"name\": \"1db4f204-cb5a-4c9c-9254-7556403ce51c\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests\"\r\n },\r\n \"displayName\": \"SQL servers should have vulnerability assessment configured\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:03.996368Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:03.996368Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests/providers/Microsoft.Security/assessments/94208a8b-16e8-4e5b-abbd-4e81c9d02bee\",\r\n \"name\": \"94208a8b-16e8-4e5b-abbd-4e81c9d02bee\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests\"\r\n },\r\n \"displayName\": \"Auditing on SQL server should be enabled\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:03.9991746Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:03.9991746Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests/providers/Microsoft.Security/assessments/620671b8-6661-273a-38ac-4574967750ec\",\r\n \"name\": \"620671b8-6661-273a-38ac-4574967750ec\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests\"\r\n },\r\n \"displayName\": \"Audit retention for SQL servers should be set to at least 90 days\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0069144Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0069144Z\"\r\n }\r\n }\r\n }\r\n ],\r\n \"nextLink\": \"https://management.azure.com/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/subAssessments_sdk_tests/providers/Microsoft.Security/assessments?api-version=2021-06-01&NextLink=_dynamic\"\r\n}", "StatusCode": 200 } ], diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/AssessmentsTests/Assessments_List_ResourceGroup_Scope_ResourceDetails.json b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/AssessmentsTests/Assessments_List_ResourceGroup_Scope_ResourceDetails.json index f59de1a99dc8..dd600768f9f7 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/AssessmentsTests/Assessments_List_ResourceGroup_Scope_ResourceDetails.json +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/AssessmentsTests/Assessments_List_ResourceGroup_Scope_ResourceDetails.json @@ -1,22 +1,22 @@ { "Entries": [ { - "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/subAssessments_sdk_tests/providers/Microsoft.Security/assessments?api-version=2020-01-01", - "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Jlc291cmNlR3JvdXBzL3N1YkFzc2Vzc21lbnRzX3Nka190ZXN0cy9wcm92aWRlcnMvTWljcm9zb2Z0LlNlY3VyaXR5L2Fzc2Vzc21lbnRzP2FwaS12ZXJzaW9uPTIwMjAtMDEtMDE=", + "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/subAssessments_sdk_tests/providers/Microsoft.Security/assessments?api-version=2021-06-01", + "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Jlc291cmNlR3JvdXBzL3N1YkFzc2Vzc21lbnRzX3Nka190ZXN0cy9wcm92aWRlcnMvTWljcm9zb2Z0LlNlY3VyaXR5L2Fzc2Vzc21lbnRzP2FwaS12ZXJzaW9uPTIwMjEtMDYtMDE=", "RequestMethod": "GET", "RequestBody": "", "RequestHeaders": { "x-ms-client-request-id": [ - "ab2448b3-deba-4c56-a90d-d029971c1ca7" + "21599ace-4b37-4727-85f1-fd6083aa94ab" ], "Accept-Language": [ "en-US" ], "User-Agent": [ - "FxVersion/4.6.29321.03", + "FxVersion/4.700.22.11601", "OSName/Windows", - "OSVersion/Microsoft.Windows.10.0.19042.", - "Microsoft.Azure.Management.Security.SecurityCenterClient/2.2.0.0" + "OSVersion/Microsoft.Windows.10.0.22000", + "Microsoft.Azure.Management.Security.SecurityCenterClient/3.0.0.0" ] }, "ResponseHeaders": { @@ -30,13 +30,13 @@ "749" ], "x-ms-request-id": [ - "66e6cded-be5f-4135-8e34-5f64052ce44d" + "23bd4bf8-2cad-4910-8002-c8f83b3ebf45" ], "x-ms-correlation-request-id": [ - "66e6cded-be5f-4135-8e34-5f64052ce44d" + "23bd4bf8-2cad-4910-8002-c8f83b3ebf45" ], "x-ms-routing-request-id": [ - "UKSOUTH:20201201T175334Z:66e6cded-be5f-4135-8e34-5f64052ce44d" + "FRANCESOUTH:20220323T162209Z:23bd4bf8-2cad-4910-8002-c8f83b3ebf45" ], "Strict-Transport-Security": [ "max-age=31536000; includeSubDomains" @@ -45,10 +45,10 @@ "nosniff" ], "Date": [ - "Tue, 01 Dec 2020 17:53:33 GMT" + "Wed, 23 Mar 2022 16:22:08 GMT" ], "Content-Length": [ - "958" + "7647" ], "Content-Type": [ "application/json; charset=utf-8" @@ -57,12 +57,10 @@ "-1" ] }, - "ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/subAssessments_sdk_tests/providers/Microsoft.ContainerRegistry/registries/sdkRef/providers/Microsoft.Security/assessments/dbd0cb49-b563-45e7-9724-889e799fa648\",\r\n \"name\": \"dbd0cb49-b563-45e7-9724-889e799fa648\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/subAssessments_sdk_tests/providers/Microsoft.ContainerRegistry/registries/sdkRef\"\r\n },\r\n \"displayName\": \"Vulnerabilities in Azure Container Registry images should be remediated (powered by Qualys)\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/subAssessments_sdk_tests/providers/Microsoft.ContainerRegistry/registries/sdkRef/providers/Microsoft.Security/assessments/dbd0cb49-b563-45e7-9724-889e799fa648/subAssessments\"\r\n }\r\n }\r\n }\r\n ]\r\n}", + "ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/subAssessments_sdk_tests/providers/Microsoft.ContainerRegistry/registries/sdkRef/providers/Microsoft.Security/assessments/dbd0cb49-b563-45e7-9724-889e799fa648\",\r\n \"name\": \"dbd0cb49-b563-45e7-9724-889e799fa648\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/subAssessments_sdk_tests/providers/Microsoft.ContainerRegistry/registries/sdkRef\"\r\n },\r\n \"displayName\": \"Container registry images should have vulnerability findings resolved\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/subAssessments_sdk_tests/providers/Microsoft.ContainerRegistry/registries/sdkRef/providers/Microsoft.Security/assessments/dbd0cb49-b563-45e7-9724-889e799fa648/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/microsoft.containerregistry/registries/sdkref/providers/Microsoft.Security/assessments/13e7d036-6903-821c-6018-962938929bf0\",\r\n \"name\": \"13e7d036-6903-821c-6018-962938929bf0\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/microsoft.containerregistry/registries/sdkref\"\r\n },\r\n \"displayName\": \"Container registries should use private link\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/microsoft.containerregistry/registries/sdkref/providers/Microsoft.Security/assessments/9b828565-a0ed-61c2-6bf3-1afc99a9b2ca\",\r\n \"name\": \"9b828565-a0ed-61c2-6bf3-1afc99a9b2ca\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/microsoft.containerregistry/registries/sdkref\"\r\n },\r\n \"displayName\": \"Container registries should not allow unrestricted network access\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests/providers/Microsoft.Security/assessments/75396512-3323-9be4-059d-32ecb113c3de\",\r\n \"name\": \"75396512-3323-9be4-059d-32ecb113c3de\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests\"\r\n },\r\n \"displayName\": \"Private endpoint connections on Azure SQL Database should be enabled\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests/providers/Microsoft.Security/assessments/22e93e92-4a31-b4cd-d640-3ef908430aa6\",\r\n \"name\": \"22e93e92-4a31-b4cd-d640-3ef908430aa6\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests\"\r\n },\r\n \"displayName\": \"Public network access on Azure SQL Database should be disabled\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests/providers/Microsoft.Security/assessments/f0553104-cfdb-65e6-759c-002812e38500\",\r\n \"name\": \"f0553104-cfdb-65e6-759c-002812e38500\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests\"\r\n },\r\n \"displayName\": \"SQL servers should have an Azure Active Directory administrator provisioned\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:03.9693764Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:03.9693764Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests/providers/Microsoft.Security/assessments/400a6682-992c-4726-9549-629fbc3b988f\",\r\n \"name\": \"400a6682-992c-4726-9549-629fbc3b988f\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests\"\r\n },\r\n \"displayName\": \"Microsoft Defender for SQL should be enabled for unprotected Azure SQL servers\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:03.9984018Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:03.9984018Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests/providers/Microsoft.Security/assessments/1db4f204-cb5a-4c9c-9254-7556403ce51c\",\r\n \"name\": \"1db4f204-cb5a-4c9c-9254-7556403ce51c\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests\"\r\n },\r\n \"displayName\": \"SQL servers should have vulnerability assessment configured\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:03.996368Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:03.996368Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests/providers/Microsoft.Security/assessments/94208a8b-16e8-4e5b-abbd-4e81c9d02bee\",\r\n \"name\": \"94208a8b-16e8-4e5b-abbd-4e81c9d02bee\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests\"\r\n },\r\n \"displayName\": \"Auditing on SQL server should be enabled\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:03.9991746Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:03.9991746Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests/providers/Microsoft.Security/assessments/620671b8-6661-273a-38ac-4574967750ec\",\r\n \"name\": \"620671b8-6661-273a-38ac-4574967750ec\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests\"\r\n },\r\n \"displayName\": \"Audit retention for SQL servers should be set to at least 90 days\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0069144Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0069144Z\"\r\n }\r\n }\r\n }\r\n ],\r\n \"nextLink\": \"https://management.azure.com/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/subAssessments_sdk_tests/providers/Microsoft.Security/assessments?api-version=2021-06-01&NextLink=_dynamic\"\r\n}", "StatusCode": 200 } ], "Names": {}, - "Variables": { - "SubscriptionId": "487bb485-b5b0-471e-9c0d-10717612f869" - } -} + "Variables": {} +} \ No newline at end of file diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/AssessmentsTests/Assessments_List_Subscription_Scope.json b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/AssessmentsTests/Assessments_List_Subscription_Scope.json index a38214ec13e3..d5e7747b2bf2 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/AssessmentsTests/Assessments_List_Subscription_Scope.json +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/AssessmentsTests/Assessments_List_Subscription_Scope.json @@ -1,22 +1,22 @@ { "Entries": [ { - "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments?api-version=2020-01-01", - "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvYXNzZXNzbWVudHM/YXBpLXZlcnNpb249MjAyMC0wMS0wMQ==", + "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments?api-version=2021-06-01", + "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvYXNzZXNzbWVudHM/YXBpLXZlcnNpb249MjAyMS0wNi0wMQ==", "RequestMethod": "GET", "RequestBody": "", "RequestHeaders": { "x-ms-client-request-id": [ - "380fc60a-17fc-49df-a26f-8cd677435ece" + "de8a411f-7a48-43b2-b40e-6f59908109ed" ], "Accept-Language": [ "en-US" ], "User-Agent": [ - "FxVersion/4.6.29321.03", + "FxVersion/4.700.22.11601", "OSName/Windows", - "OSVersion/Microsoft.Windows.10.0.19042.", - "Microsoft.Azure.Management.Security.SecurityCenterClient/2.1.0.0" + "OSVersion/Microsoft.Windows.10.0.22000", + "Microsoft.Azure.Management.Security.SecurityCenterClient/3.0.0.0" ] }, "ResponseHeaders": { @@ -30,13 +30,13 @@ "749" ], "x-ms-request-id": [ - "942cfb75-0c62-4bc9-9033-324a09d3b7f5" + "87ebf241-d1d9-4388-b622-cf498a61a484" ], "x-ms-correlation-request-id": [ - "942cfb75-0c62-4bc9-9033-324a09d3b7f5" + "87ebf241-d1d9-4388-b622-cf498a61a484" ], "x-ms-routing-request-id": [ - "UKSOUTH:20201105T085628Z:942cfb75-0c62-4bc9-9033-324a09d3b7f5" + "FRANCESOUTH:20220323T162208Z:87ebf241-d1d9-4388-b622-cf498a61a484" ], "Strict-Transport-Security": [ "max-age=31536000; includeSubDomains" @@ -45,10 +45,10 @@ "nosniff" ], "Date": [ - "Thu, 05 Nov 2020 08:56:28 GMT" + "Wed, 23 Mar 2022 16:22:08 GMT" ], "Content-Length": [ - "128499" + "232517" ], "Content-Type": [ "application/json; charset=utf-8" @@ -57,7 +57,7 @@ "-1" ] }, - "ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/f9f0eed0-f143-47bf-b856-671ea2eeed62\",\r\n \"name\": \"f9f0eed0-f143-47bf-b856-671ea2eeed62\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Adaptive Network Hardening recommendations should be applied on internet facing virtual machines\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NoNsgOnVm\",\r\n \"description\": \"This recommendation is relevant only for VMs protected by a network security group\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/f9f0eed0-f143-47bf-b856-671ea2eeed62\",\r\n \"name\": \"f9f0eed0-f143-47bf-b856-671ea2eeed62\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"Adaptive Network Hardening recommendations should be applied on internet facing virtual machines\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/3b20e985-f71f-483b-b078-f30d73936d43\",\r\n \"name\": \"3b20e985-f71f-483b-b078-f30d73936d43\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"All network ports should be restricted on network security groups associated to your virtual machine\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NoNsgOnVm\",\r\n \"description\": \"This recommendation is relevant only for VMs protected by a network security group\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/bc303248-3d14-44c2-96a0-55f5c326b5fe\",\r\n \"name\": \"bc303248-3d14-44c2-96a0-55f5c326b5fe\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Management ports should be closed on your virtual machines\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NoNsgOnVm\",\r\n \"description\": \"This recommendation is relevant only for VMs protected by a network security group\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/3b20e985-f71f-483b-b078-f30d73936d43\",\r\n \"name\": \"3b20e985-f71f-483b-b078-f30d73936d43\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"All network ports should be restricted on network security groups associated to your virtual machine\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NonInternetFacingVms\",\r\n \"description\": \"The VM is non-internet-facing\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/bc303248-3d14-44c2-96a0-55f5c326b5fe\",\r\n \"name\": \"bc303248-3d14-44c2-96a0-55f5c326b5fe\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"Management ports should be closed on your virtual machines\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NonInternetFacingVms\",\r\n \"description\": \"The VM is non-internet-facing\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/c3b51c94-588b-426b-a892-24696f9e54cc\",\r\n \"name\": \"c3b51c94-588b-426b-a892-24696f9e54cc\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"IP forwarding on your virtual machine should be disabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/c3b51c94-588b-426b-a892-24696f9e54cc\",\r\n \"name\": \"c3b51c94-588b-426b-a892-24696f9e54cc\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"IP forwarding on your virtual machine should be disabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/35f45c95-27cf-4e52-891f-8390d1de5828\",\r\n \"name\": \"35f45c95-27cf-4e52-891f-8390d1de5828\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Adaptive application controls for defining safe applications should be enabled on your machines\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"MissingDataOrUnsupported\",\r\n \"description\": \"VM is missing data or not supported\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/35f45c95-27cf-4e52-891f-8390d1de5828\",\r\n \"name\": \"35f45c95-27cf-4e52-891f-8390d1de5828\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"Adaptive application controls for defining safe applications should be enabled on your machines\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/805651bc-6ecd-4c73-9b55-97a19d0582d0\",\r\n \"name\": \"805651bc-6ecd-4c73-9b55-97a19d0582d0\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Management ports of virtual machines should be protected with just-in-time network access control\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NoNsgOrFwOnVm\",\r\n \"description\": \"This recommendation is relevant only for VMs protected by a network security group or Azure Firewall\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/805651bc-6ecd-4c73-9b55-97a19d0582d0\",\r\n \"name\": \"805651bc-6ecd-4c73-9b55-97a19d0582d0\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"Management ports of virtual machines should be protected with just-in-time network access control\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"HealthyReason\": \"JIT enabled\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Network/virtualNetworks/myService1/providers/Microsoft.Security/assessments/e3de1cc0-f4dd-3b34-e496-8b5381ba2d70\",\r\n \"name\": \"e3de1cc0-f4dd-3b34-e496-8b5381ba2d70\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Network/virtualNetworks/myService1\"\r\n },\r\n \"displayName\": \"Azure DDoS Protection Standard should be enabled\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n },\r\n \"additionalData\": {\r\n \"ddosProtectionState\": \"False\",\r\n \"appGatewaysCount\": \"1\",\r\n \"appGatewaysHasPublicIp\": \"True\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Network/virtualNetworks/myService1-vnet/providers/Microsoft.Security/assessments/e3de1cc0-f4dd-3b34-e496-8b5381ba2d70\",\r\n \"name\": \"e3de1cc0-f4dd-3b34-e496-8b5381ba2d70\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Network/virtualNetworks/myService1-vnet\"\r\n },\r\n \"displayName\": \"Azure DDoS Protection Standard should be enabled\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"VnetHasNoAppGateways\",\r\n \"description\": \"There are no Application Gateway resources attached to this Virtual Network\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Network/virtualNetworks/syslogmyservice1net/providers/Microsoft.Security/assessments/e3de1cc0-f4dd-3b34-e496-8b5381ba2d70\",\r\n \"name\": \"e3de1cc0-f4dd-3b34-e496-8b5381ba2d70\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Network/virtualNetworks/syslogmyservice1net\"\r\n },\r\n \"displayName\": \"Azure DDoS Protection Standard should be enabled\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"VnetHasNoAppGateways\",\r\n \"description\": \"There are no Application Gateway resources attached to this Virtual Network\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Sql/servers/datastore/databases/dataStore/providers/Microsoft.Security/assessments/b0df6f56-862d-4730-8597-38c0fd4ebd59\",\r\n \"name\": \"b0df6f56-862d-4730-8597-38c0fd4ebd59\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Sql/servers/datastore/databases/dataStore\"\r\n },\r\n \"displayName\": \"Sensitive data in your SQL databases should be classified\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"ReportTimeUtc\": \"10/29/2020 5:00:59 PM\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/483f12ed-ae23-447e-a2de-a67a10db4353\",\r\n \"name\": \"483f12ed-ae23-447e-a2de-a67a10db4353\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Internet-facing virtual machines should be protected with network security groups\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/483f12ed-ae23-447e-a2de-a67a10db4353\",\r\n \"name\": \"483f12ed-ae23-447e-a2de-a67a10db4353\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"Internet-facing virtual machines should be protected with network security groups\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NonInternetFacingVms\",\r\n \"description\": \"The VM is non-internet-facing\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Network/virtualNetworks/myService1/subnets/default/providers/Microsoft.Security/assessments/eade5b56-eefd-444f-95c8-23f29e5d93cb\",\r\n \"name\": \"eade5b56-eefd-444f-95c8-23f29e5d93cb\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Network/virtualNetworks/myService1/subnets/default\"\r\n },\r\n \"displayName\": \"Subnets should be associated with a network security group\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"OffByPolicy\",\r\n \"description\": \"The recommendation is disabled in policy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Network/virtualNetworks/myService1-vnet/subnets/default/providers/Microsoft.Security/assessments/eade5b56-eefd-444f-95c8-23f29e5d93cb\",\r\n \"name\": \"eade5b56-eefd-444f-95c8-23f29e5d93cb\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Network/virtualNetworks/myService1-vnet/subnets/default\"\r\n },\r\n \"displayName\": \"Subnets should be associated with a network security group\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"OffByPolicy\",\r\n \"description\": \"The recommendation is disabled in policy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Network/virtualNetworks/syslogmyservice1net/subnets/syslogmyservice1net/providers/Microsoft.Security/assessments/eade5b56-eefd-444f-95c8-23f29e5d93cb\",\r\n \"name\": \"eade5b56-eefd-444f-95c8-23f29e5d93cb\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Network/virtualNetworks/syslogmyservice1net/subnets/syslogmyservice1net\"\r\n },\r\n \"displayName\": \"Subnets should be associated with a network security group\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"OffByPolicy\",\r\n \"description\": \"The recommendation is disabled in policy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.storage/storageaccounts/takleidiag/providers/Microsoft.Security/assessments/1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"name\": \"1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.storage/storageaccounts/takleidiag\"\r\n },\r\n \"displayName\": \"Secure transfer to storage accounts should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlauditnorhckgibckar6zs/providers/Microsoft.Security/assessments/1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"name\": \"1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlauditnorhckgibckar6zs\"\r\n },\r\n \"displayName\": \"Secure transfer to storage accounts should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlauditcenkokky5rfpyhsm/providers/Microsoft.Security/assessments/1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"name\": \"1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlauditcenkokky5rfpyhsm\"\r\n },\r\n \"displayName\": \"Secure transfer to storage accounts should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlvamhbxfrvxg27hk/providers/Microsoft.Security/assessments/1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"name\": \"1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlvamhbxfrvxg27hk\"\r\n },\r\n \"displayName\": \"Secure transfer to storage accounts should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/Microsoft.Sql/servers/datastore/providers/Microsoft.Security/assessments/f0553104-cfdb-65e6-759c-002812e38500\",\r\n \"name\": \"f0553104-cfdb-65e6-759c-002812e38500\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/Microsoft.Sql/servers/datastore\"\r\n },\r\n \"displayName\": \"An Azure Active Directory administrator should be provisioned for SQL servers\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/myservice1diag229/providers/Microsoft.Security/assessments/1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"name\": \"1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/myservice1diag229\"\r\n },\r\n \"displayName\": \"Secure transfer to storage accounts should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/rc44m4u3jcfyesyslog/providers/Microsoft.Security/assessments/1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"name\": \"1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/rc44m4u3jcfyesyslog\"\r\n },\r\n \"displayName\": \"Secure transfer to storage accounts should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/myservice1diag/providers/Microsoft.Security/assessments/1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"name\": \"1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/myservice1diag\"\r\n },\r\n \"displayName\": \"Secure transfer to storage accounts should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-cus/providers/microsoft.storage/storageaccounts/samplestorageaccount2/providers/Microsoft.Security/assessments/1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"name\": \"1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-cus/providers/microsoft.storage/storageaccounts/samplestorageaccount2\"\r\n },\r\n \"displayName\": \"Secure transfer to storage accounts should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/Microsoft.Sql/servers/datastore/providers/Microsoft.Security/assessments/400a6682-992c-4726-9549-629fbc3b988f\",\r\n \"name\": \"400a6682-992c-4726-9549-629fbc3b988f\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/Microsoft.Sql/servers/datastore\"\r\n },\r\n \"displayName\": \"Azure Defender for SQL should be enabled on your SQL servers\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/Microsoft.Sql/servers/datastore/providers/Microsoft.Security/assessments/1db4f204-cb5a-4c9c-9254-7556403ce51c\",\r\n \"name\": \"1db4f204-cb5a-4c9c-9254-7556403ce51c\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/Microsoft.Sql/servers/datastore\"\r\n },\r\n \"displayName\": \"Vulnerability assessment should be enabled on your SQL servers\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.compute/virtualmachines/alertstest/providers/Microsoft.Security/assessments/12018f4f-3d10-999b-e4c4-86ec25be08a1\",\r\n \"name\": \"12018f4f-3d10-999b-e4c4-86ec25be08a1\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.compute/virtualmachines/alertstest\"\r\n },\r\n \"displayName\": \"Virtual machines should be migrated to new Azure Resource Manager resources\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.keyvault/vaults/alerts/providers/Microsoft.Security/assessments/88bbc99c-e5af-ddd7-6105-6150b2bfa519\",\r\n \"name\": \"88bbc99c-e5af-ddd7-6105-6150b2bfa519\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.keyvault/vaults/alerts\"\r\n },\r\n \"displayName\": \"Diagnostic logs in Key Vault should be enabled\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice1/providers/Microsoft.Security/assessments/12018f4f-3d10-999b-e4c4-86ec25be08a1\",\r\n \"name\": \"12018f4f-3d10-999b-e4c4-86ec25be08a1\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice1\"\r\n },\r\n \"displayName\": \"Virtual machines should be migrated to new Azure Resource Manager resources\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice/providers/Microsoft.Security/assessments/12018f4f-3d10-999b-e4c4-86ec25be08a1\",\r\n \"name\": \"12018f4f-3d10-999b-e4c4-86ec25be08a1\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice\"\r\n },\r\n \"displayName\": \"Virtual machines should be migrated to new Azure Resource Manager resources\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/Microsoft.Sql/servers/datastore/databases/datastore/providers/Microsoft.Security/assessments/651967bf-044e-4bde-8376-3e08e0600105\",\r\n \"name\": \"651967bf-044e-4bde-8376-3e08e0600105\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/Microsoft.Sql/servers/datastore/databases/datastore\"\r\n },\r\n \"displayName\": \"Transparent Data Encryption on SQL databases should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice1/providers/Microsoft.Security/assessments/8c3e93d3-0276-4d06-b20a-9a9f3012742c\",\r\n \"name\": \"8c3e93d3-0276-4d06-b20a-9a9f3012742c\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice1\"\r\n },\r\n \"displayName\": \"Network traffic data collection agent should be installed on Linux virtual machines\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/12018f4f-3d10-999b-e4c4-86ec25be08a1\",\r\n \"name\": \"12018f4f-3d10-999b-e4c4-86ec25be08a1\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Virtual machines should be migrated to new Azure Resource Manager resources\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/Microsoft.Sql/servers/datastore/providers/Microsoft.Security/assessments/94208a8b-16e8-4e5b-abbd-4e81c9d02bee\",\r\n \"name\": \"94208a8b-16e8-4e5b-abbd-4e81c9d02bee\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/Microsoft.Sql/servers/datastore\"\r\n },\r\n \"displayName\": \"Auditing on SQL server should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/8c3e93d3-0276-4d06-b20a-9a9f3012742c\",\r\n \"name\": \"8c3e93d3-0276-4d06-b20a-9a9f3012742c\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Network traffic data collection agent should be installed on Linux virtual machines\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.compute/virtualmachines/alertstest/providers/Microsoft.Security/assessments/24d8af06-d441-40b4-a49c-311421aa9f58\",\r\n \"name\": \"24d8af06-d441-40b4-a49c-311421aa9f58\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.compute/virtualmachines/alertstest\"\r\n },\r\n \"displayName\": \"Network traffic data collection agent should be installed on Windows virtual machines\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.storage/storageaccounts/takleidiag/providers/Microsoft.Security/assessments/47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"name\": \"47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.storage/storageaccounts/takleidiag\"\r\n },\r\n \"displayName\": \"Storage accounts should be migrated to new Azure Resource Manager resources\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice/providers/Microsoft.Security/assessments/24d8af06-d441-40b4-a49c-311421aa9f58\",\r\n \"name\": \"24d8af06-d441-40b4-a49c-311421aa9f58\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice\"\r\n },\r\n \"displayName\": \"Network traffic data collection agent should be installed on Windows virtual machines\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlauditnorhckgibckar6zs/providers/Microsoft.Security/assessments/47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"name\": \"47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlauditnorhckgibckar6zs\"\r\n },\r\n \"displayName\": \"Storage accounts should be migrated to new Azure Resource Manager resources\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlauditcenkokky5rfpyhsm/providers/Microsoft.Security/assessments/47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"name\": \"47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlauditcenkokky5rfpyhsm\"\r\n },\r\n \"displayName\": \"Storage accounts should be migrated to new Azure Resource Manager resources\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlvamhbxfrvxg27hk/providers/Microsoft.Security/assessments/47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"name\": \"47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlvamhbxfrvxg27hk\"\r\n },\r\n \"displayName\": \"Storage accounts should be migrated to new Azure Resource Manager resources\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/myservice1diag229/providers/Microsoft.Security/assessments/47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"name\": \"47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/myservice1diag229\"\r\n },\r\n \"displayName\": \"Storage accounts should be migrated to new Azure Resource Manager resources\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/rc44m4u3jcfyesyslog/providers/Microsoft.Security/assessments/47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"name\": \"47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/rc44m4u3jcfyesyslog\"\r\n },\r\n \"displayName\": \"Storage accounts should be migrated to new Azure Resource Manager resources\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/myservice1diag/providers/Microsoft.Security/assessments/47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"name\": \"47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/myservice1diag\"\r\n },\r\n \"displayName\": \"Storage accounts should be migrated to new Azure Resource Manager resources\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-cus/providers/microsoft.storage/storageaccounts/samplestorageaccount2/providers/Microsoft.Security/assessments/47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"name\": \"47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-cus/providers/microsoft.storage/storageaccounts/samplestorageaccount2\"\r\n },\r\n \"displayName\": \"Storage accounts should be migrated to new Azure Resource Manager resources\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/2c79b4af-f830-b61e-92b9-63dfa30f16e4\",\r\n \"name\": \"2c79b4af-f830-b61e-92b9-63dfa30f16e4\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"There should be more than one owner assigned to your subscription\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {}\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/6f90a6d6-d4d6-0794-0ec1-98fa77878c2e\",\r\n \"name\": \"6f90a6d6-d4d6-0794-0ec1-98fa77878c2e\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"A maximum of 3 owners should be designated for your subscription\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"identityDesignateLessThanXOwnersObjectIdList\": \"[\\\"56b8f04c-b471-415a-bbc2-74570bd022de\\\",\\\"870e8d5e-f9b0-48eb-9893-ad00767f3b16\\\",\\\"af29e494-977e-4749-acb6-6fe3a10c56aa\\\"]\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/00c6d40b-e990-6acf-d4f3-471e747a27c4\",\r\n \"name\": \"00c6d40b-e990-6acf-d4f3-471e747a27c4\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"Deprecated accounts should be removed from your subscription\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"deprecatedAccountsObjectIdList\": \"[]\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/e52064aa-6853-e252-a11e-dffc675689c2\",\r\n \"name\": \"e52064aa-6853-e252-a11e-dffc675689c2\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"Deprecated accounts with owner permissions should be removed from your subscription\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"deprecatedAccountsWithOwnerPermissionsObjectIdList\": \"[]\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/c3b6ae71-f1f0-31b4-e6c1-d5951285d03d\",\r\n \"name\": \"c3b6ae71-f1f0-31b4-e6c1-d5951285d03d\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"External accounts with owner permissions should be removed from your subscription\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"externalAccountsWithOwnerPermissionsObjectIdList\": \"[]\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/94290b00-4d0c-d7b4-7cea-064a9554e681\",\r\n \"name\": \"94290b00-4d0c-d7b4-7cea-064a9554e681\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"MFA should be enabled on accounts with owner permissions on your subscription\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"usersWithNoMfaObjectIdList\": \"[]\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/04e7147b-0deb-9796-2e5c-0336343ceb3d\",\r\n \"name\": \"04e7147b-0deb-9796-2e5c-0336343ceb3d\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"External accounts with write permissions should be removed from your subscription\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"externalAccountsWithWritePermissionsObjectIdList\": \"[]\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/a8c6a4ad-d51e-88fe-2979-d3ee3c864f8b\",\r\n \"name\": \"a8c6a4ad-d51e-88fe-2979-d3ee3c864f8b\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"External accounts with read permissions should be removed from your subscription\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"externalAccountsWithReadPermissionsObjectIdList\": \"[]\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/151e82c5-5341-a74b-1eb0-bc38d2c84bb5\",\r\n \"name\": \"151e82c5-5341-a74b-1eb0-bc38d2c84bb5\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"MFA should be enabled on accounts with read permissions on your subscription\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"usersWithNoMfaObjectIdList\": \"[]\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/57e98606-6b1e-6193-0e3d-fe621387c16b\",\r\n \"name\": \"57e98606-6b1e-6193-0e3d-fe621387c16b\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"MFA should be enabled on accounts with write permissions on your subscription\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"usersWithNoMfaObjectIdList\": \"[]\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/subAssessments_sdk_tests/providers/Microsoft.ContainerRegistry/registries/sdkRef/providers/Microsoft.Security/assessments/dbd0cb49-b563-45e7-9724-889e799fa648\",\r\n \"name\": \"dbd0cb49-b563-45e7-9724-889e799fa648\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/subAssessments_sdk_tests/providers/Microsoft.ContainerRegistry/registries/sdkRef\"\r\n },\r\n \"displayName\": \"Vulnerabilities in Azure Container Registry images should be remediated (powered by Qualys)\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/subAssessments_sdk_tests/providers/Microsoft.ContainerRegistry/registries/sdkRef/providers/Microsoft.Security/assessments/dbd0cb49-b563-45e7-9724-889e799fa648/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/58d72d9d-0310-4792-9a3b-6dd111093cdb\",\r\n \"name\": \"58d72d9d-0310-4792-9a3b-6dd111093cdb\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"Azure Defender for Azure SQL Database servers should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/6ac66a74-761f-4a59-928a-d373eea3f028\",\r\n \"name\": \"6ac66a74-761f-4a59-928a-d373eea3f028\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"Azure Defender for SQL servers on machines should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/56a6e81f-7413-4f72-9a1b-aaeeaa87c872\",\r\n \"name\": \"56a6e81f-7413-4f72-9a1b-aaeeaa87c872\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"Azure Defender for servers should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/53572822-d3fc-4363-bfb9-248645841612\",\r\n \"name\": \"53572822-d3fc-4363-bfb9-248645841612\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"Azure Defender for container registries should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/86ea1a79-29d3-4eac-a9f4-3541ace4e718\",\r\n \"name\": \"86ea1a79-29d3-4eac-a9f4-3541ace4e718\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"Azure Defender for Kubernetes should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/1be22853-8ed1-4005-9907-ddad64cb1417\",\r\n \"name\": \"1be22853-8ed1-4005-9907-ddad64cb1417\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"Azure Defender for Storage should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/b1af52e4-e968-4e2b-b6d0-6736c9651f0a\",\r\n \"name\": \"b1af52e4-e968-4e2b-b6d0-6736c9651f0a\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"Azure Defender for Key Vault should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/0876ef51-fee7-449d-ba1e-f2662c7e43c6\",\r\n \"name\": \"0876ef51-fee7-449d-ba1e-f2662c7e43c6\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"Azure Defender for App Service should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlvamhbxfrvxg27hk/providers/Microsoft.Security/assessments/51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"name\": \"51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlvamhbxfrvxg27hk\"\r\n },\r\n \"displayName\": \"Storage account public access should be disallowed\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlauditcenkokky5rfpyhsm/providers/Microsoft.Security/assessments/51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"name\": \"51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlauditcenkokky5rfpyhsm\"\r\n },\r\n \"displayName\": \"Storage account public access should be disallowed\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.storage/storageaccounts/takleidiag/providers/Microsoft.Security/assessments/51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"name\": \"51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.storage/storageaccounts/takleidiag\"\r\n },\r\n \"displayName\": \"Storage account public access should be disallowed\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlauditnorhckgibckar6zs/providers/Microsoft.Security/assessments/51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"name\": \"51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlauditnorhckgibckar6zs\"\r\n },\r\n \"displayName\": \"Storage account public access should be disallowed\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/rc44m4u3jcfyesyslog/providers/Microsoft.Security/assessments/51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"name\": \"51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/rc44m4u3jcfyesyslog\"\r\n },\r\n \"displayName\": \"Storage account public access should be disallowed\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/myservice1diag229/providers/Microsoft.Security/assessments/51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"name\": \"51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/myservice1diag229\"\r\n },\r\n \"displayName\": \"Storage account public access should be disallowed\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/myservice1diag/providers/Microsoft.Security/assessments/51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"name\": \"51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/myservice1diag\"\r\n },\r\n \"displayName\": \"Storage account public access should be disallowed\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-cus/providers/microsoft.storage/storageaccounts/samplestorageaccount2/providers/Microsoft.Security/assessments/51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"name\": \"51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-cus/providers/microsoft.storage/storageaccounts/samplestorageaccount2\"\r\n },\r\n \"displayName\": \"Storage account public access should be disallowed\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Network/virtualNetworks/taklei-vnet/subnets/default/providers/Microsoft.Security/assessments/eade5b56-eefd-444f-95c8-23f29e5d93cb\",\r\n \"name\": \"eade5b56-eefd-444f-95c8-23f29e5d93cb\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Network/virtualNetworks/taklei-vnet/subnets/default\"\r\n },\r\n \"displayName\": \"Subnets should be associated with a network security group\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"OffByPolicy\",\r\n \"description\": \"The recommendation is disabled in policy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/3b20e985-f71f-483b-b078-f30d73936d43\",\r\n \"name\": \"3b20e985-f71f-483b-b078-f30d73936d43\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"All network ports should be restricted on network security groups associated to your virtual machine\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/c3b51c94-588b-426b-a892-24696f9e54cc\",\r\n \"name\": \"c3b51c94-588b-426b-a892-24696f9e54cc\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"IP forwarding on your virtual machine should be disabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/f9f0eed0-f143-47bf-b856-671ea2eeed62\",\r\n \"name\": \"f9f0eed0-f143-47bf-b856-671ea2eeed62\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"Adaptive Network Hardening recommendations should be applied on internet facing virtual machines\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/35f45c95-27cf-4e52-891f-8390d1de5828\",\r\n \"name\": \"35f45c95-27cf-4e52-891f-8390d1de5828\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"Adaptive application controls for defining safe applications should be enabled on your machines\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"MissingDataOrUnsupported\",\r\n \"description\": \"VM is missing data or not supported\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Network/virtualNetworks/myService1vnet657/subnets/default/providers/Microsoft.Security/assessments/eade5b56-eefd-444f-95c8-23f29e5d93cb\",\r\n \"name\": \"eade5b56-eefd-444f-95c8-23f29e5d93cb\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Network/virtualNetworks/myService1vnet657/subnets/default\"\r\n },\r\n \"displayName\": \"Subnets should be associated with a network security group\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"OffByPolicy\",\r\n \"description\": \"The recommendation is disabled in policy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Network/virtualNetworks/myService1vnet657/providers/Microsoft.Security/assessments/e3de1cc0-f4dd-3b34-e496-8b5381ba2d70\",\r\n \"name\": \"e3de1cc0-f4dd-3b34-e496-8b5381ba2d70\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Network/virtualNetworks/myService1vnet657\"\r\n },\r\n \"displayName\": \"Azure DDoS Protection Standard should be enabled\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"VnetHasNoAppGateways\",\r\n \"description\": \"There are no Application Gateway resources attached to this Virtual Network\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/483f12ed-ae23-447e-a2de-a67a10db4353\",\r\n \"name\": \"483f12ed-ae23-447e-a2de-a67a10db4353\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"Internet-facing virtual machines should be protected with network security groups\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/3b20e985-f71f-483b-b078-f30d73936d43\",\r\n \"name\": \"3b20e985-f71f-483b-b078-f30d73936d43\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"All network ports should be restricted on network security groups associated to your virtual machine\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/c3b51c94-588b-426b-a892-24696f9e54cc\",\r\n \"name\": \"c3b51c94-588b-426b-a892-24696f9e54cc\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"IP forwarding on your virtual machine should be disabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/bc303248-3d14-44c2-96a0-55f5c326b5fe\",\r\n \"name\": \"bc303248-3d14-44c2-96a0-55f5c326b5fe\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"Management ports should be closed on your virtual machines\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/805651bc-6ecd-4c73-9b55-97a19d0582d0\",\r\n \"name\": \"805651bc-6ecd-4c73-9b55-97a19d0582d0\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"Management ports of virtual machines should be protected with just-in-time network access control\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"HealthyReason\": \"JIT enabled\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/f9f0eed0-f143-47bf-b856-671ea2eeed62\",\r\n \"name\": \"f9f0eed0-f143-47bf-b856-671ea2eeed62\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"Adaptive Network Hardening recommendations should be applied on internet facing virtual machines\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/35f45c95-27cf-4e52-891f-8390d1de5828\",\r\n \"name\": \"35f45c95-27cf-4e52-891f-8390d1de5828\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"Adaptive application controls for defining safe applications should be enabled on your machines\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/a9341235-9389-42f0-a0bf-9bfb57960d44\",\r\n \"name\": \"a9341235-9389-42f0-a0bf-9bfb57960d44\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Non-internet-facing virtual machines should be protected with network security groups\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"InternetFacingVms\",\r\n \"description\": \"The VM is internet-facing\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/a9341235-9389-42f0-a0bf-9bfb57960d44\",\r\n \"name\": \"a9341235-9389-42f0-a0bf-9bfb57960d44\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"Non-internet-facing virtual machines should be protected with network security groups\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/a9341235-9389-42f0-a0bf-9bfb57960d44\",\r\n \"name\": \"a9341235-9389-42f0-a0bf-9bfb57960d44\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"Non-internet-facing virtual machines should be protected with network security groups\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"InternetFacingVms\",\r\n \"description\": \"The VM is internet-facing\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/a9341235-9389-42f0-a0bf-9bfb57960d44\",\r\n \"name\": \"a9341235-9389-42f0-a0bf-9bfb57960d44\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"Non-internet-facing virtual machines should be protected with network security groups\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"InternetFacingVms\",\r\n \"description\": \"The VM is internet-facing\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/1234abcd-1b53-4fd4-9835-2c2fa3935313\",\r\n \"name\": \"1234abcd-1b53-4fd4-9835-2c2fa3935313\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Allowlist rules in your adaptive application control policy should be updated\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"MissingDataOrUnsupported\",\r\n \"description\": \"VM is missing data or not supported\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/1234abcd-1b53-4fd4-9835-2c2fa3935313\",\r\n \"name\": \"1234abcd-1b53-4fd4-9835-2c2fa3935313\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"Allowlist rules in your adaptive application control policy should be updated\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/1234abcd-1b53-4fd4-9835-2c2fa3935313\",\r\n \"name\": \"1234abcd-1b53-4fd4-9835-2c2fa3935313\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"Allowlist rules in your adaptive application control policy should be updated\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/1234abcd-1b53-4fd4-9835-2c2fa3935313\",\r\n \"name\": \"1234abcd-1b53-4fd4-9835-2c2fa3935313\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"Allowlist rules in your adaptive application control policy should be updated\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"MissingDataOrUnsupported\",\r\n \"description\": \"VM is missing data or not supported\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/ffff0522-1e88-47fc-8382-2a80ba848f5d\",\r\n \"name\": \"ffff0522-1e88-47fc-8382-2a80ba848f5d\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"A vulnerability assessment solution should be enabled on your virtual machines\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/ffff0522-1e88-47fc-8382-2a80ba848f5d\",\r\n \"name\": \"ffff0522-1e88-47fc-8382-2a80ba848f5d\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"A vulnerability assessment solution should be enabled on your virtual machines\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"VaRpCorruptedInstallation\",\r\n \"description\": \"The extension might be corrupted, please try to remove it and deploy again\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/ffff0522-1e88-47fc-8382-2a80ba848f5d\",\r\n \"name\": \"ffff0522-1e88-47fc-8382-2a80ba848f5d\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"A vulnerability assessment solution should be enabled on your virtual machines\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/ffff0522-1e88-47fc-8382-2a80ba848f5d\",\r\n \"name\": \"ffff0522-1e88-47fc-8382-2a80ba848f5d\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"A vulnerability assessment solution should be enabled on your virtual machines\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Sql/servers/datastore/providers/Microsoft.Security/assessments/82e20e14-edc5-4373-bfc4-f13121257c37\",\r\n \"name\": \"82e20e14-edc5-4373-bfc4-f13121257c37\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Sql/servers/datastore\"\r\n },\r\n \"displayName\": \"Vulnerability assessment findings on your SQL databases should be remediated\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"cause\": \"Unknown\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Sql/servers/datastore/providers/Microsoft.Security/assessments/82e20e14-edc5-4373-bfc4-f13121257c37/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/1195afff-c881-495e-9bc5-1486211ae03f\",\r\n \"name\": \"1195afff-c881-495e-9bc5-1486211ae03f\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"Vulnerabilities in your virtual machines should be remediated\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"Vulnerability assessment scanner is not deployed on the VM\",\r\n \"description\": \"Vulnerability assessment scanner is not deployed on the VM\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/1195afff-c881-495e-9bc5-1486211ae03f/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/functions-vx6syhq6e4vr4/providers/Microsoft.Security/assessments/cb0acdc6-0846-fd48-debe-9905af151b6d\",\r\n \"name\": \"cb0acdc6-0846-fd48-debe-9905af151b6d\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/functions-vx6syhq6e4vr4\"\r\n },\r\n \"displayName\": \"Function App should only be accessible over HTTPS\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n },\r\n \"additionalData\": {\r\n \"Kind\": \"Functionapp\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/iotsimulator-fdi4i/providers/Microsoft.Security/assessments/64b8637e-4e1d-76a9-0fc9-c1e487a97ed8\",\r\n \"name\": \"64b8637e-4e1d-76a9-0fc9-c1e487a97ed8\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/iotsimulator-fdi4i\"\r\n },\r\n \"displayName\": \"Remote debugging should be turned off for Web Applications\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"Kind\": \"WebApp\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/iotsimulator-fdi4i/providers/Microsoft.Security/assessments/df4d1739-47f0-60c7-1706-3731fea6ab03\",\r\n \"name\": \"df4d1739-47f0-60c7-1706-3731fea6ab03\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/iotsimulator-fdi4i\"\r\n },\r\n \"displayName\": \"CORS should not allow every resource to access your Web Applications\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"Kind\": \"WebApp\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/functions-vx6syhq6e4vr4/providers/Microsoft.Security/assessments/7b3d4796-9400-2904-692b-4a5ede7f0a1e\",\r\n \"name\": \"7b3d4796-9400-2904-692b-4a5ede7f0a1e\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/functions-vx6syhq6e4vr4\"\r\n },\r\n \"displayName\": \"CORS should not allow every resource to access your Function App\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"Kind\": \"Functionapp\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/functions-vx6syhq6e4vr4/providers/Microsoft.Security/assessments/093c685b-56dd-13a3-8ed5-887a001837a2\",\r\n \"name\": \"093c685b-56dd-13a3-8ed5-887a001837a2\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/functions-vx6syhq6e4vr4\"\r\n },\r\n \"displayName\": \"Remote debugging should be turned off for Function App\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"Kind\": \"Functionapp\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/1195afff-c881-495e-9bc5-1486211ae03f\",\r\n \"name\": \"1195afff-c881-495e-9bc5-1486211ae03f\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"Vulnerabilities in your virtual machines should be remediated\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/1195afff-c881-495e-9bc5-1486211ae03f/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Network/virtualNetworks/taklei-vnet/providers/Microsoft.Security/assessments/e3de1cc0-f4dd-3b34-e496-8b5381ba2d70\",\r\n \"name\": \"e3de1cc0-f4dd-3b34-e496-8b5381ba2d70\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Network/virtualNetworks/taklei-vnet\"\r\n },\r\n \"displayName\": \"Azure DDoS Protection Standard should be enabled\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"VnetHasNoAppGateways\",\r\n \"description\": \"There are no Application Gateway resources attached to this Virtual Network\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/483f12ed-ae23-447e-a2de-a67a10db4353\",\r\n \"name\": \"483f12ed-ae23-447e-a2de-a67a10db4353\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"Internet-facing virtual machines should be protected with network security groups\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/bc303248-3d14-44c2-96a0-55f5c326b5fe\",\r\n \"name\": \"bc303248-3d14-44c2-96a0-55f5c326b5fe\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"Management ports should be closed on your virtual machines\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/805651bc-6ecd-4c73-9b55-97a19d0582d0\",\r\n \"name\": \"805651bc-6ecd-4c73-9b55-97a19d0582d0\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"Management ports of virtual machines should be protected with just-in-time network access control\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"HealthyReason\": \"JIT enabled\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/1195afff-c881-495e-9bc5-1486211ae03f\",\r\n \"name\": \"1195afff-c881-495e-9bc5-1486211ae03f\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"Vulnerabilities in your virtual machines should be remediated\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"Vulnerability assessment scanner is not deployed on the VM\",\r\n \"description\": \"Vulnerability assessment scanner is not deployed on the VM\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/1195afff-c881-495e-9bc5-1486211ae03f/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/1195afff-c881-495e-9bc5-1486211ae03f\",\r\n \"name\": \"1195afff-c881-495e-9bc5-1486211ae03f\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Vulnerabilities in your virtual machines should be remediated\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"The extension might be corrupted, please try to remove it and deploy again\",\r\n \"description\": \"The extension might be corrupted, please try to remove it and deploy again\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/1195afff-c881-495e-9bc5-1486211ae03f/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotSimulator/providers/Microsoft.Network/virtualNetworks/iotsi-fdi-vnet/subnets/iotsi-fdi-subnet/providers/Microsoft.Security/assessments/eade5b56-eefd-444f-95c8-23f29e5d93cb\",\r\n \"name\": \"eade5b56-eefd-444f-95c8-23f29e5d93cb\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotSimulator/providers/Microsoft.Network/virtualNetworks/iotsi-fdi-vnet/subnets/iotsi-fdi-subnet\"\r\n },\r\n \"displayName\": \"Subnets should be associated with a network security group\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"OffByPolicy\",\r\n \"description\": \"The recommendation is disabled in policy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotSimulator/providers/Microsoft.Network/virtualNetworks/iotsi-fdi-vnet/providers/Microsoft.Security/assessments/e3de1cc0-f4dd-3b34-e496-8b5381ba2d70\",\r\n \"name\": \"e3de1cc0-f4dd-3b34-e496-8b5381ba2d70\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotSimulator/providers/Microsoft.Network/virtualNetworks/iotsi-fdi-vnet\"\r\n },\r\n \"displayName\": \"Azure DDoS Protection Standard should be enabled\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"VnetHasNoAppGateways\",\r\n \"description\": \"There are no Application Gateway resources attached to this Virtual Network\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.network/virtualnetworks/taklei-vnet/providers/Microsoft.Security/assessments/f67fb4ed-d481-44d7-91e5-efadf504f74a\",\r\n \"name\": \"f67fb4ed-d481-44d7-91e5-efadf504f74a\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.network/virtualnetworks/taklei-vnet\"\r\n },\r\n \"displayName\": \"Virtual networks should be protected by Azure Firewall\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iot-resourcegroup-cus/providers/microsoft.devices/iothubs/sdk-iothub-del-cus/providers/Microsoft.Security/assessments/77785808-ce86-4e40-b45f-19110a547397\",\r\n \"name\": \"77785808-ce86-4e40-b45f-19110a547397\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iot-resourcegroup-cus/providers/microsoft.devices/iothubs/sdk-iothub-del-cus\"\r\n },\r\n \"displayName\": \"Diagnostic logs in IoT Hub should be enabled\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iot-resourcegroup-cus/providers/microsoft.devices/iothubs/sdk-iothub-cus/providers/Microsoft.Security/assessments/77785808-ce86-4e40-b45f-19110a547397\",\r\n \"name\": \"77785808-ce86-4e40-b45f-19110a547397\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iot-resourcegroup-cus/providers/microsoft.devices/iothubs/sdk-iothub-cus\"\r\n },\r\n \"displayName\": \"Diagnostic logs in IoT Hub should be enabled\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.compute/virtualmachines/alertstest/providers/Microsoft.Security/assessments/f2f595ec-5dc6-68b4-82ef-b63563e9c610\",\r\n \"name\": \"f2f595ec-5dc6-68b4-82ef-b63563e9c610\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.compute/virtualmachines/alertstest\"\r\n },\r\n \"displayName\": \"Azure Backup should be enabled for virtual machines\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice1/providers/Microsoft.Security/assessments/f2f595ec-5dc6-68b4-82ef-b63563e9c610\",\r\n \"name\": \"f2f595ec-5dc6-68b4-82ef-b63563e9c610\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice1\"\r\n },\r\n \"displayName\": \"Azure Backup should be enabled for virtual machines\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice/providers/Microsoft.Security/assessments/f2f595ec-5dc6-68b4-82ef-b63563e9c610\",\r\n \"name\": \"f2f595ec-5dc6-68b4-82ef-b63563e9c610\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice\"\r\n },\r\n \"displayName\": \"Azure Backup should be enabled for virtual machines\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/f2f595ec-5dc6-68b4-82ef-b63563e9c610\",\r\n \"name\": \"f2f595ec-5dc6-68b4-82ef-b63563e9c610\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Azure Backup should be enabled for virtual machines\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/IOTSIMULATOR/providers/Microsoft.Compute/virtualMachineScaleSets/iotsi-fdi/providers/Microsoft.Security/assessments/8941d121-f740-35f6-952c-6561d2b38d36\",\r\n \"name\": \"8941d121-f740-35f6-952c-6561d2b38d36\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/IOTSIMULATOR/providers/Microsoft.Compute/virtualMachineScaleSets/iotsi-fdi\"\r\n },\r\n \"displayName\": \"Vulnerabilities in security configuration on your virtual machine scale sets should be remediated\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"Missing scan data\",\r\n \"description\": \"Missing scan data\"\r\n },\r\n \"additionalData\": {\r\n \"Severity Cause\": \"Missing scan data\",\r\n \"Severity Description\": \"Missing scan data\",\r\n \"Last scan time\": \"1/1/0001 12:00:00 AM\",\r\n \"Workspace Arm Id\": \"\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/IOTSIMULATOR/providers/Microsoft.Compute/virtualMachineScaleSets/iotsi-fdi/providers/Microsoft.Security/assessments/45cfe080-ceb1-a91e-9743-71551ed24e94\",\r\n \"name\": \"45cfe080-ceb1-a91e-9743-71551ed24e94\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/IOTSIMULATOR/providers/Microsoft.Compute/virtualMachineScaleSets/iotsi-fdi\"\r\n },\r\n \"displayName\": \"Log Analytics agent should be installed on your virtual machine scale sets\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n },\r\n \"additionalData\": {\r\n \"OS Offer\": \"UbuntuServer\",\r\n \"OS Type\": \"Linux\",\r\n \"Location\": \"southcentralus\",\r\n \"UpgradePolicyMode\": \"Manual\",\r\n \"Has Oms extension\": \"False\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/IOTSIMULATOR/providers/Microsoft.Compute/virtualMachineScaleSets/iotsi-fdi/providers/Microsoft.Security/assessments/21300918-b2e3-0346-785f-c77ff57d243b\",\r\n \"name\": \"21300918-b2e3-0346-785f-c77ff57d243b\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/IOTSIMULATOR/providers/Microsoft.Compute/virtualMachineScaleSets/iotsi-fdi\"\r\n },\r\n \"displayName\": \"Endpoint protection solution should be installed on virtual machine scale sets\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"Unsupported OS\",\r\n \"description\": \"Unsupported OS\"\r\n },\r\n \"additionalData\": {\r\n \"Workspace Arm Id\": \"\",\r\n \"Severity Cause\": \"Unsupported OS\",\r\n \"Severity Description\": \"Unsupported OS\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/IOTSIMULATOR/providers/Microsoft.Compute/virtualMachineScaleSets/iotsi-fdi/providers/Microsoft.Security/assessments/e71020c2-860c-3235-cd39-04f3f8c936d2\",\r\n \"name\": \"e71020c2-860c-3235-cd39-04f3f8c936d2\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/IOTSIMULATOR/providers/Microsoft.Compute/virtualMachineScaleSets/iotsi-fdi\"\r\n },\r\n \"displayName\": \"Endpoint protection health failures should be remediated on virtual machine scale sets\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"Unsupported OS\",\r\n \"description\": \"Unsupported OS\"\r\n },\r\n \"additionalData\": {\r\n \"Workspace Arm Id\": \"\",\r\n \"Severity Cause\": \"Unsupported OS\",\r\n \"Severity Description\": \"Unsupported OS\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/IOTSIMULATOR/providers/Microsoft.Compute/virtualMachineScaleSets/iotsi-fdi/providers/Microsoft.Security/assessments/bd20bd91-aaf1-7f14-b6e4-866de2f43146\",\r\n \"name\": \"bd20bd91-aaf1-7f14-b6e4-866de2f43146\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/IOTSIMULATOR/providers/Microsoft.Compute/virtualMachineScaleSets/iotsi-fdi\"\r\n },\r\n \"displayName\": \"System updates on virtual machine scale sets should be installed\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"Missing scan data\",\r\n \"description\": \"Missing scan data\"\r\n },\r\n \"additionalData\": {\r\n \"Severity Cause\": \"Missing scan data\",\r\n \"Severity Description\": \"Missing scan data\",\r\n \"Last scan time\": \"1/1/0001 12:00:00 AM\",\r\n \"Workspace Arm Id\": \"\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/d1db3318-01ff-16de-29eb-28b344515626\",\r\n \"name\": \"d1db3318-01ff-16de-29eb-28b344515626\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"Log Analytics agent should be installed on your virtual machine\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"VM Agent installed\": \"Off\",\r\n \"Monitoring agent extension installed\": \"Off\",\r\n \"Monitoring agent installation status\": \"NoHeartbeat\",\r\n \"Automatic monitoring agent installation policy\": \"On\",\r\n \"OS Type\": \"Linux\",\r\n \"Reporting workspace customer id\": \"df35f3e2-89af-4e01-b1f7-4cda6645ed9d\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/mainws/providers/microsoft.operationalinsights/workspaces/securityuserws\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/d1db3318-01ff-16de-29eb-28b344515626\",\r\n \"name\": \"d1db3318-01ff-16de-29eb-28b344515626\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Log Analytics agent should be installed on your virtual machine\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"VM Agent installed\": \"On\",\r\n \"Monitoring agent extension installed\": \"On\",\r\n \"Monitoring agent installation status\": \"Installed\",\r\n \"Automatic monitoring agent installation policy\": \"On\",\r\n \"OS Type\": \"Linux\",\r\n \"Reporting workspace customer id\": \"1e8531b4-8e83-489a-8dc1-0ba398fcc809\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-weu/providers/microsoft.operationalinsights/workspaces/defaultworkspace-487bb485-b5b0-471e-9c0d-10717612f869-weu\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/d1db3318-01ff-16de-29eb-28b344515626\",\r\n \"name\": \"d1db3318-01ff-16de-29eb-28b344515626\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"Log Analytics agent should be installed on your virtual machine\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"VM Agent installed\": \"On\",\r\n \"Monitoring agent extension installed\": \"Off\",\r\n \"Monitoring agent installation status\": \"NoHeartbeat\",\r\n \"Automatic monitoring agent installation policy\": \"On\",\r\n \"OS Type\": \"Windows\",\r\n \"Reporting workspace customer id\": \"1e8531b4-8e83-489a-8dc1-0ba398fcc809\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-weu/providers/microsoft.operationalinsights/workspaces/defaultworkspace-487bb485-b5b0-471e-9c0d-10717612f869-weu\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/d1db3318-01ff-16de-29eb-28b344515626\",\r\n \"name\": \"d1db3318-01ff-16de-29eb-28b344515626\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"Log Analytics agent should be installed on your virtual machine\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"VM Agent installed\": \"On\",\r\n \"Monitoring agent extension installed\": \"On\",\r\n \"Monitoring agent installation status\": \"Installed\",\r\n \"Automatic monitoring agent installation policy\": \"On\",\r\n \"OS Type\": \"Windows\",\r\n \"Reporting workspace customer id\": \"df35f3e2-89af-4e01-b1f7-4cda6645ed9d\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/mainws/providers/microsoft.operationalinsights/workspaces/securityuserws\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/8e2b96ff-3de2-289b-b5c1-3b9921a3441e\",\r\n \"name\": \"8e2b96ff-3de2-289b-b5c1-3b9921a3441e\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"Log Analytics agent health issues should be resolved on your machines\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"cause\": \"NoHeartbeat\",\r\n \"description\": \"Agent not responsive or missing ID - Security Center is unable to retrieve security data from the VM, even though the agent is installed.\"\r\n },\r\n \"additionalData\": {\r\n \"VM Agent installed\": \"Off\",\r\n \"Monitoring agent extension installed\": \"Off\",\r\n \"Monitoring agent installation status\": \"NoHeartbeat\",\r\n \"Automatic monitoring agent installation policy\": \"On\",\r\n \"OS Type\": \"Linux\",\r\n \"Reporting workspace customer id\": \"df35f3e2-89af-4e01-b1f7-4cda6645ed9d\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/mainws/providers/microsoft.operationalinsights/workspaces/securityuserws\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/8e2b96ff-3de2-289b-b5c1-3b9921a3441e\",\r\n \"name\": \"8e2b96ff-3de2-289b-b5c1-3b9921a3441e\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Log Analytics agent health issues should be resolved on your machines\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"VM Agent installed\": \"On\",\r\n \"Monitoring agent extension installed\": \"On\",\r\n \"Monitoring agent installation status\": \"Installed\",\r\n \"Automatic monitoring agent installation policy\": \"On\",\r\n \"OS Type\": \"Linux\",\r\n \"Reporting workspace customer id\": \"1e8531b4-8e83-489a-8dc1-0ba398fcc809\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-weu/providers/microsoft.operationalinsights/workspaces/defaultworkspace-487bb485-b5b0-471e-9c0d-10717612f869-weu\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/8e2b96ff-3de2-289b-b5c1-3b9921a3441e\",\r\n \"name\": \"8e2b96ff-3de2-289b-b5c1-3b9921a3441e\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"Log Analytics agent health issues should be resolved on your machines\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"cause\": \"NoHeartbeat\",\r\n \"description\": \"Agent not responsive or missing ID - Security Center is unable to retrieve security data from the VM, even though the agent is installed.\"\r\n },\r\n \"additionalData\": {\r\n \"VM Agent installed\": \"On\",\r\n \"Monitoring agent extension installed\": \"Off\",\r\n \"Monitoring agent installation status\": \"NoHeartbeat\",\r\n \"Automatic monitoring agent installation policy\": \"On\",\r\n \"OS Type\": \"Windows\",\r\n \"Reporting workspace customer id\": \"1e8531b4-8e83-489a-8dc1-0ba398fcc809\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-weu/providers/microsoft.operationalinsights/workspaces/defaultworkspace-487bb485-b5b0-471e-9c0d-10717612f869-weu\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/3bcd234d-c9c7-c2a2-89e0-c01f419c1a8a\",\r\n \"name\": \"3bcd234d-c9c7-c2a2-89e0-c01f419c1a8a\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"Endpoint protection health issues should be resolved on your machines\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NA\",\r\n \"description\": \"NA\"\r\n },\r\n \"additionalData\": {\r\n \"Last scan time\": \"0001-01-01T00:00:00Z\",\r\n \"Scan data is valid\": \"False\",\r\n \"Scan data exists\": \"False\",\r\n \"PolicyState\": \"On\",\r\n \"OS Type\": \"Linux\",\r\n \"Reporting workspace customer id\": \"df35f3e2-89af-4e01-b1f7-4cda6645ed9d\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/mainws/providers/microsoft.operationalinsights/workspaces/securityuserws\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/8e2b96ff-3de2-289b-b5c1-3b9921a3441e\",\r\n \"name\": \"8e2b96ff-3de2-289b-b5c1-3b9921a3441e\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"Log Analytics agent health issues should be resolved on your machines\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"VM Agent installed\": \"On\",\r\n \"Monitoring agent extension installed\": \"On\",\r\n \"Monitoring agent installation status\": \"Installed\",\r\n \"Automatic monitoring agent installation policy\": \"On\",\r\n \"OS Type\": \"Windows\",\r\n \"Reporting workspace customer id\": \"df35f3e2-89af-4e01-b1f7-4cda6645ed9d\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/mainws/providers/microsoft.operationalinsights/workspaces/securityuserws\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/83f577bd-a1b6-b7e1-0891-12ca19d1e6df\",\r\n \"name\": \"83f577bd-a1b6-b7e1-0891-12ca19d1e6df\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"Install endpoint protection solution on virtual machines\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NA\",\r\n \"description\": \"NA\"\r\n },\r\n \"additionalData\": {\r\n \"OS Type\": \"Linux\",\r\n \"Reporting workspace customer id\": \"df35f3e2-89af-4e01-b1f7-4cda6645ed9d\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/mainws/providers/microsoft.operationalinsights/workspaces/securityuserws\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/3bcd234d-c9c7-c2a2-89e0-c01f419c1a8a\",\r\n \"name\": \"3bcd234d-c9c7-c2a2-89e0-c01f419c1a8a\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Endpoint protection health issues should be resolved on your machines\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NA\",\r\n \"description\": \"NA\"\r\n },\r\n \"additionalData\": {\r\n \"Last scan time\": \"0001-01-01T00:00:00Z\",\r\n \"Scan data is valid\": \"False\",\r\n \"Scan data exists\": \"False\",\r\n \"PolicyState\": \"On\",\r\n \"OS Type\": \"Linux\",\r\n \"Reporting workspace customer id\": \"1e8531b4-8e83-489a-8dc1-0ba398fcc809\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-weu/providers/microsoft.operationalinsights/workspaces/defaultworkspace-487bb485-b5b0-471e-9c0d-10717612f869-weu\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/83f577bd-a1b6-b7e1-0891-12ca19d1e6df\",\r\n \"name\": \"83f577bd-a1b6-b7e1-0891-12ca19d1e6df\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Install endpoint protection solution on virtual machines\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NA\",\r\n \"description\": \"NA\"\r\n },\r\n \"additionalData\": {\r\n \"OS Type\": \"Linux\",\r\n \"Reporting workspace customer id\": \"1e8531b4-8e83-489a-8dc1-0ba398fcc809\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-weu/providers/microsoft.operationalinsights/workspaces/defaultworkspace-487bb485-b5b0-471e-9c0d-10717612f869-weu\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/3bcd234d-c9c7-c2a2-89e0-c01f419c1a8a\",\r\n \"name\": \"3bcd234d-c9c7-c2a2-89e0-c01f419c1a8a\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"Endpoint protection health issues should be resolved on your machines\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NA\",\r\n \"description\": \"NA\"\r\n },\r\n \"additionalData\": {\r\n \"Last scan time\": \"0001-01-01T00:00:00Z\",\r\n \"Scan data is valid\": \"False\",\r\n \"Scan data exists\": \"False\",\r\n \"PolicyState\": \"On\",\r\n \"OS Type\": \"Windows\",\r\n \"Reporting workspace customer id\": \"1e8531b4-8e83-489a-8dc1-0ba398fcc809\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-weu/providers/microsoft.operationalinsights/workspaces/defaultworkspace-487bb485-b5b0-471e-9c0d-10717612f869-weu\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/83f577bd-a1b6-b7e1-0891-12ca19d1e6df\",\r\n \"name\": \"83f577bd-a1b6-b7e1-0891-12ca19d1e6df\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"Install endpoint protection solution on virtual machines\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n },\r\n \"additionalData\": {\r\n \"OS Type\": \"Windows\",\r\n \"Reporting workspace customer id\": \"1e8531b4-8e83-489a-8dc1-0ba398fcc809\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-weu/providers/microsoft.operationalinsights/workspaces/defaultworkspace-487bb485-b5b0-471e-9c0d-10717612f869-weu\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/3bcd234d-c9c7-c2a2-89e0-c01f419c1a8a\",\r\n \"name\": \"3bcd234d-c9c7-c2a2-89e0-c01f419c1a8a\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"Endpoint protection health issues should be resolved on your machines\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n },\r\n \"additionalData\": {\r\n \"Last scan time\": \"2020-11-05T06:26:50.417Z\",\r\n \"Scan data is valid\": \"True\",\r\n \"Scan data exists\": \"True\",\r\n \"PolicyState\": \"On\",\r\n \"OS Type\": \"Windows\",\r\n \"Antimalware type\": \"Windows Defender\",\r\n \"Reporting workspace customer id\": \"df35f3e2-89af-4e01-b1f7-4cda6645ed9d\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/mainws/providers/microsoft.operationalinsights/workspaces/securityuserws\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/83f577bd-a1b6-b7e1-0891-12ca19d1e6df\",\r\n \"name\": \"83f577bd-a1b6-b7e1-0891-12ca19d1e6df\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"Install endpoint protection solution on virtual machines\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"OS Type\": \"Windows\",\r\n \"Antimalware type\": \"Windows Defender\",\r\n \"Reporting workspace customer id\": \"df35f3e2-89af-4e01-b1f7-4cda6645ed9d\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/mainws/providers/microsoft.operationalinsights/workspaces/securityuserws\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/d57a4221-a804-52ca-3dea-768284f06bb7\",\r\n \"name\": \"d57a4221-a804-52ca-3dea-768284f06bb7\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"Disk encryption should be applied on virtual machines\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n },\r\n \"additionalData\": {\r\n \"Is supported\": \"True\",\r\n \"OS disk encrypted\": \"False\",\r\n \"Data disk encrypted\": \"True\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/d57a4221-a804-52ca-3dea-768284f06bb7\",\r\n \"name\": \"d57a4221-a804-52ca-3dea-768284f06bb7\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Disk encryption should be applied on virtual machines\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NA\",\r\n \"description\": \"NA\"\r\n },\r\n \"additionalData\": {\r\n \"Is supported\": \"False\",\r\n \"OS disk encrypted\": \"False\",\r\n \"Data disk encrypted\": \"False\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/181ac480-f7c4-544b-9865-11b8ffe87f47\",\r\n \"name\": \"181ac480-f7c4-544b-9865-11b8ffe87f47\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"Vulnerabilities in security configuration on your machines should be remediated\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NA\",\r\n \"description\": \"NA\"\r\n },\r\n \"additionalData\": {\r\n \"Last scan time\": \"0001-01-01T00:00:00Z\",\r\n \"Scan data is valid\": \"False\",\r\n \"Scan data exists\": \"False\",\r\n \"PolicyState\": \"On\",\r\n \"OS Type\": \"Linux\",\r\n \"Reporting workspace customer id\": \"df35f3e2-89af-4e01-b1f7-4cda6645ed9d\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/mainws/providers/microsoft.operationalinsights/workspaces/securityuserws\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/4ab6e3c5-74dd-8b35-9ab9-f61b30875b27\",\r\n \"name\": \"4ab6e3c5-74dd-8b35-9ab9-f61b30875b27\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"System updates should be installed on your machines\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NA\",\r\n \"description\": \"NA\"\r\n },\r\n \"additionalData\": {\r\n \"Last scan time\": \"0001-01-01T00:00:00Z\",\r\n \"Scan data is valid\": \"False\",\r\n \"Scan data exists\": \"False\",\r\n \"PolicyState\": \"On\",\r\n \"OS Type\": \"Linux\",\r\n \"Reporting workspace customer id\": \"df35f3e2-89af-4e01-b1f7-4cda6645ed9d\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/mainws/providers/microsoft.operationalinsights/workspaces/securityuserws\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/d57a4221-a804-52ca-3dea-768284f06bb7\",\r\n \"name\": \"d57a4221-a804-52ca-3dea-768284f06bb7\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"Disk encryption should be applied on virtual machines\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n },\r\n \"additionalData\": {\r\n \"Is supported\": \"True\",\r\n \"OS disk encrypted\": \"False\",\r\n \"Data disk encrypted\": \"True\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/181ac480-f7c4-544b-9865-11b8ffe87f47\",\r\n \"name\": \"181ac480-f7c4-544b-9865-11b8ffe87f47\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Vulnerabilities in security configuration on your machines should be remediated\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n },\r\n \"additionalData\": {\r\n \"Last scan time\": \"2020-11-04T18:13:04.97Z\",\r\n \"Scan data is valid\": \"True\",\r\n \"Scan data exists\": \"True\",\r\n \"PolicyState\": \"On\",\r\n \"OS Type\": \"Linux\",\r\n \"Reporting workspace customer id\": \"1e8531b4-8e83-489a-8dc1-0ba398fcc809\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-weu/providers/microsoft.operationalinsights/workspaces/defaultworkspace-487bb485-b5b0-471e-9c0d-10717612f869-weu\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/4ab6e3c5-74dd-8b35-9ab9-f61b30875b27\",\r\n \"name\": \"4ab6e3c5-74dd-8b35-9ab9-f61b30875b27\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"System updates should be installed on your machines\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"Last scan time\": \"2020-11-05T06:46:38Z\",\r\n \"Scan data is valid\": \"True\",\r\n \"Scan data exists\": \"True\",\r\n \"PolicyState\": \"On\",\r\n \"OS Type\": \"Linux\",\r\n \"Reporting workspace customer id\": \"1e8531b4-8e83-489a-8dc1-0ba398fcc809\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-weu/providers/microsoft.operationalinsights/workspaces/defaultworkspace-487bb485-b5b0-471e-9c0d-10717612f869-weu\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/d57a4221-a804-52ca-3dea-768284f06bb7\",\r\n \"name\": \"d57a4221-a804-52ca-3dea-768284f06bb7\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"Disk encryption should be applied on virtual machines\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n },\r\n \"additionalData\": {\r\n \"Is supported\": \"True\",\r\n \"OS disk encrypted\": \"False\",\r\n \"Data disk encrypted\": \"True\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/181ac480-f7c4-544b-9865-11b8ffe87f47\",\r\n \"name\": \"181ac480-f7c4-544b-9865-11b8ffe87f47\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"Vulnerabilities in security configuration on your machines should be remediated\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NA\",\r\n \"description\": \"NA\"\r\n },\r\n \"additionalData\": {\r\n \"Last scan time\": \"0001-01-01T00:00:00Z\",\r\n \"Scan data is valid\": \"False\",\r\n \"Scan data exists\": \"False\",\r\n \"PolicyState\": \"On\",\r\n \"OS Type\": \"Windows\",\r\n \"Reporting workspace customer id\": \"1e8531b4-8e83-489a-8dc1-0ba398fcc809\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-weu/providers/microsoft.operationalinsights/workspaces/defaultworkspace-487bb485-b5b0-471e-9c0d-10717612f869-weu\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/4ab6e3c5-74dd-8b35-9ab9-f61b30875b27\",\r\n \"name\": \"4ab6e3c5-74dd-8b35-9ab9-f61b30875b27\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"System updates should be installed on your machines\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NA\",\r\n \"description\": \"NA\"\r\n },\r\n \"additionalData\": {\r\n \"Last scan time\": \"0001-01-01T00:00:00Z\",\r\n \"Scan data is valid\": \"False\",\r\n \"Scan data exists\": \"False\",\r\n \"PolicyState\": \"On\",\r\n \"OS Type\": \"Windows\",\r\n \"Reporting workspace customer id\": \"1e8531b4-8e83-489a-8dc1-0ba398fcc809\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-weu/providers/microsoft.operationalinsights/workspaces/defaultworkspace-487bb485-b5b0-471e-9c0d-10717612f869-weu\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/181ac480-f7c4-544b-9865-11b8ffe87f47\",\r\n \"name\": \"181ac480-f7c4-544b-9865-11b8ffe87f47\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"Vulnerabilities in security configuration on your machines should be remediated\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NA\",\r\n \"description\": \"NA\"\r\n },\r\n \"additionalData\": {\r\n \"Last scan time\": \"0001-01-01T00:00:00Z\",\r\n \"Scan data is valid\": \"True\",\r\n \"Scan data exists\": \"False\",\r\n \"PolicyState\": \"On\",\r\n \"OS Type\": \"Windows\",\r\n \"Reporting workspace customer id\": \"df35f3e2-89af-4e01-b1f7-4cda6645ed9d\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/mainws/providers/microsoft.operationalinsights/workspaces/securityuserws\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/4ab6e3c5-74dd-8b35-9ab9-f61b30875b27\",\r\n \"name\": \"4ab6e3c5-74dd-8b35-9ab9-f61b30875b27\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"System updates should be installed on your machines\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n },\r\n \"additionalData\": {\r\n \"Last scan time\": \"2020-11-05T05:01:06.443Z\",\r\n \"Scan data is valid\": \"True\",\r\n \"Scan data exists\": \"True\",\r\n \"PolicyState\": \"On\",\r\n \"OS Type\": \"Windows\",\r\n \"Reporting workspace customer id\": \"df35f3e2-89af-4e01-b1f7-4cda6645ed9d\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/mainws/providers/microsoft.operationalinsights/workspaces/securityuserws\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/c0f5316d-5ac5-9218-b77a-b96e16ccfd66\",\r\n \"name\": \"c0f5316d-5ac5-9218-b77a-b96e16ccfd66\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"Your machines should be restarted to apply system updates\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NA\",\r\n \"description\": \"NA\"\r\n },\r\n \"additionalData\": {\r\n \"OS Type\": \"Linux\",\r\n \"Reporting workspace customer id\": \"df35f3e2-89af-4e01-b1f7-4cda6645ed9d\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/mainws/providers/microsoft.operationalinsights/workspaces/securityuserws\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/c0f5316d-5ac5-9218-b77a-b96e16ccfd66\",\r\n \"name\": \"c0f5316d-5ac5-9218-b77a-b96e16ccfd66\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Your machines should be restarted to apply system updates\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"OS Type\": \"Linux\",\r\n \"Reporting workspace customer id\": \"1e8531b4-8e83-489a-8dc1-0ba398fcc809\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-weu/providers/microsoft.operationalinsights/workspaces/defaultworkspace-487bb485-b5b0-471e-9c0d-10717612f869-weu\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/c0f5316d-5ac5-9218-b77a-b96e16ccfd66\",\r\n \"name\": \"c0f5316d-5ac5-9218-b77a-b96e16ccfd66\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"Your machines should be restarted to apply system updates\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NA\",\r\n \"description\": \"NA\"\r\n },\r\n \"additionalData\": {\r\n \"OS Type\": \"Windows\",\r\n \"Reporting workspace customer id\": \"1e8531b4-8e83-489a-8dc1-0ba398fcc809\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-weu/providers/microsoft.operationalinsights/workspaces/defaultworkspace-487bb485-b5b0-471e-9c0d-10717612f869-weu\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/c0f5316d-5ac5-9218-b77a-b96e16ccfd66\",\r\n \"name\": \"c0f5316d-5ac5-9218-b77a-b96e16ccfd66\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"Your machines should be restarted to apply system updates\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"OS Type\": \"Windows\",\r\n \"Reporting workspace customer id\": \"df35f3e2-89af-4e01-b1f7-4cda6645ed9d\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/mainws/providers/microsoft.operationalinsights/workspaces/securityuserws\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/Microsoft.Sql/servers/datastore/providers/Microsoft.Security/assessments/620671b8-6661-273a-38ac-4574967750ec\",\r\n \"name\": \"620671b8-6661-273a-38ac-4574967750ec\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/Microsoft.Sql/servers/datastore\"\r\n },\r\n \"displayName\": \"Audit retention for SQL servers should be set to at least 90 days\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.storage/storageaccounts/storagefdi4i/providers/Microsoft.Security/assessments/1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"name\": \"1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.storage/storageaccounts/storagefdi4i\"\r\n },\r\n \"displayName\": \"Secure transfer to storage accounts should be enabled\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.storage/storageaccounts/stgvx6syhq6e4vr4/providers/Microsoft.Security/assessments/1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"name\": \"1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.storage/storageaccounts/stgvx6syhq6e4vr4\"\r\n },\r\n \"displayName\": \"Secure transfer to storage accounts should be enabled\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.compute/virtualmachinescalesets/iotsi-fdi/providers/Microsoft.Security/assessments/961eb649-3ea9-f8c2-6595-88e9a3aeedeb\",\r\n \"name\": \"961eb649-3ea9-f8c2-6595-88e9a3aeedeb\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.compute/virtualmachinescalesets/iotsi-fdi\"\r\n },\r\n \"displayName\": \"Diagnostic logs in Virtual Machine Scale Sets should be enabled\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/iotsimulator-fdi4i/providers/Microsoft.Security/assessments/1b351b29-41ca-6df5-946c-c190a56be5fe\",\r\n \"name\": \"1b351b29-41ca-6df5-946c-c190a56be5fe\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/iotsimulator-fdi4i\"\r\n },\r\n \"displayName\": \"Web Application should only be accessible over HTTPS\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n },\r\n \"additionalData\": {\r\n \"Kind\": \"WebApp\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.storage/storageaccounts/storagefdi4i/providers/Microsoft.Security/assessments/47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"name\": \"47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.storage/storageaccounts/storagefdi4i\"\r\n },\r\n \"displayName\": \"Storage accounts should be migrated to new Azure Resource Manager resources\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.storage/storageaccounts/stgvx6syhq6e4vr4/providers/Microsoft.Security/assessments/47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"name\": \"47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.storage/storageaccounts/stgvx6syhq6e4vr4\"\r\n },\r\n \"displayName\": \"Storage accounts should be migrated to new Azure Resource Manager resources\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/iotsimulator-fdi4i/providers/Microsoft.Security/assessments/4a3d7cd3-f17c-637a-1ffc-614a01dd03cf\",\r\n \"name\": \"4a3d7cd3-f17c-637a-1ffc-614a01dd03cf\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/iotsimulator-fdi4i\"\r\n },\r\n \"displayName\": \"Managed identity should be used in your web app\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/iotsimulator-fdi4i/providers/Microsoft.Security/assessments/ca4e6a5a-3a9a-bad3-798a-d420a1d9bd6d\",\r\n \"name\": \"ca4e6a5a-3a9a-bad3-798a-d420a1d9bd6d\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/iotsimulator-fdi4i\"\r\n },\r\n \"displayName\": \"Web apps should request an SSL certificate for all incoming requests\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/functions-vx6syhq6e4vr4/providers/Microsoft.Security/assessments/23aa9cbe-c2fb-6a2f-6c97-885a6d48c4d1\",\r\n \"name\": \"23aa9cbe-c2fb-6a2f-6c97-885a6d48c4d1\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/functions-vx6syhq6e4vr4\"\r\n },\r\n \"displayName\": \"Managed identity should be used in your function app\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/iotsimulator-fdi4i/providers/Microsoft.Security/assessments/40394a2c-60fb-7cc5-1944-065772e94f05\",\r\n \"name\": \"40394a2c-60fb-7cc5-1944-065772e94f05\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/iotsimulator-fdi4i\"\r\n },\r\n \"displayName\": \"Diagnostic logs should be enabled in App Service\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/iotsimulator-fdi4i/providers/Microsoft.Security/assessments/2a54c352-7ca4-4bae-ad46-47ecd9595bd2\",\r\n \"name\": \"2a54c352-7ca4-4bae-ad46-47ecd9595bd2\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/iotsimulator-fdi4i\"\r\n },\r\n \"displayName\": \"TLS should be updated to the latest version for your web app\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/functions-vx6syhq6e4vr4/providers/Microsoft.Security/assessments/15be5f3c-e0a4-c0fa-fbff-8e50339b4b22\",\r\n \"name\": \"15be5f3c-e0a4-c0fa-fbff-8e50339b4b22\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/functions-vx6syhq6e4vr4\"\r\n },\r\n \"displayName\": \"TLS should be updated to the latest version for your function app\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.storage/storageaccounts/storagefdi4i/providers/Microsoft.Security/assessments/51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"name\": \"51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.storage/storageaccounts/storagefdi4i\"\r\n },\r\n \"displayName\": \"Storage account public access should be disallowed\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.storage/storageaccounts/stgvx6syhq6e4vr4/providers/Microsoft.Security/assessments/51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"name\": \"51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.storage/storageaccounts/stgvx6syhq6e4vr4\"\r\n },\r\n \"displayName\": \"Storage account public access should be disallowed\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/iotsimulator-fdi4i/providers/Microsoft.Security/assessments/19beaa2a-a126-b4dd-6d35-617f6cc83fca\",\r\n \"name\": \"19beaa2a-a126-b4dd-6d35-617f6cc83fca\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/iotsimulator-fdi4i\"\r\n },\r\n \"displayName\": \"FTPS should be required in your web App\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/functions-vx6syhq6e4vr4/providers/Microsoft.Security/assessments/972a6579-f38f-c0b9-1b4b-a5bbeba3ab5b\",\r\n \"name\": \"972a6579-f38f-c0b9-1b4b-a5bbeba3ab5b\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/functions-vx6syhq6e4vr4\"\r\n },\r\n \"displayName\": \"FTPS should be required in your function App\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n }\r\n ]\r\n}", + "ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/f9f0eed0-f143-47bf-b856-671ea2eeed62\",\r\n \"name\": \"f9f0eed0-f143-47bf-b856-671ea2eeed62\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Adaptive network hardening recommendations should be applied on internet facing virtual machines\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NoNsgOnVm\",\r\n \"description\": \"This recommendation is relevant only for VMs protected by a network security group\",\r\n \"statusChangeDate\": \"2022-03-13T12:47:34.3360801Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/f9f0eed0-f143-47bf-b856-671ea2eeed62\",\r\n \"name\": \"f9f0eed0-f143-47bf-b856-671ea2eeed62\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"Adaptive network hardening recommendations should be applied on internet facing virtual machines\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-03-13T12:47:34.3360801Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/3b20e985-f71f-483b-b078-f30d73936d43\",\r\n \"name\": \"3b20e985-f71f-483b-b078-f30d73936d43\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"All network ports should be restricted on network security groups associated to your virtual machine\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NoNsgOnVm\",\r\n \"description\": \"This recommendation is relevant only for VMs protected by a network security group\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/bc303248-3d14-44c2-96a0-55f5c326b5fe\",\r\n \"name\": \"bc303248-3d14-44c2-96a0-55f5c326b5fe\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Management ports should be closed on your virtual machines\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NoNsgOnVm\",\r\n \"description\": \"This recommendation is relevant only for VMs protected by a network security group\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/3b20e985-f71f-483b-b078-f30d73936d43\",\r\n \"name\": \"3b20e985-f71f-483b-b078-f30d73936d43\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"All network ports should be restricted on network security groups associated to your virtual machine\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NonInternetFacingVms\",\r\n \"description\": \"The VM is non-internet-facing\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/bc303248-3d14-44c2-96a0-55f5c326b5fe\",\r\n \"name\": \"bc303248-3d14-44c2-96a0-55f5c326b5fe\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"Management ports should be closed on your virtual machines\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NonInternetFacingVms\",\r\n \"description\": \"The VM is non-internet-facing\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/c3b51c94-588b-426b-a892-24696f9e54cc\",\r\n \"name\": \"c3b51c94-588b-426b-a892-24696f9e54cc\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"IP forwarding on your virtual machine should be disabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/c3b51c94-588b-426b-a892-24696f9e54cc\",\r\n \"name\": \"c3b51c94-588b-426b-a892-24696f9e54cc\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"IP forwarding on your virtual machine should be disabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/35f45c95-27cf-4e52-891f-8390d1de5828\",\r\n \"name\": \"35f45c95-27cf-4e52-891f-8390d1de5828\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Adaptive application controls for defining safe applications should be enabled on your machines\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"MissingDataOrUnsupported\",\r\n \"description\": \"VM is missing data or not supported\",\r\n \"statusChangeDate\": \"2022-03-13T12:47:34.2799684Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/35f45c95-27cf-4e52-891f-8390d1de5828\",\r\n \"name\": \"35f45c95-27cf-4e52-891f-8390d1de5828\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"Adaptive application controls for defining safe applications should be enabled on your machines\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-03-13T12:47:34.2799684Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/805651bc-6ecd-4c73-9b55-97a19d0582d0\",\r\n \"name\": \"805651bc-6ecd-4c73-9b55-97a19d0582d0\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Management ports of virtual machines should be protected with just-in-time network access control\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NoNsgOrFwOnVm\",\r\n \"description\": \"This recommendation is relevant only for VMs protected by a network security group or Azure Firewall\",\r\n \"statusChangeDate\": \"2022-03-13T12:47:34.2565147Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/805651bc-6ecd-4c73-9b55-97a19d0582d0\",\r\n \"name\": \"805651bc-6ecd-4c73-9b55-97a19d0582d0\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"Management ports of virtual machines should be protected with just-in-time network access control\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"cause\": \"JitIsEnabled\",\r\n \"description\": \"JIT is enabled.\",\r\n \"statusChangeDate\": \"2022-03-13T12:47:34.2565147Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Network/virtualNetworks/myService1/providers/Microsoft.Security/assessments/e3de1cc0-f4dd-3b34-e496-8b5381ba2d70\",\r\n \"name\": \"e3de1cc0-f4dd-3b34-e496-8b5381ba2d70\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Network/virtualNetworks/myService1\"\r\n },\r\n \"displayName\": \"Azure DDoS Protection Standard should be enabled\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"cause\": \"DdosStandardIsDisabled\",\r\n \"description\": \"DDoS Protection Standard is currently disabled for your virtual network.\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n },\r\n \"additionalData\": {\r\n \"ddosProtectionState\": \"False\",\r\n \"appGatewaysCount\": \"1\",\r\n \"appGatewaysHasPublicIp\": \"True\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Network/virtualNetworks/myService1-vnet/providers/Microsoft.Security/assessments/e3de1cc0-f4dd-3b34-e496-8b5381ba2d70\",\r\n \"name\": \"e3de1cc0-f4dd-3b34-e496-8b5381ba2d70\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Network/virtualNetworks/myService1-vnet\"\r\n },\r\n \"displayName\": \"Azure DDoS Protection Standard should be enabled\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"VnetHasNoAppGateways\",\r\n \"description\": \"There are no Application Gateway resources attached to this Virtual Network\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Network/virtualNetworks/syslogmyservice1net/providers/Microsoft.Security/assessments/e3de1cc0-f4dd-3b34-e496-8b5381ba2d70\",\r\n \"name\": \"e3de1cc0-f4dd-3b34-e496-8b5381ba2d70\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Network/virtualNetworks/syslogmyservice1net\"\r\n },\r\n \"displayName\": \"Azure DDoS Protection Standard should be enabled\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"VnetHasNoAppGateways\",\r\n \"description\": \"There are no Application Gateway resources attached to this Virtual Network\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/483f12ed-ae23-447e-a2de-a67a10db4353\",\r\n \"name\": \"483f12ed-ae23-447e-a2de-a67a10db4353\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Internet-facing virtual machines should be protected with network security groups\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"cause\": \"VmIsNotProtectedWithNsg\",\r\n \"description\": \"Your virtual machine is not protected with a network security group.\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/483f12ed-ae23-447e-a2de-a67a10db4353\",\r\n \"name\": \"483f12ed-ae23-447e-a2de-a67a10db4353\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"Internet-facing virtual machines should be protected with network security groups\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NonInternetFacingVms\",\r\n \"description\": \"The VM is non-internet-facing\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Network/virtualNetworks/myService1/subnets/default/providers/Microsoft.Security/assessments/eade5b56-eefd-444f-95c8-23f29e5d93cb\",\r\n \"name\": \"eade5b56-eefd-444f-95c8-23f29e5d93cb\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Network/virtualNetworks/myService1/subnets/default\"\r\n },\r\n \"displayName\": \"Subnets should be associated with a network security group\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"OffByPolicy\",\r\n \"description\": \"The recommendation is disabled in policy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Network/virtualNetworks/myService1-vnet/subnets/default/providers/Microsoft.Security/assessments/eade5b56-eefd-444f-95c8-23f29e5d93cb\",\r\n \"name\": \"eade5b56-eefd-444f-95c8-23f29e5d93cb\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Network/virtualNetworks/myService1-vnet/subnets/default\"\r\n },\r\n \"displayName\": \"Subnets should be associated with a network security group\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"OffByPolicy\",\r\n \"description\": \"The recommendation is disabled in policy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Network/virtualNetworks/syslogmyservice1net/subnets/syslogmyservice1net/providers/Microsoft.Security/assessments/eade5b56-eefd-444f-95c8-23f29e5d93cb\",\r\n \"name\": \"eade5b56-eefd-444f-95c8-23f29e5d93cb\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Network/virtualNetworks/syslogmyservice1net/subnets/syslogmyservice1net\"\r\n },\r\n \"displayName\": \"Subnets should be associated with a network security group\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"OffByPolicy\",\r\n \"description\": \"The recommendation is disabled in policy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.storage/storageaccounts/takleidiag/providers/Microsoft.Security/assessments/1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"name\": \"1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.storage/storageaccounts/takleidiag\"\r\n },\r\n \"displayName\": \"Secure transfer to storage accounts should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlauditnorhckgibckar6zs/providers/Microsoft.Security/assessments/1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"name\": \"1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlauditnorhckgibckar6zs\"\r\n },\r\n \"displayName\": \"Secure transfer to storage accounts should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlauditcenkokky5rfpyhsm/providers/Microsoft.Security/assessments/1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"name\": \"1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlauditcenkokky5rfpyhsm\"\r\n },\r\n \"displayName\": \"Secure transfer to storage accounts should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlvamhbxfrvxg27hk/providers/Microsoft.Security/assessments/1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"name\": \"1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlvamhbxfrvxg27hk\"\r\n },\r\n \"displayName\": \"Secure transfer to storage accounts should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/myservice1diag229/providers/Microsoft.Security/assessments/1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"name\": \"1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/myservice1diag229\"\r\n },\r\n \"displayName\": \"Secure transfer to storage accounts should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/rc44m4u3jcfyesyslog/providers/Microsoft.Security/assessments/1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"name\": \"1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/rc44m4u3jcfyesyslog\"\r\n },\r\n \"displayName\": \"Secure transfer to storage accounts should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/myservice1diag/providers/Microsoft.Security/assessments/1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"name\": \"1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/myservice1diag\"\r\n },\r\n \"displayName\": \"Secure transfer to storage accounts should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-cus/providers/microsoft.storage/storageaccounts/samplestorageaccount2/providers/Microsoft.Security/assessments/1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"name\": \"1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-cus/providers/microsoft.storage/storageaccounts/samplestorageaccount2\"\r\n },\r\n \"displayName\": \"Secure transfer to storage accounts should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.storage/storageaccounts/takleidiag/providers/Microsoft.Security/assessments/47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"name\": \"47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.storage/storageaccounts/takleidiag\"\r\n },\r\n \"displayName\": \"Storage accounts should be migrated to new Azure Resource Manager resources\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlauditnorhckgibckar6zs/providers/Microsoft.Security/assessments/47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"name\": \"47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlauditnorhckgibckar6zs\"\r\n },\r\n \"displayName\": \"Storage accounts should be migrated to new Azure Resource Manager resources\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlauditcenkokky5rfpyhsm/providers/Microsoft.Security/assessments/47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"name\": \"47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlauditcenkokky5rfpyhsm\"\r\n },\r\n \"displayName\": \"Storage accounts should be migrated to new Azure Resource Manager resources\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlvamhbxfrvxg27hk/providers/Microsoft.Security/assessments/47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"name\": \"47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlvamhbxfrvxg27hk\"\r\n },\r\n \"displayName\": \"Storage accounts should be migrated to new Azure Resource Manager resources\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/myservice1diag229/providers/Microsoft.Security/assessments/47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"name\": \"47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/myservice1diag229\"\r\n },\r\n \"displayName\": \"Storage accounts should be migrated to new Azure Resource Manager resources\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/rc44m4u3jcfyesyslog/providers/Microsoft.Security/assessments/47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"name\": \"47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/rc44m4u3jcfyesyslog\"\r\n },\r\n \"displayName\": \"Storage accounts should be migrated to new Azure Resource Manager resources\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/myservice1diag/providers/Microsoft.Security/assessments/47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"name\": \"47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/myservice1diag\"\r\n },\r\n \"displayName\": \"Storage accounts should be migrated to new Azure Resource Manager resources\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-cus/providers/microsoft.storage/storageaccounts/samplestorageaccount2/providers/Microsoft.Security/assessments/47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"name\": \"47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-cus/providers/microsoft.storage/storageaccounts/samplestorageaccount2\"\r\n },\r\n \"displayName\": \"Storage accounts should be migrated to new Azure Resource Manager resources\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/subAssessments_sdk_tests/providers/Microsoft.ContainerRegistry/registries/sdkRef/providers/Microsoft.Security/assessments/dbd0cb49-b563-45e7-9724-889e799fa648\",\r\n \"name\": \"dbd0cb49-b563-45e7-9724-889e799fa648\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/subAssessments_sdk_tests/providers/Microsoft.ContainerRegistry/registries/sdkRef\"\r\n },\r\n \"displayName\": \"Container registry images should have vulnerability findings resolved\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/subAssessments_sdk_tests/providers/Microsoft.ContainerRegistry/registries/sdkRef/providers/Microsoft.Security/assessments/dbd0cb49-b563-45e7-9724-889e799fa648/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlvamhbxfrvxg27hk/providers/Microsoft.Security/assessments/51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"name\": \"51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlvamhbxfrvxg27hk\"\r\n },\r\n \"displayName\": \"Storage account public access should be disallowed\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlauditcenkokky5rfpyhsm/providers/Microsoft.Security/assessments/51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"name\": \"51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlauditcenkokky5rfpyhsm\"\r\n },\r\n \"displayName\": \"Storage account public access should be disallowed\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.storage/storageaccounts/takleidiag/providers/Microsoft.Security/assessments/51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"name\": \"51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.storage/storageaccounts/takleidiag\"\r\n },\r\n \"displayName\": \"Storage account public access should be disallowed\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlauditnorhckgibckar6zs/providers/Microsoft.Security/assessments/51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"name\": \"51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlauditnorhckgibckar6zs\"\r\n },\r\n \"displayName\": \"Storage account public access should be disallowed\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/rc44m4u3jcfyesyslog/providers/Microsoft.Security/assessments/51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"name\": \"51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/rc44m4u3jcfyesyslog\"\r\n },\r\n \"displayName\": \"Storage account public access should be disallowed\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/myservice1diag229/providers/Microsoft.Security/assessments/51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"name\": \"51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/myservice1diag229\"\r\n },\r\n \"displayName\": \"Storage account public access should be disallowed\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/myservice1diag/providers/Microsoft.Security/assessments/51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"name\": \"51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/myservice1diag\"\r\n },\r\n \"displayName\": \"Storage account public access should be disallowed\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-cus/providers/microsoft.storage/storageaccounts/samplestorageaccount2/providers/Microsoft.Security/assessments/51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"name\": \"51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-cus/providers/microsoft.storage/storageaccounts/samplestorageaccount2\"\r\n },\r\n \"displayName\": \"Storage account public access should be disallowed\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Network/virtualNetworks/taklei-vnet/subnets/default/providers/Microsoft.Security/assessments/eade5b56-eefd-444f-95c8-23f29e5d93cb\",\r\n \"name\": \"eade5b56-eefd-444f-95c8-23f29e5d93cb\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Network/virtualNetworks/taklei-vnet/subnets/default\"\r\n },\r\n \"displayName\": \"Subnets should be associated with a network security group\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"OffByPolicy\",\r\n \"description\": \"The recommendation is disabled in policy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/3b20e985-f71f-483b-b078-f30d73936d43\",\r\n \"name\": \"3b20e985-f71f-483b-b078-f30d73936d43\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"All network ports should be restricted on network security groups associated to your virtual machine\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NonInternetFacingVms\",\r\n \"description\": \"The VM is non-internet-facing\",\r\n \"statusChangeDate\": \"2022-03-13T10:40:55.5461204Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/c3b51c94-588b-426b-a892-24696f9e54cc\",\r\n \"name\": \"c3b51c94-588b-426b-a892-24696f9e54cc\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"IP forwarding on your virtual machine should be disabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/f9f0eed0-f143-47bf-b856-671ea2eeed62\",\r\n \"name\": \"f9f0eed0-f143-47bf-b856-671ea2eeed62\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"Adaptive network hardening recommendations should be applied on internet facing virtual machines\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-03-13T12:47:34.3360801Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/35f45c95-27cf-4e52-891f-8390d1de5828\",\r\n \"name\": \"35f45c95-27cf-4e52-891f-8390d1de5828\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"Adaptive application controls for defining safe applications should be enabled on your machines\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"MissingDataOrUnsupported\",\r\n \"description\": \"VM is missing data or not supported\",\r\n \"statusChangeDate\": \"2022-03-13T12:47:34.2799684Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Network/virtualNetworks/myService1vnet657/subnets/default/providers/Microsoft.Security/assessments/eade5b56-eefd-444f-95c8-23f29e5d93cb\",\r\n \"name\": \"eade5b56-eefd-444f-95c8-23f29e5d93cb\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Network/virtualNetworks/myService1vnet657/subnets/default\"\r\n },\r\n \"displayName\": \"Subnets should be associated with a network security group\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"OffByPolicy\",\r\n \"description\": \"The recommendation is disabled in policy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Network/virtualNetworks/myService1vnet657/providers/Microsoft.Security/assessments/e3de1cc0-f4dd-3b34-e496-8b5381ba2d70\",\r\n \"name\": \"e3de1cc0-f4dd-3b34-e496-8b5381ba2d70\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Network/virtualNetworks/myService1vnet657\"\r\n },\r\n \"displayName\": \"Azure DDoS Protection Standard should be enabled\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"VnetHasNoAppGateways\",\r\n \"description\": \"There are no Application Gateway resources attached to this Virtual Network\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/483f12ed-ae23-447e-a2de-a67a10db4353\",\r\n \"name\": \"483f12ed-ae23-447e-a2de-a67a10db4353\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"Internet-facing virtual machines should be protected with network security groups\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NonInternetFacingVms\",\r\n \"description\": \"The VM is non-internet-facing\",\r\n \"statusChangeDate\": \"2022-03-13T10:40:55.5496673Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/3b20e985-f71f-483b-b078-f30d73936d43\",\r\n \"name\": \"3b20e985-f71f-483b-b078-f30d73936d43\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"All network ports should be restricted on network security groups associated to your virtual machine\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NonInternetFacingVms\",\r\n \"description\": \"The VM is non-internet-facing\",\r\n \"statusChangeDate\": \"2022-03-13T10:40:55.5461204Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/c3b51c94-588b-426b-a892-24696f9e54cc\",\r\n \"name\": \"c3b51c94-588b-426b-a892-24696f9e54cc\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"IP forwarding on your virtual machine should be disabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/bc303248-3d14-44c2-96a0-55f5c326b5fe\",\r\n \"name\": \"bc303248-3d14-44c2-96a0-55f5c326b5fe\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"Management ports should be closed on your virtual machines\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NonInternetFacingVms\",\r\n \"description\": \"The VM is non-internet-facing\",\r\n \"statusChangeDate\": \"2022-03-13T10:40:55.544058Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/805651bc-6ecd-4c73-9b55-97a19d0582d0\",\r\n \"name\": \"805651bc-6ecd-4c73-9b55-97a19d0582d0\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"Management ports of virtual machines should be protected with just-in-time network access control\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"cause\": \"JitIsEnabled\",\r\n \"description\": \"JIT is enabled.\",\r\n \"statusChangeDate\": \"2022-03-13T12:47:34.2565147Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/f9f0eed0-f143-47bf-b856-671ea2eeed62\",\r\n \"name\": \"f9f0eed0-f143-47bf-b856-671ea2eeed62\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"Adaptive network hardening recommendations should be applied on internet facing virtual machines\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-03-13T12:47:34.3360801Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/35f45c95-27cf-4e52-891f-8390d1de5828\",\r\n \"name\": \"35f45c95-27cf-4e52-891f-8390d1de5828\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"Adaptive application controls for defining safe applications should be enabled on your machines\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-03-13T12:47:34.2799684Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/a9341235-9389-42f0-a0bf-9bfb57960d44\",\r\n \"name\": \"a9341235-9389-42f0-a0bf-9bfb57960d44\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Non-internet-facing virtual machines should be protected with network security groups\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"InternetFacingVms\",\r\n \"description\": \"The VM is internet-facing\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/a9341235-9389-42f0-a0bf-9bfb57960d44\",\r\n \"name\": \"a9341235-9389-42f0-a0bf-9bfb57960d44\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"Non-internet-facing virtual machines should be protected with network security groups\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/a9341235-9389-42f0-a0bf-9bfb57960d44\",\r\n \"name\": \"a9341235-9389-42f0-a0bf-9bfb57960d44\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"Non-internet-facing virtual machines should be protected with network security groups\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-03-13T10:40:55.5378294Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/a9341235-9389-42f0-a0bf-9bfb57960d44\",\r\n \"name\": \"a9341235-9389-42f0-a0bf-9bfb57960d44\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"Non-internet-facing virtual machines should be protected with network security groups\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-03-13T10:40:55.5378294Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/1234abcd-1b53-4fd4-9835-2c2fa3935313\",\r\n \"name\": \"1234abcd-1b53-4fd4-9835-2c2fa3935313\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Allowlist rules in your adaptive application control policy should be updated\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"MissingDataOrUnsupported\",\r\n \"description\": \"VM is missing data or not supported\",\r\n \"statusChangeDate\": \"2022-03-13T12:47:34.2621574Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/1234abcd-1b53-4fd4-9835-2c2fa3935313\",\r\n \"name\": \"1234abcd-1b53-4fd4-9835-2c2fa3935313\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"Allowlist rules in your adaptive application control policy should be updated\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-03-13T12:47:34.2621574Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/1234abcd-1b53-4fd4-9835-2c2fa3935313\",\r\n \"name\": \"1234abcd-1b53-4fd4-9835-2c2fa3935313\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"Allowlist rules in your adaptive application control policy should be updated\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-03-13T12:47:34.2621574Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/1234abcd-1b53-4fd4-9835-2c2fa3935313\",\r\n \"name\": \"1234abcd-1b53-4fd4-9835-2c2fa3935313\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"Allowlist rules in your adaptive application control policy should be updated\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"MissingDataOrUnsupported\",\r\n \"description\": \"VM is missing data or not supported\",\r\n \"statusChangeDate\": \"2022-03-13T12:47:34.2621574Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/ffff0522-1e88-47fc-8382-2a80ba848f5d\",\r\n \"name\": \"ffff0522-1e88-47fc-8382-2a80ba848f5d\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"Machines should have a vulnerability assessment solution\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"cause\": \"VaScannerNotInstalled\",\r\n \"description\": \"The machine is not onboarded to any vulnerability assessments solution.\",\r\n \"statusChangeDate\": \"2022-03-22T21:51:56.7487335Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n },\r\n \"additionalData\": {\r\n \"Can onboard to Built-in Qualys\": \"true\",\r\n \"Can onboard to BYOL\": \"true\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/ffff0522-1e88-47fc-8382-2a80ba848f5d\",\r\n \"name\": \"ffff0522-1e88-47fc-8382-2a80ba848f5d\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Machines should have a vulnerability assessment solution\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"cause\": \"default\",\r\n \"description\": \"The machine is onboarded to built-in Qualys vulnerability assessment.\",\r\n \"statusChangeDate\": \"2022-03-22T10:18:01.4775515Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n },\r\n \"additionalData\": {\r\n \"Can onboard to Built-in Qualys\": \"true\",\r\n \"Can onboard to BYOL\": \"true\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/ffff0522-1e88-47fc-8382-2a80ba848f5d\",\r\n \"name\": \"ffff0522-1e88-47fc-8382-2a80ba848f5d\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"Machines should have a vulnerability assessment solution\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"cause\": \"default\",\r\n \"description\": \"The machine is onboarded to built-in Qualys vulnerability assessment.\",\r\n \"statusChangeDate\": \"2022-03-22T21:51:56.7487335Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n },\r\n \"additionalData\": {\r\n \"Can onboard to Built-in Qualys\": \"true\",\r\n \"Can onboard to BYOL\": \"true\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/ffff0522-1e88-47fc-8382-2a80ba848f5d\",\r\n \"name\": \"ffff0522-1e88-47fc-8382-2a80ba848f5d\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"Machines should have a vulnerability assessment solution\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"cause\": \"VaScannerNotInstalled\",\r\n \"description\": \"The machine is not onboarded to any vulnerability assessments solution.\",\r\n \"statusChangeDate\": \"2021-11-17T10:54:41.5324584Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n },\r\n \"additionalData\": {\r\n \"Can onboard to Built-in Qualys\": \"true\",\r\n \"Can onboard to BYOL\": \"true\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Sql/servers/datastore/providers/Microsoft.Security/assessments/82e20e14-edc5-4373-bfc4-f13121257c37\",\r\n \"name\": \"82e20e14-edc5-4373-bfc4-f13121257c37\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Sql/servers/datastore\"\r\n },\r\n \"displayName\": \"SQL databases should have vulnerability findings resolved\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"cause\": \"Unknown\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Sql/servers/datastore/providers/Microsoft.Security/assessments/82e20e14-edc5-4373-bfc4-f13121257c37/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/1195afff-c881-495e-9bc5-1486211ae03f\",\r\n \"name\": \"1195afff-c881-495e-9bc5-1486211ae03f\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"Machines should have vulnerability findings resolved\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"Vulnerability assessment scanner is not deployed on the machine\",\r\n \"description\": \"Vulnerability assessment scanner is not deployed on the machine\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/1195afff-c881-495e-9bc5-1486211ae03f/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/1195afff-c881-495e-9bc5-1486211ae03f\",\r\n \"name\": \"1195afff-c881-495e-9bc5-1486211ae03f\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"Machines should have vulnerability findings resolved\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-03-22T21:52:02.7683066Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/1195afff-c881-495e-9bc5-1486211ae03f/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Network/virtualNetworks/taklei-vnet/providers/Microsoft.Security/assessments/e3de1cc0-f4dd-3b34-e496-8b5381ba2d70\",\r\n \"name\": \"e3de1cc0-f4dd-3b34-e496-8b5381ba2d70\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Network/virtualNetworks/taklei-vnet\"\r\n },\r\n \"displayName\": \"Azure DDoS Protection Standard should be enabled\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"VnetHasNoAppGateways\",\r\n \"description\": \"There are no Application Gateway resources attached to this Virtual Network\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/483f12ed-ae23-447e-a2de-a67a10db4353\",\r\n \"name\": \"483f12ed-ae23-447e-a2de-a67a10db4353\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"Internet-facing virtual machines should be protected with network security groups\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NonInternetFacingVms\",\r\n \"description\": \"The VM is non-internet-facing\",\r\n \"statusChangeDate\": \"2022-03-13T10:40:55.5496673Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/bc303248-3d14-44c2-96a0-55f5c326b5fe\",\r\n \"name\": \"bc303248-3d14-44c2-96a0-55f5c326b5fe\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"Management ports should be closed on your virtual machines\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NonInternetFacingVms\",\r\n \"description\": \"The VM is non-internet-facing\",\r\n \"statusChangeDate\": \"2022-03-13T10:40:55.544058Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/805651bc-6ecd-4c73-9b55-97a19d0582d0\",\r\n \"name\": \"805651bc-6ecd-4c73-9b55-97a19d0582d0\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"Management ports of virtual machines should be protected with just-in-time network access control\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"cause\": \"JitIsEnabled\",\r\n \"description\": \"JIT is enabled.\",\r\n \"statusChangeDate\": \"2022-03-13T12:47:34.2565147Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/1195afff-c881-495e-9bc5-1486211ae03f\",\r\n \"name\": \"1195afff-c881-495e-9bc5-1486211ae03f\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"Machines should have vulnerability findings resolved\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"Vulnerability assessment scanner is not deployed on the machine\",\r\n \"description\": \"Vulnerability assessment scanner is not deployed on the machine\",\r\n \"statusChangeDate\": \"2022-03-22T21:51:55.6949884Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/1195afff-c881-495e-9bc5-1486211ae03f/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/1195afff-c881-495e-9bc5-1486211ae03f\",\r\n \"name\": \"1195afff-c881-495e-9bc5-1486211ae03f\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Machines should have vulnerability findings resolved\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-03-13T13:55:36.764555Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/1195afff-c881-495e-9bc5-1486211ae03f/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice/providers/Microsoft.Security/assessments/4ab6e3c5-74dd-8b35-9ab9-f61b30875b27\",\r\n \"name\": \"4ab6e3c5-74dd-8b35-9ab9-f61b30875b27\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice\"\r\n },\r\n \"displayName\": \"System updates should be installed on your machines\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"VmNotReportingHB\",\r\n \"description\": \"This resource does not report heartbeat to any workspace\",\r\n \"statusChangeDate\": \"2021-06-13T20:23:45.125409Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice/providers/Microsoft.Security/assessments/4ab6e3c5-74dd-8b35-9ab9-f61b30875b27/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/4ab6e3c5-74dd-8b35-9ab9-f61b30875b27\",\r\n \"name\": \"4ab6e3c5-74dd-8b35-9ab9-f61b30875b27\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"System updates should be installed on your machines\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-04-24T08:23:44.4058318Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/4ab6e3c5-74dd-8b35-9ab9-f61b30875b27/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice1/providers/Microsoft.Security/assessments/4ab6e3c5-74dd-8b35-9ab9-f61b30875b27\",\r\n \"name\": \"4ab6e3c5-74dd-8b35-9ab9-f61b30875b27\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice1\"\r\n },\r\n \"displayName\": \"System updates should be installed on your machines\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"VmNotReportingHB\",\r\n \"description\": \"This resource does not report heartbeat to any workspace\",\r\n \"statusChangeDate\": \"2021-06-13T20:23:44.8816299Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice1/providers/Microsoft.Security/assessments/4ab6e3c5-74dd-8b35-9ab9-f61b30875b27/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotSimulator/providers/Microsoft.Network/virtualNetworks/iotsi-fdi-vnet/subnets/iotsi-fdi-subnet/providers/Microsoft.Security/assessments/eade5b56-eefd-444f-95c8-23f29e5d93cb\",\r\n \"name\": \"eade5b56-eefd-444f-95c8-23f29e5d93cb\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotSimulator/providers/Microsoft.Network/virtualNetworks/iotsi-fdi-vnet/subnets/iotsi-fdi-subnet\"\r\n },\r\n \"displayName\": \"Subnets should be associated with a network security group\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"OffByPolicy\",\r\n \"description\": \"The recommendation is disabled in policy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotSimulator/providers/Microsoft.Network/virtualNetworks/iotsi-fdi-vnet/providers/Microsoft.Security/assessments/e3de1cc0-f4dd-3b34-e496-8b5381ba2d70\",\r\n \"name\": \"e3de1cc0-f4dd-3b34-e496-8b5381ba2d70\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotSimulator/providers/Microsoft.Network/virtualNetworks/iotsi-fdi-vnet\"\r\n },\r\n \"displayName\": \"Azure DDoS Protection Standard should be enabled\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"VnetHasNoAppGateways\",\r\n \"description\": \"There are no Application Gateway resources attached to this Virtual Network\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/IOTSIMULATOR/providers/Microsoft.Compute/virtualMachineScaleSets/iotsi-fdi/providers/Microsoft.Security/assessments/8941d121-f740-35f6-952c-6561d2b38d36\",\r\n \"name\": \"8941d121-f740-35f6-952c-6561d2b38d36\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/IOTSIMULATOR/providers/Microsoft.Compute/virtualMachineScaleSets/iotsi-fdi\"\r\n },\r\n \"displayName\": \"Virtual machine scale sets should be configured securely\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"Missing scan data\",\r\n \"description\": \"Missing scan data\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n },\r\n \"additionalData\": {\r\n \"Severity Cause\": \"Missing scan data\",\r\n \"Severity Description\": \"Missing scan data\",\r\n \"Last scan time\": \"1/1/0001 12:00:00 AM\",\r\n \"Workspace Arm Id\": \"\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/IOTSIMULATOR/providers/Microsoft.Compute/virtualMachineScaleSets/iotsi-fdi/providers/Microsoft.Security/assessments/45cfe080-ceb1-a91e-9743-71551ed24e94\",\r\n \"name\": \"45cfe080-ceb1-a91e-9743-71551ed24e94\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/IOTSIMULATOR/providers/Microsoft.Compute/virtualMachineScaleSets/iotsi-fdi\"\r\n },\r\n \"displayName\": \"Log Analytics agent should be installed on virtual machine scale sets\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n },\r\n \"additionalData\": {\r\n \"OS Offer\": \"UbuntuServer\",\r\n \"OS Type\": \"Linux\",\r\n \"Location\": \"southcentralus\",\r\n \"UpgradePolicyMode\": \"Manual\",\r\n \"Has Oms extension\": \"False\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/IOTSIMULATOR/providers/Microsoft.Compute/virtualMachineScaleSets/iotsi-fdi/providers/Microsoft.Security/assessments/21300918-b2e3-0346-785f-c77ff57d243b\",\r\n \"name\": \"21300918-b2e3-0346-785f-c77ff57d243b\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/IOTSIMULATOR/providers/Microsoft.Compute/virtualMachineScaleSets/iotsi-fdi\"\r\n },\r\n \"displayName\": \"Endpoint protection should be installed on virtual machine scale sets\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"Unsupported OS\",\r\n \"description\": \"Unsupported OS\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n },\r\n \"additionalData\": {\r\n \"Workspace Arm Id\": \"\",\r\n \"Severity Cause\": \"Unsupported OS\",\r\n \"Severity Description\": \"Unsupported OS\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/IOTSIMULATOR/providers/Microsoft.Compute/virtualMachineScaleSets/iotsi-fdi/providers/Microsoft.Security/assessments/e71020c2-860c-3235-cd39-04f3f8c936d2\",\r\n \"name\": \"e71020c2-860c-3235-cd39-04f3f8c936d2\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/IOTSIMULATOR/providers/Microsoft.Compute/virtualMachineScaleSets/iotsi-fdi\"\r\n },\r\n \"displayName\": \"Endpoint protection health issues on virtual machine scale sets should be resolved\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"Unsupported OS\",\r\n \"description\": \"Unsupported OS\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n },\r\n \"additionalData\": {\r\n \"Workspace Arm Id\": \"\",\r\n \"Severity Cause\": \"Unsupported OS\",\r\n \"Severity Description\": \"Unsupported OS\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/IOTSIMULATOR/providers/Microsoft.Compute/virtualMachineScaleSets/iotsi-fdi/providers/Microsoft.Security/assessments/bd20bd91-aaf1-7f14-b6e4-866de2f43146\",\r\n \"name\": \"bd20bd91-aaf1-7f14-b6e4-866de2f43146\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/IOTSIMULATOR/providers/Microsoft.Compute/virtualMachineScaleSets/iotsi-fdi\"\r\n },\r\n \"displayName\": \"System updates on virtual machine scale sets should be installed\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"Missing scan data\",\r\n \"description\": \"Missing scan data\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n },\r\n \"additionalData\": {\r\n \"Severity Cause\": \"Missing scan data\",\r\n \"Severity Description\": \"Missing scan data\",\r\n \"Last scan time\": \"1/1/0001 12:00:00 AM\",\r\n \"Workspace Arm Id\": \"\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.storage/storageaccounts/storagefdi4i/providers/Microsoft.Security/assessments/1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"name\": \"1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.storage/storageaccounts/storagefdi4i\"\r\n },\r\n \"displayName\": \"Secure transfer to storage accounts should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-06-21T10:19:50.7355812Z\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.storage/storageaccounts/stgvx6syhq6e4vr4/providers/Microsoft.Security/assessments/1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"name\": \"1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.storage/storageaccounts/stgvx6syhq6e4vr4\"\r\n },\r\n \"displayName\": \"Secure transfer to storage accounts should be enabled\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.storage/storageaccounts/storagefdi4i/providers/Microsoft.Security/assessments/47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"name\": \"47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.storage/storageaccounts/storagefdi4i\"\r\n },\r\n \"displayName\": \"Storage accounts should be migrated to new Azure Resource Manager resources\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.storage/storageaccounts/stgvx6syhq6e4vr4/providers/Microsoft.Security/assessments/47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"name\": \"47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.storage/storageaccounts/stgvx6syhq6e4vr4\"\r\n },\r\n \"displayName\": \"Storage accounts should be migrated to new Azure Resource Manager resources\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.storage/storageaccounts/storagefdi4i/providers/Microsoft.Security/assessments/51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"name\": \"51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.storage/storageaccounts/storagefdi4i\"\r\n },\r\n \"displayName\": \"Storage account public access should be disallowed\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.storage/storageaccounts/stgvx6syhq6e4vr4/providers/Microsoft.Security/assessments/51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"name\": \"51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.storage/storageaccounts/stgvx6syhq6e4vr4\"\r\n },\r\n \"displayName\": \"Storage account public access should be disallowed\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/e1145ab1-eb4f-43d8-911b-36ddf771d13f\",\r\n \"name\": \"e1145ab1-eb4f-43d8-911b-36ddf771d13f\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"System updates should be installed on your machines (powered by Update Center)\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NoScanData\",\r\n \"description\": \"The latest scan on the machine failed\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/e1145ab1-eb4f-43d8-911b-36ddf771d13f/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.OperationalInsights/workspaces/TestServiceWS/onPremiseMachines/machineName_b53988df-1137-41f2-99ff-52d49d7f53e1_ec2ad76a-fc72-bc3a-f0d7-017756d33d5e/providers/Microsoft.Security/assessments/b53988df-1137-41f2-99ff-52d49d7f53e1\",\r\n \"name\": \"b53988df-1137-41f2-99ff-52d49d7f53e1\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"OnPremise\",\r\n \"WorkspaceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.OperationalInsights/workspaces/TestServiceWS\",\r\n \"VMUUID\": \"ec2ad76a-fc72-bc3a-f0d7-017756d33d5e\",\r\n \"SourceComputerId\": \"b53988df-1137-41f2-99ff-52d49d7f53e1\",\r\n \"MachineName\": \"machineName\"\r\n },\r\n \"displayName\": \"Customer managed metadata\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.OperationalInsights/workspaces/TestServiceWS/providers/Microsoft.Security/assessments/b53988df-1137-41f2-99ff-52d49d7f53e1\",\r\n \"name\": \"b53988df-1137-41f2-99ff-52d49d7f53e1\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.OperationalInsights/workspaces/TestServiceWS\"\r\n },\r\n \"displayName\": \"Customer managed metadata\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"cause\": \"NA\",\r\n \"description\": \"NA\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.OperationalInsights/workspaces/TestServiceWS/onPremiseMachines/machineName_b53988df-1137-41f2-99ff-52d49d7f53e1_ec2ad76a-fc72-bc3a-f0d7-017756d33d5e/providers/Microsoft.Security/assessments/c53988df-1137-41f2-99ff-52d49d7f53e1\",\r\n \"name\": \"c53988df-1137-41f2-99ff-52d49d7f53e1\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"OnPremise\",\r\n \"WorkspaceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.OperationalInsights/workspaces/TestServiceWS\",\r\n \"VMUUID\": \"ec2ad76a-fc72-bc3a-f0d7-017756d33d5e\",\r\n \"SourceComputerId\": \"b53988df-1137-41f2-99ff-52d49d7f53e1\",\r\n \"MachineName\": \"machineName\"\r\n },\r\n \"displayName\": \"[elgrady] custom assessment metadata\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.OperationalInsights/workspaces/TestServiceWS/providers/Microsoft.Security/assessments/c53988df-1137-41f2-99ff-52d49d7f53e1\",\r\n \"name\": \"c53988df-1137-41f2-99ff-52d49d7f53e1\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.OperationalInsights/workspaces/TestServiceWS\"\r\n },\r\n \"displayName\": \"[elgrady] custom assessment metadata\",\r\n \"status\": {\r\n \"code\": \"Healthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.OperationalInsights/workspaces/TestServiceWS/providers/Microsoft.Security/assessments/9b0c3939-c9db-4ffc-ad4b-4673ff25cdd8\",\r\n \"name\": \"9b0c3939-c9db-4ffc-ad4b-4673ff25cdd8\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.OperationalInsights/workspaces/TestServiceWS\"\r\n },\r\n \"displayName\": \"Customer managed metadata\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"cause\": \"NA\",\r\n \"description\": \"NA\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.OperationalInsights/workspaces/TestServiceWS/onPremiseMachines/machineName_b53988df-1137-41f2-99ff-52d49d7f53e1_ec2ad76a-fc72-bc3a-f0d7-017756d33d5e/providers/Microsoft.Security/assessments/d53988df-1137-41f2-99ff-52d49d7f53e1\",\r\n \"name\": \"d53988df-1137-41f2-99ff-52d49d7f53e1\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"OnPremise\",\r\n \"WorkspaceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.OperationalInsights/workspaces/TestServiceWS\",\r\n \"VMUUID\": \"ec2ad76a-fc72-bc3a-f0d7-017756d33d5e\",\r\n \"SourceComputerId\": \"b53988df-1137-41f2-99ff-52d49d7f53e1\",\r\n \"MachineName\": \"machineName\"\r\n },\r\n \"displayName\": \"[elgrady] custom assessment metadata\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/clitest.rglcgsehtecwpwxccgtkja6224bw44vnfv2k467vcpemnzdcao6sps5zepofomkzwvi/providers/microsoft.storage/storageaccounts/clitestjnrp2z3af7yw7ebbd/providers/Microsoft.Security/assessments/51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"name\": \"51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/clitest.rglcgsehtecwpwxccgtkja6224bw44vnfv2k467vcpemnzdcao6sps5zepofomkzwvi/providers/microsoft.storage/storageaccounts/clitestjnrp2z3af7yw7ebbd\"\r\n },\r\n \"displayName\": \"Storage account public access should be disallowed\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/clitest.rglcgsehtecwpwxccgtkja6224bw44vnfv2k467vcpemnzdcao6sps5zepofomkzwvi/providers/microsoft.storage/storageaccounts/clitestjnrp2z3af7yw7ebbd/providers/Microsoft.Security/assessments/47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"name\": \"47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/clitest.rglcgsehtecwpwxccgtkja6224bw44vnfv2k467vcpemnzdcao6sps5zepofomkzwvi/providers/microsoft.storage/storageaccounts/clitestjnrp2z3af7yw7ebbd\"\r\n },\r\n \"displayName\": \"Storage accounts should be migrated to new Azure Resource Manager resources\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/clitest.rglcgsehtecwpwxccgtkja6224bw44vnfv2k467vcpemnzdcao6sps5zepofomkzwvi/providers/microsoft.storage/storageaccounts/clitestjnrp2z3af7yw7ebbd/providers/Microsoft.Security/assessments/1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"name\": \"1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/clitest.rglcgsehtecwpwxccgtkja6224bw44vnfv2k467vcpemnzdcao6sps5zepofomkzwvi/providers/microsoft.storage/storageaccounts/clitestjnrp2z3af7yw7ebbd\"\r\n },\r\n \"displayName\": \"Secure transfer to storage accounts should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/clitest.rgux2hohzfm5ae5g3e2kmehihecmlqvykbbwsyvm42bkvazts5afq5z5yozj4nl5rkj/providers/microsoft.storage/storageaccounts/clitestiwr74bhqm6myki4hp/providers/Microsoft.Security/assessments/1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"name\": \"1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/clitest.rgux2hohzfm5ae5g3e2kmehihecmlqvykbbwsyvm42bkvazts5afq5z5yozj4nl5rkj/providers/microsoft.storage/storageaccounts/clitestiwr74bhqm6myki4hp\"\r\n },\r\n \"displayName\": \"Secure transfer to storage accounts should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/clitest.rgux2hohzfm5ae5g3e2kmehihecmlqvykbbwsyvm42bkvazts5afq5z5yozj4nl5rkj/providers/microsoft.storage/storageaccounts/clitestiwr74bhqm6myki4hp/providers/Microsoft.Security/assessments/47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"name\": \"47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/clitest.rgux2hohzfm5ae5g3e2kmehihecmlqvykbbwsyvm42bkvazts5afq5z5yozj4nl5rkj/providers/microsoft.storage/storageaccounts/clitestiwr74bhqm6myki4hp\"\r\n },\r\n \"displayName\": \"Storage accounts should be migrated to new Azure Resource Manager resources\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/clitest.rgux2hohzfm5ae5g3e2kmehihecmlqvykbbwsyvm42bkvazts5afq5z5yozj4nl5rkj/providers/microsoft.storage/storageaccounts/clitestiwr74bhqm6myki4hp/providers/Microsoft.Security/assessments/51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"name\": \"51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/clitest.rgux2hohzfm5ae5g3e2kmehihecmlqvykbbwsyvm42bkvazts5afq5z5yozj4nl5rkj/providers/microsoft.storage/storageaccounts/clitestiwr74bhqm6myki4hp\"\r\n },\r\n \"displayName\": \"Storage account public access should be disallowed\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/sample-rg/providers/microsoft.devices/iothubs/samplehubforsdk/providers/Microsoft.Security/assessments/5a3d6cdd-8eb3-46d2-ba11-d24a0d47fe65\",\r\n \"name\": \"5a3d6cdd-8eb3-46d2-ba11-d24a0d47fe65\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/sample-rg/providers/microsoft.devices/iothubs/samplehubforsdk\"\r\n },\r\n \"displayName\": \"Default IP Filter Policy should be Deny\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/sample-rg/providers/microsoft.devices/iothubs/samplehubforsdk/providers/Microsoft.Security/assessments/d8326952-60bb-40fb-b33f-51e662708a88\",\r\n \"name\": \"d8326952-60bb-40fb-b33f-51e662708a88\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/sample-rg/providers/microsoft.devices/iothubs/samplehubforsdk\"\r\n },\r\n \"displayName\": \"IP Filter rule large IP range\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/new-api-rg/providers/microsoft.storage/storageaccounts/storageaccountnewap90e0/providers/Microsoft.Security/assessments/1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"name\": \"1c5de8e1-f68d-6a17-e0d2-ec259c42768c\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/new-api-rg/providers/microsoft.storage/storageaccounts/storageaccountnewap90e0\"\r\n },\r\n \"displayName\": \"Secure transfer to storage accounts should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/new-api-rg/providers/microsoft.storage/storageaccounts/storageaccountnewap90e0/providers/Microsoft.Security/assessments/47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"name\": \"47bb383c-8e25-95f0-c2aa-437add1d87d3\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/new-api-rg/providers/microsoft.storage/storageaccounts/storageaccountnewap90e0\"\r\n },\r\n \"displayName\": \"Storage accounts should be migrated to new Azure Resource Manager resources\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/new-api-rg/providers/microsoft.storage/storageaccounts/storageaccountnewap90e0/providers/Microsoft.Security/assessments/51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"name\": \"51fd8bb1-0db4-bbf1-7e2b-cfcba7eb66a6\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/new-api-rg/providers/microsoft.storage/storageaccounts/storageaccountnewap90e0\"\r\n },\r\n \"displayName\": \"Storage account public access should be disallowed\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/e1145ab1-eb4f-43d8-911b-36ddf771d13f\",\r\n \"name\": \"e1145ab1-eb4f-43d8-911b-36ddf771d13f\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"System updates should be installed on your machines (powered by Update Center)\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NotSupported\",\r\n \"description\": \"VM image is not supported\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/e1145ab1-eb4f-43d8-911b-36ddf771d13f/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/e1145ab1-eb4f-43d8-911b-36ddf771d13f\",\r\n \"name\": \"e1145ab1-eb4f-43d8-911b-36ddf771d13f\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"System updates should be installed on your machines (powered by Update Center)\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NotSupported\",\r\n \"description\": \"VM image is not supported\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/e1145ab1-eb4f-43d8-911b-36ddf771d13f/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/microsoft.containerregistry/registries/sdkref/providers/Microsoft.Security/assessments/13e7d036-6903-821c-6018-962938929bf0\",\r\n \"name\": \"13e7d036-6903-821c-6018-962938929bf0\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/microsoft.containerregistry/registries/sdkref\"\r\n },\r\n \"displayName\": \"Container registries should use private link\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.storage/storageaccounts/takleidiag/providers/Microsoft.Security/assessments/ad4f3ff1-30eb-5042-16ed-27198f640b8d\",\r\n \"name\": \"ad4f3ff1-30eb-5042-16ed-27198f640b8d\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.storage/storageaccounts/takleidiag\"\r\n },\r\n \"displayName\": \"Storage accounts should restrict network access using virtual network rules\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/new-api-rg/providers/microsoft.storage/storageaccounts/storageaccountnewap90e0/providers/Microsoft.Security/assessments/ad4f3ff1-30eb-5042-16ed-27198f640b8d\",\r\n \"name\": \"ad4f3ff1-30eb-5042-16ed-27198f640b8d\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/new-api-rg/providers/microsoft.storage/storageaccounts/storageaccountnewap90e0\"\r\n },\r\n \"displayName\": \"Storage accounts should restrict network access using virtual network rules\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlauditnorhckgibckar6zs/providers/Microsoft.Security/assessments/ad4f3ff1-30eb-5042-16ed-27198f640b8d\",\r\n \"name\": \"ad4f3ff1-30eb-5042-16ed-27198f640b8d\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlauditnorhckgibckar6zs\"\r\n },\r\n \"displayName\": \"Storage accounts should restrict network access using virtual network rules\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/microsoft.containerregistry/registries/sdkref/providers/Microsoft.Security/assessments/9b828565-a0ed-61c2-6bf3-1afc99a9b2ca\",\r\n \"name\": \"9b828565-a0ed-61c2-6bf3-1afc99a9b2ca\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/microsoft.containerregistry/registries/sdkref\"\r\n },\r\n \"displayName\": \"Container registries should not allow unrestricted network access\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlvamhbxfrvxg27hk/providers/Microsoft.Security/assessments/ad4f3ff1-30eb-5042-16ed-27198f640b8d\",\r\n \"name\": \"ad4f3ff1-30eb-5042-16ed-27198f640b8d\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlvamhbxfrvxg27hk\"\r\n },\r\n \"displayName\": \"Storage accounts should restrict network access using virtual network rules\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/myservice1diag229/providers/Microsoft.Security/assessments/ad4f3ff1-30eb-5042-16ed-27198f640b8d\",\r\n \"name\": \"ad4f3ff1-30eb-5042-16ed-27198f640b8d\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/myservice1diag229\"\r\n },\r\n \"displayName\": \"Storage accounts should restrict network access using virtual network rules\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlauditcenkokky5rfpyhsm/providers/Microsoft.Security/assessments/ad4f3ff1-30eb-5042-16ed-27198f640b8d\",\r\n \"name\": \"ad4f3ff1-30eb-5042-16ed-27198f640b8d\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlauditcenkokky5rfpyhsm\"\r\n },\r\n \"displayName\": \"Storage accounts should restrict network access using virtual network rules\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/rc44m4u3jcfyesyslog/providers/Microsoft.Security/assessments/ad4f3ff1-30eb-5042-16ed-27198f640b8d\",\r\n \"name\": \"ad4f3ff1-30eb-5042-16ed-27198f640b8d\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/rc44m4u3jcfyesyslog\"\r\n },\r\n \"displayName\": \"Storage accounts should restrict network access using virtual network rules\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.storage/storageaccounts/storagefdi4i/providers/Microsoft.Security/assessments/ad4f3ff1-30eb-5042-16ed-27198f640b8d\",\r\n \"name\": \"ad4f3ff1-30eb-5042-16ed-27198f640b8d\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.storage/storageaccounts/storagefdi4i\"\r\n },\r\n \"displayName\": \"Storage accounts should restrict network access using virtual network rules\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/myservice1diag/providers/Microsoft.Security/assessments/ad4f3ff1-30eb-5042-16ed-27198f640b8d\",\r\n \"name\": \"ad4f3ff1-30eb-5042-16ed-27198f640b8d\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/myservice1diag\"\r\n },\r\n \"displayName\": \"Storage accounts should restrict network access using virtual network rules\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-cus/providers/microsoft.storage/storageaccounts/samplestorageaccount2/providers/Microsoft.Security/assessments/ad4f3ff1-30eb-5042-16ed-27198f640b8d\",\r\n \"name\": \"ad4f3ff1-30eb-5042-16ed-27198f640b8d\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-cus/providers/microsoft.storage/storageaccounts/samplestorageaccount2\"\r\n },\r\n \"displayName\": \"Storage accounts should restrict network access using virtual network rules\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.storage/storageaccounts/stgvx6syhq6e4vr4/providers/Microsoft.Security/assessments/ad4f3ff1-30eb-5042-16ed-27198f640b8d\",\r\n \"name\": \"ad4f3ff1-30eb-5042-16ed-27198f640b8d\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.storage/storageaccounts/stgvx6syhq6e4vr4\"\r\n },\r\n \"displayName\": \"Storage accounts should restrict network access using virtual network rules\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/clitest.rgux2hohzfm5ae5g3e2kmehihecmlqvykbbwsyvm42bkvazts5afq5z5yozj4nl5rkj/providers/microsoft.storage/storageaccounts/clitestiwr74bhqm6myki4hp/providers/Microsoft.Security/assessments/ad4f3ff1-30eb-5042-16ed-27198f640b8d\",\r\n \"name\": \"ad4f3ff1-30eb-5042-16ed-27198f640b8d\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/clitest.rgux2hohzfm5ae5g3e2kmehihecmlqvykbbwsyvm42bkvazts5afq5z5yozj4nl5rkj/providers/microsoft.storage/storageaccounts/clitestiwr74bhqm6myki4hp\"\r\n },\r\n \"displayName\": \"Storage accounts should restrict network access using virtual network rules\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/clitest.rglcgsehtecwpwxccgtkja6224bw44vnfv2k467vcpemnzdcao6sps5zepofomkzwvi/providers/microsoft.storage/storageaccounts/clitestjnrp2z3af7yw7ebbd/providers/Microsoft.Security/assessments/ad4f3ff1-30eb-5042-16ed-27198f640b8d\",\r\n \"name\": \"ad4f3ff1-30eb-5042-16ed-27198f640b8d\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/clitest.rglcgsehtecwpwxccgtkja6224bw44vnfv2k467vcpemnzdcao6sps5zepofomkzwvi/providers/microsoft.storage/storageaccounts/clitestjnrp2z3af7yw7ebbd\"\r\n },\r\n \"displayName\": \"Storage accounts should restrict network access using virtual network rules\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.network/applicationgateways/contosowaf2/providers/Microsoft.Security/assessments/efe75f01-6fff-5d9d-08e6-092b98d3fb3f\",\r\n \"name\": \"efe75f01-6fff-5d9d-08e6-092b98d3fb3f\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.network/applicationgateways/contosowaf2\"\r\n },\r\n \"displayName\": \"Web Application Firewall (WAF) should be enabled for Application Gateway\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.network/applicationgateways/contosowaf/providers/Microsoft.Security/assessments/efe75f01-6fff-5d9d-08e6-092b98d3fb3f\",\r\n \"name\": \"efe75f01-6fff-5d9d-08e6-092b98d3fb3f\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.network/applicationgateways/contosowaf\"\r\n },\r\n \"displayName\": \"Web Application Firewall (WAF) should be enabled for Application Gateway\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/e1145ab1-eb4f-43d8-911b-36ddf771d13f\",\r\n \"name\": \"e1145ab1-eb4f-43d8-911b-36ddf771d13f\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"System updates should be installed on your machines (powered by Update Center)\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NoScanData\",\r\n \"description\": \"The latest scan on the machine failed\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/e1145ab1-eb4f-43d8-911b-36ddf771d13f/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests/providers/Microsoft.Security/assessments/75396512-3323-9be4-059d-32ecb113c3de\",\r\n \"name\": \"75396512-3323-9be4-059d-32ecb113c3de\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests\"\r\n },\r\n \"displayName\": \"Private endpoint connections on Azure SQL Database should be enabled\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/Microsoft.Sql/servers/datastore/providers/Microsoft.Security/assessments/75396512-3323-9be4-059d-32ecb113c3de\",\r\n \"name\": \"75396512-3323-9be4-059d-32ecb113c3de\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/Microsoft.Sql/servers/datastore\"\r\n },\r\n \"displayName\": \"Private endpoint connections on Azure SQL Database should be enabled\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests/providers/Microsoft.Security/assessments/22e93e92-4a31-b4cd-d640-3ef908430aa6\",\r\n \"name\": \"22e93e92-4a31-b4cd-d640-3ef908430aa6\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests\"\r\n },\r\n \"displayName\": \"Public network access on Azure SQL Database should be disabled\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/Microsoft.Sql/servers/datastore/providers/Microsoft.Security/assessments/22e93e92-4a31-b4cd-d640-3ef908430aa6\",\r\n \"name\": \"22e93e92-4a31-b4cd-d640-3ef908430aa6\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/Microsoft.Sql/servers/datastore\"\r\n },\r\n \"displayName\": \"Public network access on Azure SQL Database should be disabled\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-03-14T00:00:00\",\r\n \"firstEvaluationDate\": \"2021-03-14T00:00:00\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.compute/virtualmachines/alertstest/providers/Microsoft.Security/assessments/4ab6e3c5-74dd-8b35-9ab9-f61b30875b27\",\r\n \"name\": \"4ab6e3c5-74dd-8b35-9ab9-f61b30875b27\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.compute/virtualmachines/alertstest\"\r\n },\r\n \"displayName\": \"System updates should be installed on your machines\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-04-07T20:23:43.7791199Z\",\r\n \"firstEvaluationDate\": \"2021-04-07T08:23:44.5057723Z\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.compute/virtualmachines/alertstest/providers/Microsoft.Security/assessments/4ab6e3c5-74dd-8b35-9ab9-f61b30875b27/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/1ff0b4c9-ed56-4de6-be9c-d7ab39645926\",\r\n \"name\": \"1ff0b4c9-ed56-4de6-be9c-d7ab39645926\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"Deprecated accounts should be removed from your subscription\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-06-13T20:32:51.8773336Z\",\r\n \"firstEvaluationDate\": \"2021-06-13T20:32:51.8773336Z\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/1ff0b4c9-ed56-4de6-be9c-d7ab39645926/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/dabc9bc4-b8a8-45bd-9a5a-43000df8aa1c\",\r\n \"name\": \"dabc9bc4-b8a8-45bd-9a5a-43000df8aa1c\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"MFA should be enabled on accounts with read permissions on your subscription\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-06-13T20:32:51.8989149Z\",\r\n \"firstEvaluationDate\": \"2021-06-13T20:32:51.8989149Z\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/dabc9bc4-b8a8-45bd-9a5a-43000df8aa1c/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/6240402e-f77c-46fa-9060-a7ce53997754\",\r\n \"name\": \"6240402e-f77c-46fa-9060-a7ce53997754\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"MFA should be enabled on accounts with owner permissions on your subscription\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-06-13T20:32:51.9030516Z\",\r\n \"firstEvaluationDate\": \"2021-06-13T20:32:51.9030516Z\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/6240402e-f77c-46fa-9060-a7ce53997754/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/050ac097-3dda-4d24-ab6d-82568e7a50cf\",\r\n \"name\": \"050ac097-3dda-4d24-ab6d-82568e7a50cf\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"Deprecated accounts with owner permissions should be removed from your subscription\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-06-13T20:32:51.5634277Z\",\r\n \"firstEvaluationDate\": \"2021-06-13T20:32:51.5634277Z\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/050ac097-3dda-4d24-ab6d-82568e7a50cf/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/0354476c-a12a-4fcc-a79d-f0ab7ffffdbb\",\r\n \"name\": \"0354476c-a12a-4fcc-a79d-f0ab7ffffdbb\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"External accounts with write permissions should be removed from your subscription\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-06-13T20:32:51.5805219Z\",\r\n \"firstEvaluationDate\": \"2021-06-13T20:32:51.5805219Z\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/0354476c-a12a-4fcc-a79d-f0ab7ffffdbb/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/c0cb17b2-0607-48a7-b0e0-903ed22de39b\",\r\n \"name\": \"c0cb17b2-0607-48a7-b0e0-903ed22de39b\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"MFA should be enabled on accounts with write permissions on your subscription\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-06-13T20:32:51.5849535Z\",\r\n \"firstEvaluationDate\": \"2021-06-13T20:32:51.5849535Z\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/c0cb17b2-0607-48a7-b0e0-903ed22de39b/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/fde1c0c9-0fd2-4ecc-87b5-98956cbc1095\",\r\n \"name\": \"fde1c0c9-0fd2-4ecc-87b5-98956cbc1095\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"External accounts with read permissions should be removed from your subscription\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-06-13T20:32:51.6284481Z\",\r\n \"firstEvaluationDate\": \"2021-06-13T20:32:51.6284481Z\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/fde1c0c9-0fd2-4ecc-87b5-98956cbc1095/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/20606e75-05c4-48c0-9d97-add6daa2109a\",\r\n \"name\": \"20606e75-05c4-48c0-9d97-add6daa2109a\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"External accounts with owner permissions should be removed from your subscription\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-06-13T20:32:51.6489205Z\",\r\n \"firstEvaluationDate\": \"2021-06-13T20:32:51.6489205Z\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/20606e75-05c4-48c0-9d97-add6daa2109a/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-eus/providers/microsoft.operationalinsights/workspaces/defaultworkspace-487bb485-b5b0-471e-9c0d-10717612f869-eus/providers/Microsoft.Security/assessments/1ce68079-b783-4404-b341-d2851d6f0fa2\",\r\n \"name\": \"1ce68079-b783-4404-b341-d2851d6f0fa2\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-eus/providers/microsoft.operationalinsights/workspaces/defaultworkspace-487bb485-b5b0-471e-9c0d-10717612f869-eus\"\r\n },\r\n \"displayName\": \"Microsoft Defender for servers should be enabled on workspaces\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-08-15T20:33:17.9996311Z\",\r\n \"firstEvaluationDate\": \"2021-08-15T20:33:17.9996311Z\"\r\n },\r\n \"additionalData\": {\r\n \"Number Of Reporting Machines\": \"0\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-weu/providers/microsoft.operationalinsights/workspaces/defaultworkspace-487bb485-b5b0-471e-9c0d-10717612f869-weu/providers/Microsoft.Security/assessments/1ce68079-b783-4404-b341-d2851d6f0fa2\",\r\n \"name\": \"1ce68079-b783-4404-b341-d2851d6f0fa2\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-weu/providers/microsoft.operationalinsights/workspaces/defaultworkspace-487bb485-b5b0-471e-9c0d-10717612f869-weu\"\r\n },\r\n \"displayName\": \"Microsoft Defender for servers should be enabled on workspaces\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-08-15T20:33:17.9996311Z\",\r\n \"firstEvaluationDate\": \"2021-08-15T20:33:17.9996311Z\"\r\n },\r\n \"additionalData\": {\r\n \"Number Of Reporting Machines\": \"0\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.documentdb/databaseaccounts/documentdb-fdi4i/providers/Microsoft.Security/assessments/276b1952-c364-852b-11e5-657f0fa34dc6\",\r\n \"name\": \"276b1952-c364-852b-11e5-657f0fa34dc6\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.documentdb/databaseaccounts/documentdb-fdi4i\"\r\n },\r\n \"displayName\": \"Azure Cosmos DB accounts should have firewall rules\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-08-24T22:04:02.6829265Z\",\r\n \"firstEvaluationDate\": \"2021-08-24T22:04:02.6829265Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.keyvault/vaults/alerts/providers/Microsoft.Security/assessments/4ed62ae4-5072-f9e7-8d94-51c76c48159a\",\r\n \"name\": \"4ed62ae4-5072-f9e7-8d94-51c76c48159a\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.keyvault/vaults/alerts\"\r\n },\r\n \"displayName\": \"Key vaults should have purge protection enabled\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-08-09T01:03:52.5124099Z\",\r\n \"firstEvaluationDate\": \"2021-08-09T01:03:52.5124099Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.keyvault/vaults/alerts/providers/Microsoft.Security/assessments/78211c00-15a9-336e-17c4-0b48613dadf4\",\r\n \"name\": \"78211c00-15a9-336e-17c4-0b48613dadf4\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.keyvault/vaults/alerts\"\r\n },\r\n \"displayName\": \"Key vaults should have soft delete enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-08-09T01:03:52.5158627Z\",\r\n \"firstEvaluationDate\": \"2021-08-09T01:03:52.5158627Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.keyvault/vaults/alerts/providers/Microsoft.Security/assessments/52f7826a-ace7-3107-dd0d-4875853c1576\",\r\n \"name\": \"52f7826a-ace7-3107-dd0d-4875853c1576\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.keyvault/vaults/alerts\"\r\n },\r\n \"displayName\": \"Firewall should be enabled on Key Vault\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-08-09T01:03:52.513154Z\",\r\n \"firstEvaluationDate\": \"2021-08-09T01:03:52.513154Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.keyvault/vaults/alerts/providers/Microsoft.Security/assessments/2e96bc2f-1972-e471-9e70-ae58d41e9d2a\",\r\n \"name\": \"2e96bc2f-1972-e471-9e70-ae58d41e9d2a\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.keyvault/vaults/alerts\"\r\n },\r\n \"displayName\": \"Private endpoint should be configured for Key Vault\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-08-09T01:03:52.5176301Z\",\r\n \"firstEvaluationDate\": \"2021-08-09T01:03:52.5176301Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/4fb67663-9ab9-475d-b026-8c544cced439\",\r\n \"name\": \"4fb67663-9ab9-475d-b026-8c544cced439\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"Endpoint protection should be installed on machines\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-08-02T06:02:19.3314049Z\",\r\n \"firstEvaluationDate\": \"2021-08-02T06:02:19.3314049Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/37a3689a-818e-4a0e-82ac-b1392b9bb000\",\r\n \"name\": \"37a3689a-818e-4a0e-82ac-b1392b9bb000\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"Endpoint protection health issues on machines should be resolved\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-08-02T06:02:19.465464Z\",\r\n \"firstEvaluationDate\": \"2021-08-02T06:02:19.465464Z\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/37a3689a-818e-4a0e-82ac-b1392b9bb000/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/1f655fb7-63ca-4980-91a3-56dbc2b715c6\",\r\n \"name\": \"1f655fb7-63ca-4980-91a3-56dbc2b715c6\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"Vulnerabilities in security configuration on your Linux machines should be remediated (powered by Guest Configuration)\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NoExtension\",\r\n \"description\": \"Guest Configuration extension is not installed on the machine\",\r\n \"statusChangeDate\": \"2021-08-15T16:13:02.7856736Z\",\r\n \"firstEvaluationDate\": \"2021-08-15T16:13:02.7856736Z\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/1f655fb7-63ca-4980-91a3-56dbc2b715c6/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/8c3d9ad0-3639-4686-9cd2-2b2ab2609bda\",\r\n \"name\": \"8c3d9ad0-3639-4686-9cd2-2b2ab2609bda\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"Vulnerabilities in security configuration on your Windows machines should be remediated (powered by Guest Configuration)\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NoExtension\",\r\n \"description\": \"Guest Configuration extension is not installed on the machine\",\r\n \"statusChangeDate\": \"2021-08-15T16:13:02.8319806Z\",\r\n \"firstEvaluationDate\": \"2021-08-15T16:13:02.8319806Z\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/taklei/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/8c3d9ad0-3639-4686-9cd2-2b2ab2609bda/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/8c3d9ad0-3639-4686-9cd2-2b2ab2609bda\",\r\n \"name\": \"8c3d9ad0-3639-4686-9cd2-2b2ab2609bda\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"Vulnerabilities in security configuration on your Windows machines should be remediated (powered by Guest Configuration)\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NoExtension\",\r\n \"description\": \"Guest Configuration extension is not installed on the machine\",\r\n \"statusChangeDate\": \"2021-08-15T16:13:02.904596Z\",\r\n \"firstEvaluationDate\": \"2021-08-15T16:13:02.904596Z\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/8c3d9ad0-3639-4686-9cd2-2b2ab2609bda/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/1f655fb7-63ca-4980-91a3-56dbc2b715c6\",\r\n \"name\": \"1f655fb7-63ca-4980-91a3-56dbc2b715c6\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Vulnerabilities in security configuration on your Linux machines should be remediated (powered by Guest Configuration)\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NoExtension\",\r\n \"description\": \"Guest Configuration extension is not installed on the machine\",\r\n \"statusChangeDate\": \"2021-08-15T16:13:02.9081607Z\",\r\n \"firstEvaluationDate\": \"2021-08-15T16:13:02.9081607Z\"\r\n },\r\n \"additionalData\": {\r\n \"subAssessmentsLink\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/myService1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/1f655fb7-63ca-4980-91a3-56dbc2b715c6/subAssessments\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/2c79b4af-f830-b61e-92b9-63dfa30f16e4\",\r\n \"name\": \"2c79b4af-f830-b61e-92b9-63dfa30f16e4\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"There should be more than one owner assigned to subscriptions\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-09-19T20:32:53.6046192Z\",\r\n \"firstEvaluationDate\": \"2021-09-19T20:32:53.6046192Z\"\r\n },\r\n \"additionalData\": {}\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/6f90a6d6-d4d6-0794-0ec1-98fa77878c2e\",\r\n \"name\": \"6f90a6d6-d4d6-0794-0ec1-98fa77878c2e\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"A maximum of 3 owners should be designated for subscriptions\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-09-19T20:32:53.6059449Z\",\r\n \"firstEvaluationDate\": \"2021-09-19T20:32:53.6059449Z\"\r\n },\r\n \"additionalData\": {\r\n \"identityDesignateLessThanXOwnersObjectIdList\": \"[\\\"56b8f04c-b471-415a-bbc2-74570bd022de\\\",\\\"af29e494-977e-4749-acb6-6fe3a10c56aa\\\",\\\"25b2be9f-65f7-491e-9e53-61fa1b39fa8a\\\",\\\"08ebb2ca-8554-40f6-91a8-f274313fc8ae\\\"]\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/57e98606-6b1e-6193-0e3d-fe621387c16b\",\r\n \"name\": \"57e98606-6b1e-6193-0e3d-fe621387c16b\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"MFA should be enabled on accounts with write permissions on subscriptions\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-09-19T20:32:53.6115249Z\",\r\n \"firstEvaluationDate\": \"2021-09-19T20:32:53.6115249Z\"\r\n },\r\n \"additionalData\": {\r\n \"usersWithNoMfaObjectIdList\": \"[]\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/151e82c5-5341-a74b-1eb0-bc38d2c84bb5\",\r\n \"name\": \"151e82c5-5341-a74b-1eb0-bc38d2c84bb5\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"MFA should be enabled on accounts with read permissions on subscriptions\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-09-19T20:32:53.6141561Z\",\r\n \"firstEvaluationDate\": \"2021-09-19T20:32:53.6141561Z\"\r\n },\r\n \"additionalData\": {\r\n \"usersWithNoMfaObjectIdList\": \"[]\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/e52064aa-6853-e252-a11e-dffc675689c2\",\r\n \"name\": \"e52064aa-6853-e252-a11e-dffc675689c2\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"Deprecated accounts with owner permissions should be removed from subscriptions\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-09-19T20:32:53.6103438Z\",\r\n \"firstEvaluationDate\": \"2021-09-19T20:32:53.6103438Z\"\r\n },\r\n \"additionalData\": {\r\n \"deprecatedAccountsWithOwnerPermissionsObjectIdList\": \"[]\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/94290b00-4d0c-d7b4-7cea-064a9554e681\",\r\n \"name\": \"94290b00-4d0c-d7b4-7cea-064a9554e681\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"MFA should be enabled on accounts with owner permissions on subscriptions\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-09-19T20:32:53.6213412Z\",\r\n \"firstEvaluationDate\": \"2021-09-19T20:32:53.6213412Z\"\r\n },\r\n \"additionalData\": {\r\n \"usersWithNoMfaObjectIdList\": \"[]\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/04e7147b-0deb-9796-2e5c-0336343ceb3d\",\r\n \"name\": \"04e7147b-0deb-9796-2e5c-0336343ceb3d\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"External accounts with write permissions should be removed from subscriptions\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-09-19T20:32:53.6330153Z\",\r\n \"firstEvaluationDate\": \"2021-09-19T20:32:53.6330153Z\"\r\n },\r\n \"additionalData\": {\r\n \"externalAccountsWithWritePermissionsObjectIdList\": \"[]\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/00c6d40b-e990-6acf-d4f3-471e747a27c4\",\r\n \"name\": \"00c6d40b-e990-6acf-d4f3-471e747a27c4\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"Deprecated accounts should be removed from subscriptions\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-09-19T20:32:53.6353479Z\",\r\n \"firstEvaluationDate\": \"2021-09-19T20:32:53.6353479Z\"\r\n },\r\n \"additionalData\": {\r\n \"deprecatedAccountsObjectIdList\": \"[]\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/a8c6a4ad-d51e-88fe-2979-d3ee3c864f8b\",\r\n \"name\": \"a8c6a4ad-d51e-88fe-2979-d3ee3c864f8b\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"External accounts with read permissions should be removed from subscriptions\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-09-19T20:32:53.6345574Z\",\r\n \"firstEvaluationDate\": \"2021-09-19T20:32:53.6345574Z\"\r\n },\r\n \"additionalData\": {\r\n \"externalAccountsWithReadPermissionsObjectIdList\": \"[]\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/c3b6ae71-f1f0-31b4-e6c1-d5951285d03d\",\r\n \"name\": \"c3b6ae71-f1f0-31b4-e6c1-d5951285d03d\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"External accounts with owner permissions should be removed from subscriptions\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-09-19T20:32:53.7199527Z\",\r\n \"firstEvaluationDate\": \"2021-09-19T20:32:53.7199527Z\"\r\n },\r\n \"additionalData\": {\r\n \"externalAccountsWithOwnerPermissionsObjectIdList\": \"[]\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/mainws/providers/microsoft.operationalinsights/workspaces/securityuserws/providers/Microsoft.Security/assessments/1ce68079-b783-4404-b341-d2851d6f0fa2\",\r\n \"name\": \"1ce68079-b783-4404-b341-d2851d6f0fa2\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/mainws/providers/microsoft.operationalinsights/workspaces/securityuserws\"\r\n },\r\n \"displayName\": \"Microsoft Defender for servers should be enabled on workspaces\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-09-19T20:32:54.9171468Z\",\r\n \"firstEvaluationDate\": \"2021-09-19T20:32:54.9171468Z\"\r\n },\r\n \"additionalData\": {\r\n \"Number Of Reporting Machines\": \"1\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.operationalinsights/workspaces/testservicews/providers/Microsoft.Security/assessments/1ce68079-b783-4404-b341-d2851d6f0fa2\",\r\n \"name\": \"1ce68079-b783-4404-b341-d2851d6f0fa2\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.operationalinsights/workspaces/testservicews\"\r\n },\r\n \"displayName\": \"Microsoft Defender for servers should be enabled on workspaces\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-09-19T20:32:54.9171468Z\",\r\n \"firstEvaluationDate\": \"2021-09-19T20:32:54.9171468Z\"\r\n },\r\n \"additionalData\": {\r\n \"Number Of Reporting Machines\": \"1\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-eus/providers/microsoft.operationalinsights/workspaces/defaultworkspace-487bb485-b5b0-471e-9c0d-10717612f869-eus/providers/Microsoft.Security/assessments/e9c320f1-03a0-4d2b-9a37-84b3bdc2e281\",\r\n \"name\": \"e9c320f1-03a0-4d2b-9a37-84b3bdc2e281\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-eus/providers/microsoft.operationalinsights/workspaces/defaultworkspace-487bb485-b5b0-471e-9c0d-10717612f869-eus\"\r\n },\r\n \"displayName\": \"Microsoft Defender for SQL on machines should be enabled on workspaces\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-10-03T21:33:32.3743312Z\",\r\n \"firstEvaluationDate\": \"2021-10-03T21:33:32.3743312Z\"\r\n },\r\n \"additionalData\": {\r\n \"Number Of Reporting Machines\": \"0\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-weu/providers/microsoft.operationalinsights/workspaces/defaultworkspace-487bb485-b5b0-471e-9c0d-10717612f869-weu/providers/Microsoft.Security/assessments/e9c320f1-03a0-4d2b-9a37-84b3bdc2e281\",\r\n \"name\": \"e9c320f1-03a0-4d2b-9a37-84b3bdc2e281\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-weu/providers/microsoft.operationalinsights/workspaces/defaultworkspace-487bb485-b5b0-471e-9c0d-10717612f869-weu\"\r\n },\r\n \"displayName\": \"Microsoft Defender for SQL on machines should be enabled on workspaces\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-10-03T21:33:32.3743312Z\",\r\n \"firstEvaluationDate\": \"2021-10-03T21:33:32.3743312Z\"\r\n },\r\n \"additionalData\": {\r\n \"Number Of Reporting Machines\": \"0\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/mainws/providers/microsoft.operationalinsights/workspaces/securityuserws/providers/Microsoft.Security/assessments/e9c320f1-03a0-4d2b-9a37-84b3bdc2e281\",\r\n \"name\": \"e9c320f1-03a0-4d2b-9a37-84b3bdc2e281\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/mainws/providers/microsoft.operationalinsights/workspaces/securityuserws\"\r\n },\r\n \"displayName\": \"Microsoft Defender for SQL on machines should be enabled on workspaces\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-10-03T21:33:32.3743312Z\",\r\n \"firstEvaluationDate\": \"2021-10-03T21:33:32.3743312Z\"\r\n },\r\n \"additionalData\": {\r\n \"Number Of Reporting Machines\": \"1\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.operationalinsights/workspaces/testservicews/providers/Microsoft.Security/assessments/e9c320f1-03a0-4d2b-9a37-84b3bdc2e281\",\r\n \"name\": \"e9c320f1-03a0-4d2b-9a37-84b3bdc2e281\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.operationalinsights/workspaces/testservicews\"\r\n },\r\n \"displayName\": \"Microsoft Defender for SQL on machines should be enabled on workspaces\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-10-04T21:33:36.2516476Z\",\r\n \"firstEvaluationDate\": \"2021-10-03T21:33:32.3743312Z\"\r\n },\r\n \"additionalData\": {\r\n \"Number Of Reporting Machines\": \"1\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/new-api-rg/providers/microsoft.web/sites/updateapitasks/providers/Microsoft.Security/assessments/cb0acdc6-0846-fd48-debe-9905af151b6d\",\r\n \"name\": \"cb0acdc6-0846-fd48-debe-9905af151b6d\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/new-api-rg/providers/microsoft.web/sites/updateapitasks\"\r\n },\r\n \"displayName\": \"Function App should only be accessible over HTTPS\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-10-19T18:46:59.7996975Z\",\r\n \"firstEvaluationDate\": \"2021-10-19T18:46:59.7996975Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/functions-vx6syhq6e4vr4/providers/Microsoft.Security/assessments/cb0acdc6-0846-fd48-debe-9905af151b6d\",\r\n \"name\": \"cb0acdc6-0846-fd48-debe-9905af151b6d\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/functions-vx6syhq6e4vr4\"\r\n },\r\n \"displayName\": \"Function App should only be accessible over HTTPS\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-10-19T18:46:59.7996975Z\",\r\n \"firstEvaluationDate\": \"2021-10-19T18:46:59.7996975Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/iotsimulator-fdi4i/providers/Microsoft.Security/assessments/1b351b29-41ca-6df5-946c-c190a56be5fe\",\r\n \"name\": \"1b351b29-41ca-6df5-946c-c190a56be5fe\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/iotsimulator-fdi4i\"\r\n },\r\n \"displayName\": \"Web Application should only be accessible over HTTPS\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-10-19T18:46:59.8041627Z\",\r\n \"firstEvaluationDate\": \"2021-10-19T18:46:59.8041627Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/iotsimulator-fdi4i/providers/Microsoft.Security/assessments/ca4e6a5a-3a9a-bad3-798a-d420a1d9bd6d\",\r\n \"name\": \"ca4e6a5a-3a9a-bad3-798a-d420a1d9bd6d\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/iotsimulator-fdi4i\"\r\n },\r\n \"displayName\": \"Web apps should request an SSL certificate for all incoming requests\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-10-19T18:46:59.8187875Z\",\r\n \"firstEvaluationDate\": \"2021-10-19T18:46:59.8187875Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/new-api-rg/providers/microsoft.web/sites/updateapitasks/providers/Microsoft.Security/assessments/c2ab4bea-c663-3259-a4cd-03a8feb02825\",\r\n \"name\": \"c2ab4bea-c663-3259-a4cd-03a8feb02825\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/new-api-rg/providers/microsoft.web/sites/updateapitasks\"\r\n },\r\n \"displayName\": \"Function apps should have Client Certificates (Incoming client certificates) enabled\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-10-19T18:46:59.8425325Z\",\r\n \"firstEvaluationDate\": \"2021-10-19T18:46:59.8425325Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/functions-vx6syhq6e4vr4/providers/Microsoft.Security/assessments/c2ab4bea-c663-3259-a4cd-03a8feb02825\",\r\n \"name\": \"c2ab4bea-c663-3259-a4cd-03a8feb02825\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/functions-vx6syhq6e4vr4\"\r\n },\r\n \"displayName\": \"Function apps should have Client Certificates (Incoming client certificates) enabled\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2021-10-19T18:46:59.8425325Z\",\r\n \"firstEvaluationDate\": \"2021-10-19T18:46:59.8425325Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.compute/virtualmachines/alertstest/providers/Microsoft.Security/assessments/12018f4f-3d10-999b-e4c4-86ec25be08a1\",\r\n \"name\": \"12018f4f-3d10-999b-e4c4-86ec25be08a1\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.compute/virtualmachines/alertstest\"\r\n },\r\n \"displayName\": \"Virtual machines should be migrated to new Azure Resource Manager resources\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-11-02T18:19:55.1336704Z\",\r\n \"firstEvaluationDate\": \"2021-11-02T18:19:55.1336704Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice1/providers/Microsoft.Security/assessments/12018f4f-3d10-999b-e4c4-86ec25be08a1\",\r\n \"name\": \"12018f4f-3d10-999b-e4c4-86ec25be08a1\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice1\"\r\n },\r\n \"displayName\": \"Virtual machines should be migrated to new Azure Resource Manager resources\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-11-02T18:19:55.1336704Z\",\r\n \"firstEvaluationDate\": \"2021-11-02T18:19:55.1336704Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice/providers/Microsoft.Security/assessments/12018f4f-3d10-999b-e4c4-86ec25be08a1\",\r\n \"name\": \"12018f4f-3d10-999b-e4c4-86ec25be08a1\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice\"\r\n },\r\n \"displayName\": \"Virtual machines should be migrated to new Azure Resource Manager resources\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-11-02T18:19:55.1336704Z\",\r\n \"firstEvaluationDate\": \"2021-11-02T18:19:55.1336704Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/12018f4f-3d10-999b-e4c4-86ec25be08a1\",\r\n \"name\": \"12018f4f-3d10-999b-e4c4-86ec25be08a1\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Virtual machines should be migrated to new Azure Resource Manager resources\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-11-02T18:19:55.1336704Z\",\r\n \"firstEvaluationDate\": \"2021-11-02T18:19:55.1336704Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.compute/virtualmachines/alertstest/providers/Microsoft.Security/assessments/69ad830b-d98c-b1cf-2158-9d69d38c7093\",\r\n \"name\": \"69ad830b-d98c-b1cf-2158-9d69d38c7093\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.compute/virtualmachines/alertstest\"\r\n },\r\n \"displayName\": \"Secure Boot should be enabled on supported Windows virtual machines\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-11-02T18:19:55.260862Z\",\r\n \"firstEvaluationDate\": \"2021-11-02T18:19:55.260862Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.compute/virtualmachines/alertstest/providers/Microsoft.Security/assessments/861bbc73-0a55-8d1d-efc6-e92d9e1176e0\",\r\n \"name\": \"861bbc73-0a55-8d1d-efc6-e92d9e1176e0\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.compute/virtualmachines/alertstest\"\r\n },\r\n \"displayName\": \"vTPM should be enabled on supported virtual machines\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-11-02T18:19:55.2609309Z\",\r\n \"firstEvaluationDate\": \"2021-11-02T18:19:55.2609309Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice1/providers/Microsoft.Security/assessments/69ad830b-d98c-b1cf-2158-9d69d38c7093\",\r\n \"name\": \"69ad830b-d98c-b1cf-2158-9d69d38c7093\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice1\"\r\n },\r\n \"displayName\": \"Secure Boot should be enabled on supported Windows virtual machines\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-11-02T18:19:55.260862Z\",\r\n \"firstEvaluationDate\": \"2021-11-02T18:19:55.260862Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice1/providers/Microsoft.Security/assessments/861bbc73-0a55-8d1d-efc6-e92d9e1176e0\",\r\n \"name\": \"861bbc73-0a55-8d1d-efc6-e92d9e1176e0\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice1\"\r\n },\r\n \"displayName\": \"vTPM should be enabled on supported virtual machines\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-11-02T18:19:55.2609309Z\",\r\n \"firstEvaluationDate\": \"2021-11-02T18:19:55.2609309Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice/providers/Microsoft.Security/assessments/69ad830b-d98c-b1cf-2158-9d69d38c7093\",\r\n \"name\": \"69ad830b-d98c-b1cf-2158-9d69d38c7093\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice\"\r\n },\r\n \"displayName\": \"Secure Boot should be enabled on supported Windows virtual machines\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-11-02T18:19:55.260862Z\",\r\n \"firstEvaluationDate\": \"2021-11-02T18:19:55.260862Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice/providers/Microsoft.Security/assessments/861bbc73-0a55-8d1d-efc6-e92d9e1176e0\",\r\n \"name\": \"861bbc73-0a55-8d1d-efc6-e92d9e1176e0\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice\"\r\n },\r\n \"displayName\": \"vTPM should be enabled on supported virtual machines\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-11-02T18:19:55.2609309Z\",\r\n \"firstEvaluationDate\": \"2021-11-02T18:19:55.2609309Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/69ad830b-d98c-b1cf-2158-9d69d38c7093\",\r\n \"name\": \"69ad830b-d98c-b1cf-2158-9d69d38c7093\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Secure Boot should be enabled on supported Windows virtual machines\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-11-02T18:19:55.260862Z\",\r\n \"firstEvaluationDate\": \"2021-11-02T18:19:55.260862Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/861bbc73-0a55-8d1d-efc6-e92d9e1176e0\",\r\n \"name\": \"861bbc73-0a55-8d1d-efc6-e92d9e1176e0\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"vTPM should be enabled on supported virtual machines\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2021-11-02T18:19:55.2609309Z\",\r\n \"firstEvaluationDate\": \"2021-11-02T18:19:55.2609309Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests/providers/Microsoft.Security/assessments/f0553104-cfdb-65e6-759c-002812e38500\",\r\n \"name\": \"f0553104-cfdb-65e6-759c-002812e38500\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests\"\r\n },\r\n \"displayName\": \"SQL servers should have an Azure Active Directory administrator provisioned\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:03.9693764Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:03.9693764Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/Microsoft.Sql/servers/datastore/providers/Microsoft.Security/assessments/f0553104-cfdb-65e6-759c-002812e38500\",\r\n \"name\": \"f0553104-cfdb-65e6-759c-002812e38500\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/Microsoft.Sql/servers/datastore\"\r\n },\r\n \"displayName\": \"SQL servers should have an Azure Active Directory administrator provisioned\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:03.9693764Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:03.9693764Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.keyvault/vaults/alerts/providers/Microsoft.Security/assessments/88bbc99c-e5af-ddd7-6105-6150b2bfa519\",\r\n \"name\": \"88bbc99c-e5af-ddd7-6105-6150b2bfa519\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.keyvault/vaults/alerts\"\r\n },\r\n \"displayName\": \"Diagnostic logs in Key Vault should be enabled\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:03.9919531Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:03.9919531Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.compute/virtualmachinescalesets/iotsi-fdi/providers/Microsoft.Security/assessments/961eb649-3ea9-f8c2-6595-88e9a3aeedeb\",\r\n \"name\": \"961eb649-3ea9-f8c2-6595-88e9a3aeedeb\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.compute/virtualmachinescalesets/iotsi-fdi\"\r\n },\r\n \"displayName\": \"Diagnostic logs in Virtual Machine Scale Sets should be enabled\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:03.9933439Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:03.9933439Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests/providers/Microsoft.Security/assessments/400a6682-992c-4726-9549-629fbc3b988f\",\r\n \"name\": \"400a6682-992c-4726-9549-629fbc3b988f\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests\"\r\n },\r\n \"displayName\": \"Microsoft Defender for SQL should be enabled for unprotected Azure SQL servers\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:03.9984018Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:03.9984018Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/Microsoft.Sql/servers/datastore/providers/Microsoft.Security/assessments/400a6682-992c-4726-9549-629fbc3b988f\",\r\n \"name\": \"400a6682-992c-4726-9549-629fbc3b988f\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/Microsoft.Sql/servers/datastore\"\r\n },\r\n \"displayName\": \"Microsoft Defender for SQL should be enabled for unprotected Azure SQL servers\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:03.9984018Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:03.9984018Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/new-api-rg/providers/microsoft.web/sites/updateapitasks/providers/Microsoft.Security/assessments/7b3d4796-9400-2904-692b-4a5ede7f0a1e\",\r\n \"name\": \"7b3d4796-9400-2904-692b-4a5ede7f0a1e\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/new-api-rg/providers/microsoft.web/sites/updateapitasks\"\r\n },\r\n \"displayName\": \"CORS should not allow every resource to access Function Apps\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0001629Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0001629Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/e599a9fe-30e3-47c6-a173-8b4b6d9d3255\",\r\n \"name\": \"e599a9fe-30e3-47c6-a173-8b4b6d9d3255\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"Microsoft Defender for Containers should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-24T14:23:54.3291012Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0011465Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/iotsimulator-fdi4i/providers/Microsoft.Security/assessments/64b8637e-4e1d-76a9-0fc9-c1e487a97ed8\",\r\n \"name\": \"64b8637e-4e1d-76a9-0fc9-c1e487a97ed8\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/iotsimulator-fdi4i\"\r\n },\r\n \"displayName\": \"Remote debugging should be turned off for Web Applications\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0018099Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0018099Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iot-resourcegroup-cus/providers/microsoft.devices/iothubs/sdk-iothub-del-cus/providers/Microsoft.Security/assessments/77785808-ce86-4e40-b45f-19110a547397\",\r\n \"name\": \"77785808-ce86-4e40-b45f-19110a547397\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iot-resourcegroup-cus/providers/microsoft.devices/iothubs/sdk-iothub-del-cus\"\r\n },\r\n \"displayName\": \"Diagnostic logs in IoT Hub should be enabled\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0018008Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0018008Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/new-api-rg/providers/microsoft.web/sites/updateapitasks/providers/Microsoft.Security/assessments/093c685b-56dd-13a3-8ed5-887a001837a2\",\r\n \"name\": \"093c685b-56dd-13a3-8ed5-887a001837a2\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/new-api-rg/providers/microsoft.web/sites/updateapitasks\"\r\n },\r\n \"displayName\": \"Remote debugging should be turned off for Function App\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0002475Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0002475Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests/providers/Microsoft.Security/assessments/1db4f204-cb5a-4c9c-9254-7556403ce51c\",\r\n \"name\": \"1db4f204-cb5a-4c9c-9254-7556403ce51c\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests\"\r\n },\r\n \"displayName\": \"SQL servers should have vulnerability assessment configured\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:03.996368Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:03.996368Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/Microsoft.Sql/servers/datastore/databases/datastore/providers/Microsoft.Security/assessments/651967bf-044e-4bde-8376-3e08e0600105\",\r\n \"name\": \"651967bf-044e-4bde-8376-3e08e0600105\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/Microsoft.Sql/servers/datastore/databases/datastore\"\r\n },\r\n \"displayName\": \"Transparent Data Encryption on SQL databases should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0015598Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0015598Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/sample-rg/providers/microsoft.devices/iothubs/samplehubforsdk/providers/Microsoft.Security/assessments/77785808-ce86-4e40-b45f-19110a547397\",\r\n \"name\": \"77785808-ce86-4e40-b45f-19110a547397\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/sample-rg/providers/microsoft.devices/iothubs/samplehubforsdk\"\r\n },\r\n \"displayName\": \"Diagnostic logs in IoT Hub should be enabled\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0018008Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0018008Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/functions-vx6syhq6e4vr4/providers/Microsoft.Security/assessments/093c685b-56dd-13a3-8ed5-887a001837a2\",\r\n \"name\": \"093c685b-56dd-13a3-8ed5-887a001837a2\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/functions-vx6syhq6e4vr4\"\r\n },\r\n \"displayName\": \"Remote debugging should be turned off for Function App\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0002475Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0002475Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/Microsoft.Sql/servers/datastore/providers/Microsoft.Security/assessments/1db4f204-cb5a-4c9c-9254-7556403ce51c\",\r\n \"name\": \"1db4f204-cb5a-4c9c-9254-7556403ce51c\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/Microsoft.Sql/servers/datastore\"\r\n },\r\n \"displayName\": \"SQL servers should have vulnerability assessment configured\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:03.996368Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:03.996368Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/clitest.rg7exkn4sm4v24amnub5nzbmik37myxeusxwwyn2jpxwhdbbzlofsr5agedmwfjvoxv/providers/microsoft.devices/iothubs/azurecli-hubuksphkbt3lhh/providers/Microsoft.Security/assessments/77785808-ce86-4e40-b45f-19110a547397\",\r\n \"name\": \"77785808-ce86-4e40-b45f-19110a547397\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/clitest.rg7exkn4sm4v24amnub5nzbmik37myxeusxwwyn2jpxwhdbbzlofsr5agedmwfjvoxv/providers/microsoft.devices/iothubs/azurecli-hubuksphkbt3lhh\"\r\n },\r\n \"displayName\": \"Diagnostic logs in IoT Hub should be enabled\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0018008Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0018008Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/functions-vx6syhq6e4vr4/providers/Microsoft.Security/assessments/7b3d4796-9400-2904-692b-4a5ede7f0a1e\",\r\n \"name\": \"7b3d4796-9400-2904-692b-4a5ede7f0a1e\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/functions-vx6syhq6e4vr4\"\r\n },\r\n \"displayName\": \"CORS should not allow every resource to access Function Apps\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0001629Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0001629Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/iotsimulator-fdi4i/providers/Microsoft.Security/assessments/df4d1739-47f0-60c7-1706-3731fea6ab03\",\r\n \"name\": \"df4d1739-47f0-60c7-1706-3731fea6ab03\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/iotsimulator-fdi4i\"\r\n },\r\n \"displayName\": \"CORS should not allow every resource to access Web Applications\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0034658Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0034658Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/56a6e81f-7413-4f72-9a1b-aaeeaa87c872\",\r\n \"name\": \"56a6e81f-7413-4f72-9a1b-aaeeaa87c872\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"Microsoft Defender for servers should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0045784Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0045784Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/58d72d9d-0310-4792-9a3b-6dd111093cdb\",\r\n \"name\": \"58d72d9d-0310-4792-9a3b-6dd111093cdb\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"Microsoft Defender for Azure SQL Database servers should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0039742Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0039742Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/0876ef51-fee7-449d-ba1e-f2662c7e43c6\",\r\n \"name\": \"0876ef51-fee7-449d-ba1e-f2662c7e43c6\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"Microsoft Defender for App Service should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0054229Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0054229Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/new-api-rg/providers/microsoft.web/sites/updateapitasks/providers/Microsoft.Security/assessments/23aa9cbe-c2fb-6a2f-6c97-885a6d48c4d1\",\r\n \"name\": \"23aa9cbe-c2fb-6a2f-6c97-885a6d48c4d1\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/new-api-rg/providers/microsoft.web/sites/updateapitasks\"\r\n },\r\n \"displayName\": \"Managed identity should be used in function apps\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0053346Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0053346Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests/providers/Microsoft.Security/assessments/94208a8b-16e8-4e5b-abbd-4e81c9d02bee\",\r\n \"name\": \"94208a8b-16e8-4e5b-abbd-4e81c9d02bee\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests\"\r\n },\r\n \"displayName\": \"Auditing on SQL server should be enabled\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:03.9991746Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:03.9991746Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/1be22853-8ed1-4005-9907-ddad64cb1417\",\r\n \"name\": \"1be22853-8ed1-4005-9907-ddad64cb1417\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"Microsoft Defender for Storage should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0048439Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0048439Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/functions-vx6syhq6e4vr4/providers/Microsoft.Security/assessments/23aa9cbe-c2fb-6a2f-6c97-885a6d48c4d1\",\r\n \"name\": \"23aa9cbe-c2fb-6a2f-6c97-885a6d48c4d1\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/functions-vx6syhq6e4vr4\"\r\n },\r\n \"displayName\": \"Managed identity should be used in function apps\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0053346Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0053346Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/Microsoft.Sql/servers/datastore/providers/Microsoft.Security/assessments/94208a8b-16e8-4e5b-abbd-4e81c9d02bee\",\r\n \"name\": \"94208a8b-16e8-4e5b-abbd-4e81c9d02bee\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/Microsoft.Sql/servers/datastore\"\r\n },\r\n \"displayName\": \"Auditing on SQL server should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:03.9991746Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:03.9991746Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/iotsimulator-fdi4i/providers/Microsoft.Security/assessments/2a54c352-7ca4-4bae-ad46-47ecd9595bd2\",\r\n \"name\": \"2a54c352-7ca4-4bae-ad46-47ecd9595bd2\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/iotsimulator-fdi4i\"\r\n },\r\n \"displayName\": \"TLS should be updated to the latest version for web apps\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0071513Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0071513Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests/providers/Microsoft.Security/assessments/620671b8-6661-273a-38ac-4574967750ec\",\r\n \"name\": \"620671b8-6661-273a-38ac-4574967750ec\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/subassessments_sdk_tests/providers/Microsoft.Sql/servers/sqlserversdktests\"\r\n },\r\n \"displayName\": \"Audit retention for SQL servers should be set to at least 90 days\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0069144Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0069144Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/Microsoft.Sql/servers/datastore/providers/Microsoft.Security/assessments/620671b8-6661-273a-38ac-4574967750ec\",\r\n \"name\": \"620671b8-6661-273a-38ac-4574967750ec\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/Microsoft.Sql/servers/datastore\"\r\n },\r\n \"displayName\": \"Audit retention for SQL servers should be set to at least 90 days\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0069144Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0069144Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/b1af52e4-e968-4e2b-b6d0-6736c9651f0a\",\r\n \"name\": \"b1af52e4-e968-4e2b-b6d0-6736c9651f0a\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"Microsoft Defender for Key Vault should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0089767Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0089767Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/new-api-rg/providers/microsoft.web/sites/updateapitasks/providers/Microsoft.Security/assessments/15be5f3c-e0a4-c0fa-fbff-8e50339b4b22\",\r\n \"name\": \"15be5f3c-e0a4-c0fa-fbff-8e50339b4b22\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/new-api-rg/providers/microsoft.web/sites/updateapitasks\"\r\n },\r\n \"displayName\": \"TLS should be updated to the latest version for function apps\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0096265Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0096265Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/iotsimulator-fdi4i/providers/Microsoft.Security/assessments/40394a2c-60fb-7cc5-1944-065772e94f05\",\r\n \"name\": \"40394a2c-60fb-7cc5-1944-065772e94f05\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/iotsimulator-fdi4i\"\r\n },\r\n \"displayName\": \"Diagnostic logs in App Service should be enabled\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0063732Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0063732Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.compute/virtualmachines/alertstest/providers/Microsoft.Security/assessments/f2f595ec-5dc6-68b4-82ef-b63563e9c610\",\r\n \"name\": \"f2f595ec-5dc6-68b4-82ef-b63563e9c610\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.compute/virtualmachines/alertstest\"\r\n },\r\n \"displayName\": \"Azure Backup should be enabled for virtual machines\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0090103Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0090103Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.compute/virtualmachines/alertstest/providers/Microsoft.Security/assessments/22489c48-27d1-4e40-9420-4303ad9cffef\",\r\n \"name\": \"22489c48-27d1-4e40-9420-4303ad9cffef\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.compute/virtualmachines/alertstest\"\r\n },\r\n \"displayName\": \"Windows Defender Exploit Guard should be enabled on machines\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"GCExtensionIdentityMissing\",\r\n \"description\": \"Guest Configuration extension, managed identity and user identity are missing.\",\r\n \"statusChangeDate\": \"2022-03-12T09:07:28.7863485Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0095194Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/functions-vx6syhq6e4vr4/providers/Microsoft.Security/assessments/15be5f3c-e0a4-c0fa-fbff-8e50339b4b22\",\r\n \"name\": \"15be5f3c-e0a4-c0fa-fbff-8e50339b4b22\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/functions-vx6syhq6e4vr4\"\r\n },\r\n \"displayName\": \"TLS should be updated to the latest version for function apps\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0096265Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0096265Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/iotsimulator-fdi4i/providers/Microsoft.Security/assessments/4a3d7cd3-f17c-637a-1ffc-614a01dd03cf\",\r\n \"name\": \"4a3d7cd3-f17c-637a-1ffc-614a01dd03cf\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/iotsimulator-fdi4i\"\r\n },\r\n \"displayName\": \"Managed identity should be used in web apps\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0103616Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0103616Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.network/virtualnetworks/taklei-vnet/providers/Microsoft.Security/assessments/f67fb4ed-d481-44d7-91e5-efadf504f74a\",\r\n \"name\": \"f67fb4ed-d481-44d7-91e5-efadf504f74a\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.network/virtualnetworks/taklei-vnet\"\r\n },\r\n \"displayName\": \"Virtual networks should be protected by Azure Firewall\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0098938Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0098938Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice/providers/Microsoft.Security/assessments/f2f595ec-5dc6-68b4-82ef-b63563e9c610\",\r\n \"name\": \"f2f595ec-5dc6-68b4-82ef-b63563e9c610\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice\"\r\n },\r\n \"displayName\": \"Azure Backup should be enabled for virtual machines\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0090103Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0090103Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice/providers/Microsoft.Security/assessments/22489c48-27d1-4e40-9420-4303ad9cffef\",\r\n \"name\": \"22489c48-27d1-4e40-9420-4303ad9cffef\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice\"\r\n },\r\n \"displayName\": \"Windows Defender Exploit Guard should be enabled on machines\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"GCExtensionIdentityMissing\",\r\n \"description\": \"Guest Configuration extension, managed identity and user identity are missing.\",\r\n \"statusChangeDate\": \"2022-03-12T09:07:28.7863485Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0095194Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/af849052-4299-0692-acc0-bffcbe9e440c\",\r\n \"name\": \"af849052-4299-0692-acc0-bffcbe9e440c\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"Auto provisioning of the Log Analytics agent should be enabled on subscriptions\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0107554Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0107554Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice1/providers/Microsoft.Security/assessments/f2f595ec-5dc6-68b4-82ef-b63563e9c610\",\r\n \"name\": \"f2f595ec-5dc6-68b4-82ef-b63563e9c610\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice1\"\r\n },\r\n \"displayName\": \"Azure Backup should be enabled for virtual machines\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0090103Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0090103Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/iotsimulator-fdi4i/providers/Microsoft.Security/assessments/19beaa2a-a126-b4dd-6d35-617f6cc83fca\",\r\n \"name\": \"19beaa2a-a126-b4dd-6d35-617f6cc83fca\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/iotsimulator-fdi4i\"\r\n },\r\n \"displayName\": \"FTPS should be required in web apps\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.011225Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.011225Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/9f97e78d-88ee-a48d-abe2-5ef12954e7ea\",\r\n \"name\": \"9f97e78d-88ee-a48d-abe2-5ef12954e7ea\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"Email notification to subscription owner for high severity alerts should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0115974Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0115974Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/f2f595ec-5dc6-68b4-82ef-b63563e9c610\",\r\n \"name\": \"f2f595ec-5dc6-68b4-82ef-b63563e9c610\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Azure Backup should be enabled for virtual machines\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0090103Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0090103Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.compute/virtualmachines/alertstest/providers/Microsoft.Security/assessments/6c99f570-2ce7-46bc-8175-cde013df43bc\",\r\n \"name\": \"6c99f570-2ce7-46bc-8175-cde013df43bc\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.compute/virtualmachines/alertstest\"\r\n },\r\n \"displayName\": \"Guest Configuration extension should be installed on machines\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0128255Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0128255Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice1/providers/Microsoft.Security/assessments/6c99f570-2ce7-46bc-8175-cde013df43bc\",\r\n \"name\": \"6c99f570-2ce7-46bc-8175-cde013df43bc\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice1\"\r\n },\r\n \"displayName\": \"Guest Configuration extension should be installed on machines\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0128255Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0128255Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice/providers/Microsoft.Security/assessments/6c99f570-2ce7-46bc-8175-cde013df43bc\",\r\n \"name\": \"6c99f570-2ce7-46bc-8175-cde013df43bc\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice\"\r\n },\r\n \"displayName\": \"Guest Configuration extension should be installed on machines\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0128255Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0128255Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/6c99f570-2ce7-46bc-8175-cde013df43bc\",\r\n \"name\": \"6c99f570-2ce7-46bc-8175-cde013df43bc\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Guest Configuration extension should be installed on machines\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0128255Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0128255Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/new-api-rg/providers/microsoft.web/sites/updateapitasks/providers/Microsoft.Security/assessments/972a6579-f38f-c0b9-1b4b-a5bbeba3ab5b\",\r\n \"name\": \"972a6579-f38f-c0b9-1b4b-a5bbeba3ab5b\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/new-api-rg/providers/microsoft.web/sites/updateapitasks\"\r\n },\r\n \"displayName\": \"FTPS should be required in function apps\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0154555Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0154555Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.compute/virtualmachines/alertstest/providers/Microsoft.Security/assessments/87448ec1-55f6-3746-3f79-0f35beee76b4\",\r\n \"name\": \"87448ec1-55f6-3746-3f79-0f35beee76b4\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.compute/virtualmachines/alertstest\"\r\n },\r\n \"displayName\": \"Windows web servers should be configured to use secure communication protocols\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"GCExtensionIdentityMissing\",\r\n \"description\": \"Guest Configuration extension, managed identity and user identity are missing.\",\r\n \"statusChangeDate\": \"2022-03-12T09:07:29.0377405Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0154914Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/functions-vx6syhq6e4vr4/providers/Microsoft.Security/assessments/972a6579-f38f-c0b9-1b4b-a5bbeba3ab5b\",\r\n \"name\": \"972a6579-f38f-c0b9-1b4b-a5bbeba3ab5b\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.web/sites/functions-vx6syhq6e4vr4\"\r\n },\r\n \"displayName\": \"FTPS should be required in function apps\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0154555Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0154555Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/6ac66a74-761f-4a59-928a-d373eea3f028\",\r\n \"name\": \"6ac66a74-761f-4a59-928a-d373eea3f028\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"Microsoft Defender for SQL servers on machines should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0167308Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0167308Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice/providers/Microsoft.Security/assessments/87448ec1-55f6-3746-3f79-0f35beee76b4\",\r\n \"name\": \"87448ec1-55f6-3746-3f79-0f35beee76b4\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice\"\r\n },\r\n \"displayName\": \"Windows web servers should be configured to use secure communication protocols\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"GCExtensionIdentityMissing\",\r\n \"description\": \"Guest Configuration extension, managed identity and user identity are missing.\",\r\n \"statusChangeDate\": \"2022-03-12T09:07:29.0377405Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0154914Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice1/providers/Microsoft.Security/assessments/22441184-2f7b-d4a0-e00b-4c5eaef4afc9\",\r\n \"name\": \"22441184-2f7b-d4a0-e00b-4c5eaef4afc9\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice1\"\r\n },\r\n \"displayName\": \"Authentication to Linux machines should require SSH keys\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"GCExtensionIdentityMissing\",\r\n \"description\": \"Guest Configuration extension, managed identity and user identity are missing.\",\r\n \"statusChangeDate\": \"2022-03-12T09:07:29.0365627Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0163149Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/22441184-2f7b-d4a0-e00b-4c5eaef4afc9\",\r\n \"name\": \"22441184-2f7b-d4a0-e00b-4c5eaef4afc9\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Authentication to Linux machines should require SSH keys\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"GCExtensionIdentityMissing\",\r\n \"description\": \"Guest Configuration extension, managed identity and user identity are missing.\",\r\n \"statusChangeDate\": \"2022-03-12T09:07:29.0365627Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0163149Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/77758c9d-8a56-5f54-6ff7-69a762ca6004\",\r\n \"name\": \"77758c9d-8a56-5f54-6ff7-69a762ca6004\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"Subscriptions should have a contact email address for security issues\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0213256Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0213256Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.network/virtualnetworks/taklei-vnet/providers/Microsoft.Security/assessments/f1f2f7dc-7bd5-18bf-c403-cbbdb7ec3d68\",\r\n \"name\": \"f1f2f7dc-7bd5-18bf-c403-cbbdb7ec3d68\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.network/virtualnetworks/taklei-vnet\"\r\n },\r\n \"displayName\": \"Network Watcher should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0158943Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0158943Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.network/virtualnetworks/syslogmyservice1net/providers/Microsoft.Security/assessments/f1f2f7dc-7bd5-18bf-c403-cbbdb7ec3d68\",\r\n \"name\": \"f1f2f7dc-7bd5-18bf-c403-cbbdb7ec3d68\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.network/virtualnetworks/syslogmyservice1net\"\r\n },\r\n \"displayName\": \"Network Watcher should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0158943Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0158943Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/3869fbd7-5d90-84e4-37bd-d9a7f4ce9a24\",\r\n \"name\": \"3869fbd7-5d90-84e4-37bd-d9a7f4ce9a24\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"Email notification for high severity alerts should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0231581Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0231581Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/aae10e53-8403-3576-5d97-3b00f97332b2\",\r\n \"name\": \"aae10e53-8403-3576-5d97-3b00f97332b2\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"Microsoft Defender for DNS should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0180004Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0180004Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/f0fb2a7e-16d5-849f-be57-86db712e9bd0\",\r\n \"name\": \"f0fb2a7e-16d5-849f-be57-86db712e9bd0\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"Microsoft Defender for Resource Manager should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0242729Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0242729Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.network/virtualnetworks/myservice1vnet657/providers/Microsoft.Security/assessments/f1f2f7dc-7bd5-18bf-c403-cbbdb7ec3d68\",\r\n \"name\": \"f1f2f7dc-7bd5-18bf-c403-cbbdb7ec3d68\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.network/virtualnetworks/myservice1vnet657\"\r\n },\r\n \"displayName\": \"Network Watcher should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0158943Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0158943Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.network/virtualnetworks/myservice1-vnet/providers/Microsoft.Security/assessments/f1f2f7dc-7bd5-18bf-c403-cbbdb7ec3d68\",\r\n \"name\": \"f1f2f7dc-7bd5-18bf-c403-cbbdb7ec3d68\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.network/virtualnetworks/myservice1-vnet\"\r\n },\r\n \"displayName\": \"Network Watcher should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0158943Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0158943Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.network/virtualnetworks/myservice1/providers/Microsoft.Security/assessments/f1f2f7dc-7bd5-18bf-c403-cbbdb7ec3d68\",\r\n \"name\": \"f1f2f7dc-7bd5-18bf-c403-cbbdb7ec3d68\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.network/virtualnetworks/myservice1\"\r\n },\r\n \"displayName\": \"Network Watcher should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0158943Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0158943Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.network/virtualnetworks/iotsi-fdi-vnet/providers/Microsoft.Security/assessments/f1f2f7dc-7bd5-18bf-c403-cbbdb7ec3d68\",\r\n \"name\": \"f1f2f7dc-7bd5-18bf-c403-cbbdb7ec3d68\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.network/virtualnetworks/iotsi-fdi-vnet\"\r\n },\r\n \"displayName\": \"Network Watcher should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0158943Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0158943Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments/b6a28450-dd5d-4ba4-8806-245e20ef6632\",\r\n \"name\": \"b6a28450-dd5d-4ba4-8806-245e20ef6632\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869\"\r\n },\r\n \"displayName\": \"Microsoft Defender for open-source relational databases should be enabled\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0275362Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0275362Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.storage/storageaccounts/takleidiag/providers/Microsoft.Security/assessments/cdc78c07-02b0-4af0-1cb2-cb7c672a8b0a\",\r\n \"name\": \"cdc78c07-02b0-4af0-1cb2-cb7c672a8b0a\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.storage/storageaccounts/takleidiag\"\r\n },\r\n \"displayName\": \"Storage account should use a private link connection\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0617368Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0617368Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/rc44m4u3jcfyesyslog/providers/Microsoft.Security/assessments/cdc78c07-02b0-4af0-1cb2-cb7c672a8b0a\",\r\n \"name\": \"cdc78c07-02b0-4af0-1cb2-cb7c672a8b0a\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/rc44m4u3jcfyesyslog\"\r\n },\r\n \"displayName\": \"Storage account should use a private link connection\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0617368Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0617368Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/new-api-rg/providers/microsoft.storage/storageaccounts/storageaccountnewap90e0/providers/Microsoft.Security/assessments/cdc78c07-02b0-4af0-1cb2-cb7c672a8b0a\",\r\n \"name\": \"cdc78c07-02b0-4af0-1cb2-cb7c672a8b0a\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/new-api-rg/providers/microsoft.storage/storageaccounts/storageaccountnewap90e0\"\r\n },\r\n \"displayName\": \"Storage account should use a private link connection\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0617368Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0617368Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/myservice1diag229/providers/Microsoft.Security/assessments/cdc78c07-02b0-4af0-1cb2-cb7c672a8b0a\",\r\n \"name\": \"cdc78c07-02b0-4af0-1cb2-cb7c672a8b0a\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/myservice1diag229\"\r\n },\r\n \"displayName\": \"Storage account should use a private link connection\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0617368Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0617368Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlvamhbxfrvxg27hk/providers/Microsoft.Security/assessments/cdc78c07-02b0-4af0-1cb2-cb7c672a8b0a\",\r\n \"name\": \"cdc78c07-02b0-4af0-1cb2-cb7c672a8b0a\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlvamhbxfrvxg27hk\"\r\n },\r\n \"displayName\": \"Storage account should use a private link connection\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0617368Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0617368Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlauditnorhckgibckar6zs/providers/Microsoft.Security/assessments/cdc78c07-02b0-4af0-1cb2-cb7c672a8b0a\",\r\n \"name\": \"cdc78c07-02b0-4af0-1cb2-cb7c672a8b0a\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlauditnorhckgibckar6zs\"\r\n },\r\n \"displayName\": \"Storage account should use a private link connection\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0617368Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0617368Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlauditcenkokky5rfpyhsm/providers/Microsoft.Security/assessments/cdc78c07-02b0-4af0-1cb2-cb7c672a8b0a\",\r\n \"name\": \"cdc78c07-02b0-4af0-1cb2-cb7c672a8b0a\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/sqlauditcenkokky5rfpyhsm\"\r\n },\r\n \"displayName\": \"Storage account should use a private link connection\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0617368Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0617368Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.storage/storageaccounts/storagefdi4i/providers/Microsoft.Security/assessments/cdc78c07-02b0-4af0-1cb2-cb7c672a8b0a\",\r\n \"name\": \"cdc78c07-02b0-4af0-1cb2-cb7c672a8b0a\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.storage/storageaccounts/storagefdi4i\"\r\n },\r\n \"displayName\": \"Storage account should use a private link connection\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0617368Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0617368Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/myservice1diag/providers/Microsoft.Security/assessments/cdc78c07-02b0-4af0-1cb2-cb7c672a8b0a\",\r\n \"name\": \"cdc78c07-02b0-4af0-1cb2-cb7c672a8b0a\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.storage/storageaccounts/myservice1diag\"\r\n },\r\n \"displayName\": \"Storage account should use a private link connection\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0617368Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0617368Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.storage/storageaccounts/stgvx6syhq6e4vr4/providers/Microsoft.Security/assessments/cdc78c07-02b0-4af0-1cb2-cb7c672a8b0a\",\r\n \"name\": \"cdc78c07-02b0-4af0-1cb2-cb7c672a8b0a\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/iotsimulator/providers/microsoft.storage/storageaccounts/stgvx6syhq6e4vr4\"\r\n },\r\n \"displayName\": \"Storage account should use a private link connection\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0617368Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0617368Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/clitest.rgux2hohzfm5ae5g3e2kmehihecmlqvykbbwsyvm42bkvazts5afq5z5yozj4nl5rkj/providers/microsoft.storage/storageaccounts/clitestiwr74bhqm6myki4hp/providers/Microsoft.Security/assessments/cdc78c07-02b0-4af0-1cb2-cb7c672a8b0a\",\r\n \"name\": \"cdc78c07-02b0-4af0-1cb2-cb7c672a8b0a\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/clitest.rgux2hohzfm5ae5g3e2kmehihecmlqvykbbwsyvm42bkvazts5afq5z5yozj4nl5rkj/providers/microsoft.storage/storageaccounts/clitestiwr74bhqm6myki4hp\"\r\n },\r\n \"displayName\": \"Storage account should use a private link connection\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0617368Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0617368Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-cus/providers/microsoft.storage/storageaccounts/samplestorageaccount2/providers/Microsoft.Security/assessments/cdc78c07-02b0-4af0-1cb2-cb7c672a8b0a\",\r\n \"name\": \"cdc78c07-02b0-4af0-1cb2-cb7c672a8b0a\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-cus/providers/microsoft.storage/storageaccounts/samplestorageaccount2\"\r\n },\r\n \"displayName\": \"Storage account should use a private link connection\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0617368Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0617368Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/clitest.rglcgsehtecwpwxccgtkja6224bw44vnfv2k467vcpemnzdcao6sps5zepofomkzwvi/providers/microsoft.storage/storageaccounts/clitestjnrp2z3af7yw7ebbd/providers/Microsoft.Security/assessments/cdc78c07-02b0-4af0-1cb2-cb7c672a8b0a\",\r\n \"name\": \"cdc78c07-02b0-4af0-1cb2-cb7c672a8b0a\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/clitest.rglcgsehtecwpwxccgtkja6224bw44vnfv2k467vcpemnzdcao6sps5zepofomkzwvi/providers/microsoft.storage/storageaccounts/clitestjnrp2z3af7yw7ebbd\"\r\n },\r\n \"displayName\": \"Storage account should use a private link connection\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-02-04T13:11:04.0617368Z\",\r\n \"firstEvaluationDate\": \"2022-02-04T13:11:04.0617368Z\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice1/providers/Microsoft.Security/assessments/0677209d-e675-2c6f-e91a-54cef2878663\",\r\n \"name\": \"0677209d-e675-2c6f-e91a-54cef2878663\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice1\"\r\n },\r\n \"displayName\": \"Container hosts should be configured securely\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NonDockerNonRelevantRecommendation\",\r\n \"description\": \"This recommendation is not relevant for resources that are not Docker containers.\",\r\n \"statusChangeDate\": \"2022-03-10T05:45:52.1981689Z\",\r\n \"firstEvaluationDate\": \"2022-03-10T05:45:52.1981689Z\"\r\n },\r\n \"additionalData\": {}\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/0677209d-e675-2c6f-e91a-54cef2878663\",\r\n \"name\": \"0677209d-e675-2c6f-e91a-54cef2878663\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Container hosts should be configured securely\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NonDockerNonRelevantRecommendation\",\r\n \"description\": \"This recommendation is not relevant for resources that are not Docker containers.\",\r\n \"statusChangeDate\": \"2022-03-10T05:45:52.1981689Z\",\r\n \"firstEvaluationDate\": \"2022-03-10T05:45:52.1981689Z\"\r\n },\r\n \"additionalData\": {}\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice/providers/Microsoft.Security/assessments/0677209d-e675-2c6f-e91a-54cef2878663\",\r\n \"name\": \"0677209d-e675-2c6f-e91a-54cef2878663\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/myservice1/providers/microsoft.compute/virtualmachines/testservice\"\r\n },\r\n \"displayName\": \"Container hosts should be configured securely\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NonDockerNonRelevantRecommendation\",\r\n \"description\": \"This recommendation is not relevant for resources that are not Docker containers.\",\r\n \"statusChangeDate\": \"2022-03-10T05:45:52.1981689Z\",\r\n \"firstEvaluationDate\": \"2022-03-10T05:45:52.1981689Z\"\r\n },\r\n \"additionalData\": {}\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.compute/virtualmachines/alertstest/providers/Microsoft.Security/assessments/0677209d-e675-2c6f-e91a-54cef2878663\",\r\n \"name\": \"0677209d-e675-2c6f-e91a-54cef2878663\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.compute/virtualmachines/alertstest\"\r\n },\r\n \"displayName\": \"Container hosts should be configured securely\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NonDockerNonRelevantRecommendation\",\r\n \"description\": \"This recommendation is not relevant for resources that are not Docker containers.\",\r\n \"statusChangeDate\": \"2022-03-10T05:45:52.1981689Z\",\r\n \"firstEvaluationDate\": \"2022-03-10T05:45:52.1981689Z\"\r\n },\r\n \"additionalData\": {}\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/d1db3318-01ff-16de-29eb-28b344515626\",\r\n \"name\": \"d1db3318-01ff-16de-29eb-28b344515626\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"Log Analytics agent should be installed on virtual machines\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-03-11T23:22:35.973436Z\",\r\n \"firstEvaluationDate\": \"2022-03-11T23:22:35.973436Z\"\r\n },\r\n \"additionalData\": {\r\n \"VM Agent installed\": \"Off\",\r\n \"Monitoring agent extension installed\": \"Off\",\r\n \"Monitoring agent installation status\": \"FailureDueToAgentNotResponding\",\r\n \"Automatic monitoring agent installation policy\": \"On\",\r\n \"OS Type\": \"Linux\",\r\n \"Reporting workspace customer id\": \"df35f3e2-89af-4e01-b1f7-4cda6645ed9d\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/mainws/providers/microsoft.operationalinsights/workspaces/securityuserws\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/d1db3318-01ff-16de-29eb-28b344515626\",\r\n \"name\": \"d1db3318-01ff-16de-29eb-28b344515626\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Log Analytics agent should be installed on virtual machines\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-03-11T23:22:35.973436Z\",\r\n \"firstEvaluationDate\": \"2022-03-11T23:22:35.973436Z\"\r\n },\r\n \"additionalData\": {\r\n \"VM Agent installed\": \"On\",\r\n \"Monitoring agent extension installed\": \"On\",\r\n \"Monitoring agent installation status\": \"Installed\",\r\n \"Automatic monitoring agent installation policy\": \"On\",\r\n \"OS Type\": \"Linux\",\r\n \"Reporting workspace customer id\": \"1e8531b4-8e83-489a-8dc1-0ba398fcc809\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-weu/providers/microsoft.operationalinsights/workspaces/defaultworkspace-487bb485-b5b0-471e-9c0d-10717612f869-weu\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/d1db3318-01ff-16de-29eb-28b344515626\",\r\n \"name\": \"d1db3318-01ff-16de-29eb-28b344515626\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"Log Analytics agent should be installed on virtual machines\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-03-11T23:22:35.973436Z\",\r\n \"firstEvaluationDate\": \"2022-03-11T23:22:35.973436Z\"\r\n },\r\n \"additionalData\": {\r\n \"VM Agent installed\": \"Off\",\r\n \"Monitoring agent extension installed\": \"Off\",\r\n \"Monitoring agent installation status\": \"FailureDueToAgentNotResponding\",\r\n \"Automatic monitoring agent installation policy\": \"On\",\r\n \"OS Type\": \"Windows\",\r\n \"Reporting workspace customer id\": \"1e8531b4-8e83-489a-8dc1-0ba398fcc809\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-weu/providers/microsoft.operationalinsights/workspaces/defaultworkspace-487bb485-b5b0-471e-9c0d-10717612f869-weu\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/d1db3318-01ff-16de-29eb-28b344515626\",\r\n \"name\": \"d1db3318-01ff-16de-29eb-28b344515626\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"Log Analytics agent should be installed on virtual machines\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-03-11T23:22:35.973436Z\",\r\n \"firstEvaluationDate\": \"2022-03-11T23:22:35.973436Z\"\r\n },\r\n \"additionalData\": {\r\n \"VM Agent installed\": \"On\",\r\n \"Monitoring agent extension installed\": \"On\",\r\n \"Monitoring agent installation status\": \"Installed\",\r\n \"Automatic monitoring agent installation policy\": \"On\",\r\n \"OS Type\": \"Windows\",\r\n \"Reporting workspace customer id\": \"df35f3e2-89af-4e01-b1f7-4cda6645ed9d\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/mainws/providers/microsoft.operationalinsights/workspaces/securityuserws\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/d57a4221-a804-52ca-3dea-768284f06bb7\",\r\n \"name\": \"d57a4221-a804-52ca-3dea-768284f06bb7\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-03-11T23:22:36.0975048Z\",\r\n \"firstEvaluationDate\": \"2022-03-11T23:22:36.0975048Z\"\r\n },\r\n \"additionalData\": {\r\n \"Is supported\": \"True\",\r\n \"OS disk encrypted\": \"False\",\r\n \"Data disk encrypted\": \"True\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/83f577bd-a1b6-b7e1-0891-12ca19d1e6df\",\r\n \"name\": \"83f577bd-a1b6-b7e1-0891-12ca19d1e6df\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"Install endpoint protection solution on virtual machines\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NA\",\r\n \"description\": \"NA\",\r\n \"statusChangeDate\": \"2022-03-11T23:22:36.0971807Z\",\r\n \"firstEvaluationDate\": \"2022-03-11T23:22:36.0971807Z\"\r\n },\r\n \"additionalData\": {\r\n \"OS Type\": \"Linux\",\r\n \"Reporting workspace customer id\": \"df35f3e2-89af-4e01-b1f7-4cda6645ed9d\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/mainws/providers/microsoft.operationalinsights/workspaces/securityuserws\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/d57a4221-a804-52ca-3dea-768284f06bb7\",\r\n \"name\": \"d57a4221-a804-52ca-3dea-768284f06bb7\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NA\",\r\n \"description\": \"NA\",\r\n \"statusChangeDate\": \"2022-03-11T23:22:36.0975048Z\",\r\n \"firstEvaluationDate\": \"2022-03-11T23:22:36.0975048Z\"\r\n },\r\n \"additionalData\": {\r\n \"Is supported\": \"False\",\r\n \"OS disk encrypted\": \"False\",\r\n \"Data disk encrypted\": \"False\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/83f577bd-a1b6-b7e1-0891-12ca19d1e6df\",\r\n \"name\": \"83f577bd-a1b6-b7e1-0891-12ca19d1e6df\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Install endpoint protection solution on virtual machines\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NA\",\r\n \"description\": \"NA\",\r\n \"statusChangeDate\": \"2022-03-11T23:22:36.0971807Z\",\r\n \"firstEvaluationDate\": \"2022-03-11T23:22:36.0971807Z\"\r\n },\r\n \"additionalData\": {\r\n \"OS Type\": \"Linux\",\r\n \"Reporting workspace customer id\": \"1e8531b4-8e83-489a-8dc1-0ba398fcc809\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-weu/providers/microsoft.operationalinsights/workspaces/defaultworkspace-487bb485-b5b0-471e-9c0d-10717612f869-weu\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/d57a4221-a804-52ca-3dea-768284f06bb7\",\r\n \"name\": \"d57a4221-a804-52ca-3dea-768284f06bb7\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-03-11T23:22:36.0975048Z\",\r\n \"firstEvaluationDate\": \"2022-03-11T23:22:36.0975048Z\"\r\n },\r\n \"additionalData\": {\r\n \"Is supported\": \"True\",\r\n \"OS disk encrypted\": \"False\",\r\n \"Data disk encrypted\": \"True\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/83f577bd-a1b6-b7e1-0891-12ca19d1e6df\",\r\n \"name\": \"83f577bd-a1b6-b7e1-0891-12ca19d1e6df\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"Install endpoint protection solution on virtual machines\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-03-11T23:22:36.0971807Z\",\r\n \"firstEvaluationDate\": \"2022-03-11T23:22:36.0971807Z\"\r\n },\r\n \"additionalData\": {\r\n \"OS Type\": \"Windows\",\r\n \"Reporting workspace customer id\": \"1e8531b4-8e83-489a-8dc1-0ba398fcc809\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-weu/providers/microsoft.operationalinsights/workspaces/defaultworkspace-487bb485-b5b0-471e-9c0d-10717612f869-weu\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/83f577bd-a1b6-b7e1-0891-12ca19d1e6df\",\r\n \"name\": \"83f577bd-a1b6-b7e1-0891-12ca19d1e6df\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"Install endpoint protection solution on virtual machines\",\r\n \"status\": {\r\n \"code\": \"Healthy\",\r\n \"statusChangeDate\": \"2022-03-11T23:22:36.0971807Z\",\r\n \"firstEvaluationDate\": \"2022-03-11T23:22:36.0971807Z\"\r\n },\r\n \"additionalData\": {\r\n \"OS Type\": \"Windows\",\r\n \"Antimalware type\": \"Windows Defender\",\r\n \"Reporting workspace customer id\": \"df35f3e2-89af-4e01-b1f7-4cda6645ed9d\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/mainws/providers/microsoft.operationalinsights/workspaces/securityuserws\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/d57a4221-a804-52ca-3dea-768284f06bb7\",\r\n \"name\": \"d57a4221-a804-52ca-3dea-768284f06bb7\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-03-11T23:22:36.0975048Z\",\r\n \"firstEvaluationDate\": \"2022-03-11T23:22:36.0975048Z\"\r\n },\r\n \"additionalData\": {\r\n \"Is supported\": \"True\",\r\n \"OS disk encrypted\": \"False\",\r\n \"Data disk encrypted\": \"True\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/3bcd234d-c9c7-c2a2-89e0-c01f419c1a8a\",\r\n \"name\": \"3bcd234d-c9c7-c2a2-89e0-c01f419c1a8a\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"Endpoint protection health issues on machines should be resolved\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NA\",\r\n \"description\": \"NA\",\r\n \"statusChangeDate\": \"2022-03-11T23:22:36.0991887Z\",\r\n \"firstEvaluationDate\": \"2022-03-11T23:22:36.0991887Z\"\r\n },\r\n \"additionalData\": {\r\n \"Last scan time\": \"0001-01-01T00:00:00Z\",\r\n \"Scan data is valid\": \"False\",\r\n \"Scan data exists\": \"False\",\r\n \"PolicyState\": \"On\",\r\n \"OS Type\": \"Linux\",\r\n \"Reporting workspace customer id\": \"df35f3e2-89af-4e01-b1f7-4cda6645ed9d\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/mainws/providers/microsoft.operationalinsights/workspaces/securityuserws\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1/providers/Microsoft.Security/assessments/181ac480-f7c4-544b-9865-11b8ffe87f47\",\r\n \"name\": \"181ac480-f7c4-544b-9865-11b8ffe87f47\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService1\"\r\n },\r\n \"displayName\": \"Machines should be configured securely\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NA\",\r\n \"description\": \"NA\",\r\n \"statusChangeDate\": \"2022-03-11T23:22:36.100048Z\",\r\n \"firstEvaluationDate\": \"2022-03-11T23:22:36.100048Z\"\r\n },\r\n \"additionalData\": {\r\n \"Last scan time\": \"0001-01-01T00:00:00Z\",\r\n \"Scan data is valid\": \"False\",\r\n \"Scan data exists\": \"False\",\r\n \"PolicyState\": \"On\",\r\n \"OS Type\": \"Linux\",\r\n \"Reporting workspace customer id\": \"df35f3e2-89af-4e01-b1f7-4cda6645ed9d\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/mainws/providers/microsoft.operationalinsights/workspaces/securityuserws\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/181ac480-f7c4-544b-9865-11b8ffe87f47\",\r\n \"name\": \"181ac480-f7c4-544b-9865-11b8ffe87f47\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Machines should be configured securely\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-03-11T23:22:36.100048Z\",\r\n \"firstEvaluationDate\": \"2022-03-11T23:22:36.100048Z\"\r\n },\r\n \"additionalData\": {\r\n \"Last scan time\": \"2022-03-22T23:17:39.083Z\",\r\n \"Scan data is valid\": \"True\",\r\n \"Scan data exists\": \"True\",\r\n \"PolicyState\": \"On\",\r\n \"OS Type\": \"Linux\",\r\n \"Reporting workspace customer id\": \"1e8531b4-8e83-489a-8dc1-0ba398fcc809\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-weu/providers/microsoft.operationalinsights/workspaces/defaultworkspace-487bb485-b5b0-471e-9c0d-10717612f869-weu\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/181ac480-f7c4-544b-9865-11b8ffe87f47\",\r\n \"name\": \"181ac480-f7c4-544b-9865-11b8ffe87f47\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"Machines should be configured securely\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NA\",\r\n \"description\": \"NA\",\r\n \"statusChangeDate\": \"2022-03-11T23:22:36.100048Z\",\r\n \"firstEvaluationDate\": \"2022-03-11T23:22:36.100048Z\"\r\n },\r\n \"additionalData\": {\r\n \"Last scan time\": \"0001-01-01T00:00:00Z\",\r\n \"Scan data is valid\": \"False\",\r\n \"Scan data exists\": \"False\",\r\n \"PolicyState\": \"On\",\r\n \"OS Type\": \"Windows\",\r\n \"Reporting workspace customer id\": \"1e8531b4-8e83-489a-8dc1-0ba398fcc809\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-weu/providers/microsoft.operationalinsights/workspaces/defaultworkspace-487bb485-b5b0-471e-9c0d-10717612f869-weu\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm/providers/Microsoft.Security/assessments/3bcd234d-c9c7-c2a2-89e0-c01f419c1a8a\",\r\n \"name\": \"3bcd234d-c9c7-c2a2-89e0-c01f419c1a8a\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/syslogmyservice1vm\"\r\n },\r\n \"displayName\": \"Endpoint protection health issues on machines should be resolved\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NA\",\r\n \"description\": \"NA\",\r\n \"statusChangeDate\": \"2022-03-11T23:22:36.0991887Z\",\r\n \"firstEvaluationDate\": \"2022-03-11T23:22:36.0991887Z\"\r\n },\r\n \"additionalData\": {\r\n \"Last scan time\": \"0001-01-01T00:00:00Z\",\r\n \"Scan data is valid\": \"False\",\r\n \"Scan data exists\": \"False\",\r\n \"PolicyState\": \"On\",\r\n \"OS Type\": \"Linux\",\r\n \"Reporting workspace customer id\": \"1e8531b4-8e83-489a-8dc1-0ba398fcc809\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-weu/providers/microsoft.operationalinsights/workspaces/defaultworkspace-487bb485-b5b0-471e-9c0d-10717612f869-weu\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/181ac480-f7c4-544b-9865-11b8ffe87f47\",\r\n \"name\": \"181ac480-f7c4-544b-9865-11b8ffe87f47\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"Machines should be configured securely\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NA\",\r\n \"description\": \"NA\",\r\n \"statusChangeDate\": \"2022-03-11T23:22:36.100048Z\",\r\n \"firstEvaluationDate\": \"2022-03-11T23:22:36.100048Z\"\r\n },\r\n \"additionalData\": {\r\n \"Last scan time\": \"0001-01-01T00:00:00Z\",\r\n \"Scan data is valid\": \"True\",\r\n \"Scan data exists\": \"False\",\r\n \"PolicyState\": \"On\",\r\n \"OS Type\": \"Windows\",\r\n \"Reporting workspace customer id\": \"df35f3e2-89af-4e01-b1f7-4cda6645ed9d\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/mainws/providers/microsoft.operationalinsights/workspaces/securityuserws\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService/providers/Microsoft.Security/assessments/3bcd234d-c9c7-c2a2-89e0-c01f419c1a8a\",\r\n \"name\": \"3bcd234d-c9c7-c2a2-89e0-c01f419c1a8a\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/MYSERVICE1/providers/Microsoft.Compute/virtualMachines/testService\"\r\n },\r\n \"displayName\": \"Endpoint protection health issues on machines should be resolved\",\r\n \"status\": {\r\n \"code\": \"NotApplicable\",\r\n \"cause\": \"NA\",\r\n \"description\": \"NA\",\r\n \"statusChangeDate\": \"2022-03-11T23:22:36.0991887Z\",\r\n \"firstEvaluationDate\": \"2022-03-11T23:22:36.0991887Z\"\r\n },\r\n \"additionalData\": {\r\n \"Last scan time\": \"0001-01-01T00:00:00Z\",\r\n \"Scan data is valid\": \"False\",\r\n \"Scan data exists\": \"False\",\r\n \"PolicyState\": \"On\",\r\n \"OS Type\": \"Windows\",\r\n \"Reporting workspace customer id\": \"1e8531b4-8e83-489a-8dc1-0ba398fcc809\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/defaultresourcegroup-weu/providers/microsoft.operationalinsights/workspaces/defaultworkspace-487bb485-b5b0-471e-9c0d-10717612f869-weu\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest/providers/Microsoft.Security/assessments/3bcd234d-c9c7-c2a2-89e0-c01f419c1a8a\",\r\n \"name\": \"3bcd234d-c9c7-c2a2-89e0-c01f419c1a8a\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/TAKLEI/providers/Microsoft.Compute/virtualMachines/alertsTest\"\r\n },\r\n \"displayName\": \"Endpoint protection health issues on machines should be resolved\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-03-11T23:22:36.0991887Z\",\r\n \"firstEvaluationDate\": \"2022-03-11T23:22:36.0991887Z\"\r\n },\r\n \"additionalData\": {\r\n \"Last scan time\": \"2022-03-23T11:53:06.387Z\",\r\n \"Scan data is valid\": \"True\",\r\n \"Scan data exists\": \"True\",\r\n \"PolicyState\": \"On\",\r\n \"OS Type\": \"Windows\",\r\n \"Antimalware type\": \"Windows Defender\",\r\n \"Reporting workspace customer id\": \"df35f3e2-89af-4e01-b1f7-4cda6645ed9d\",\r\n \"Reporting workspace azure id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/mainws/providers/microsoft.operationalinsights/workspaces/securityuserws\"\r\n }\r\n }\r\n },\r\n {\r\n \"type\": \"Microsoft.Security/assessments\",\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.keyvault/vaults/alerts/providers/Microsoft.Security/assessments/14257785-9437-97fa-11ae-898cfb24302b\",\r\n \"name\": \"14257785-9437-97fa-11ae-898cfb24302b\",\r\n \"properties\": {\r\n \"resourceDetails\": {\r\n \"Source\": \"Azure\",\r\n \"Id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourcegroups/taklei/providers/microsoft.keyvault/vaults/alerts\"\r\n },\r\n \"displayName\": \"Key Vault secrets should have an expiration date\",\r\n \"status\": {\r\n \"code\": \"Unhealthy\",\r\n \"statusChangeDate\": \"2022-03-21T17:58:55.3507058Z\",\r\n \"firstEvaluationDate\": \"2022-03-21T17:58:55.3507058Z\"\r\n }\r\n }\r\n }\r\n ],\r\n \"nextLink\": \"https://management.azure.com/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/assessments?api-version=2021-06-01&NextLink=_dynamic\"\r\n}", "StatusCode": 200 } ], diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/PricingsTests/Pricings_GetSubscriptionPricing.json b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/PricingsTests/Pricings_GetSubscriptionPricing.json index 1d380778f387..0e286c643756 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/PricingsTests/Pricings_GetSubscriptionPricing.json +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/PricingsTests/Pricings_GetSubscriptionPricing.json @@ -1,57 +1,60 @@ { "Entries": [ { - "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/pricings/VirtualMachines?api-version=2018-06-01", - "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvcHJpY2luZ3MvVmlydHVhbE1hY2hpbmVzP2FwaS12ZXJzaW9uPTIwMTgtMDYtMDE=", + "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/pricings/VirtualMachines?api-version=2022-03-01", + "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvcHJpY2luZ3MvVmlydHVhbE1hY2hpbmVzP2FwaS12ZXJzaW9uPTIwMjItMDMtMDE=", "RequestMethod": "GET", "RequestBody": "", "RequestHeaders": { "x-ms-client-request-id": [ - "fa1346d9-80cd-45d4-bba7-f612afd58ca7" + "90b198d3-f9e0-4bdc-bedc-d028e87e77cf" ], - "accept-language": [ + "Accept-Language": [ "en-US" ], "User-Agent": [ - "FxVersion/4.6.26614.01", + "FxVersion/4.700.22.11601", "OSName/Windows", - "OSVersion/Microsoft.Windows.10.0.17763.", - "Microsoft.Azure.Management.Security.SecurityCenterClient/0.11.0.0" + "OSVersion/Microsoft.Windows.10.0.22000", + "Microsoft.Azure.Management.Security.SecurityCenterClient/3.0.0.0" ] }, "ResponseHeaders": { "Cache-Control": [ "no-cache" ], - "Date": [ - "Mon, 04 Mar 2019 16:03:05 GMT" - ], "Pragma": [ "no-cache" ], - "Server": [ - "Microsoft-HTTPAPI/2.0" + "x-ms-ratelimit-remaining-subscription-resource-requests": [ + "749" + ], + "Strict-Transport-Security": [ + "max-age=31536000; includeSubDomains" + ], + "api-supported-versions": [ + "1.0" ], "x-ms-request-id": [ - "0eeb012f-1b23-434e-92c8-21837eb6c37d" + "2fe861e0-09b6-41a7-874e-e7153198ce4c" ], - "x-ms-ratelimit-remaining-subscription-resource-requests": [ - "749" + "Server": [ + "Kestrel" ], "x-ms-correlation-request-id": [ - "1944858a-a83f-496e-9ca9-bfd975543fb7" + "9c62938b-d6ee-45c3-9baf-f58b19e3d9ee" ], "x-ms-routing-request-id": [ - "UKWEST:20190304T160306Z:1944858a-a83f-496e-9ca9-bfd975543fb7" - ], - "Strict-Transport-Security": [ - "max-age=31536000; includeSubDomains" + "FRANCESOUTH:20220323T162204Z:9c62938b-d6ee-45c3-9baf-f58b19e3d9ee" ], "X-Content-Type-Options": [ "nosniff" ], + "Date": [ + "Wed, 23 Mar 2022 16:22:04 GMT" + ], "Content-Length": [ - "248" + "263" ], "Content-Type": [ "application/json; charset=utf-8" @@ -60,12 +63,10 @@ "-1" ] }, - "ResponseBody": "{\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/pricings/VirtualMachines\",\r\n \"name\": \"VirtualMachines\",\r\n \"type\": \"Microsoft.Security/pricings\",\r\n \"properties\": {\r\n \"pricingTier\": \"Standard\",\r\n \"freeTrialRemainingTime\": \"PT0S\"\r\n }\r\n}", + "ResponseBody": "{\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/pricings/VirtualMachines\",\r\n \"name\": \"VirtualMachines\",\r\n \"type\": \"Microsoft.Security/pricings\",\r\n \"properties\": {\r\n \"subPlan\": \"P2\",\r\n \"pricingTier\": \"Standard\",\r\n \"freeTrialRemainingTime\": \"PT0S\"\r\n }\r\n}", "StatusCode": 200 } ], "Names": {}, - "Variables": { - "SubscriptionId": "487bb485-b5b0-471e-9c0d-10717612f869" - } + "Variables": {} } \ No newline at end of file diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/PricingsTests/Pricings_List.json b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/PricingsTests/Pricings_List.json index c1af463a86b7..b8fdc3183a2c 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/PricingsTests/Pricings_List.json +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/PricingsTests/Pricings_List.json @@ -1,57 +1,60 @@ { "Entries": [ { - "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/pricings?api-version=2018-06-01", - "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvcHJpY2luZ3M/YXBpLXZlcnNpb249MjAxOC0wNi0wMQ==", + "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/pricings?api-version=2022-03-01", + "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvcHJpY2luZ3M/YXBpLXZlcnNpb249MjAyMi0wMy0wMQ==", "RequestMethod": "GET", "RequestBody": "", "RequestHeaders": { "x-ms-client-request-id": [ - "069a50af-a0d7-4277-9846-ae0aa0ac032a" + "01691934-153b-41a2-9818-f7b1bb989aea" ], - "accept-language": [ + "Accept-Language": [ "en-US" ], "User-Agent": [ - "FxVersion/4.6.26614.01", + "FxVersion/4.700.22.11601", "OSName/Windows", - "OSVersion/Microsoft.Windows.10.0.17763.", - "Microsoft.Azure.Management.Security.SecurityCenterClient/0.11.0.0" + "OSVersion/Microsoft.Windows.10.0.22000", + "Microsoft.Azure.Management.Security.SecurityCenterClient/3.0.0.0" ] }, "ResponseHeaders": { "Cache-Control": [ "no-cache" ], - "Date": [ - "Mon, 04 Mar 2019 16:03:06 GMT" - ], "Pragma": [ "no-cache" ], - "Server": [ - "Microsoft-HTTPAPI/2.0" + "x-ms-ratelimit-remaining-subscription-resource-requests": [ + "749" + ], + "Strict-Transport-Security": [ + "max-age=31536000; includeSubDomains" + ], + "api-supported-versions": [ + "1.0" ], "x-ms-request-id": [ - "235b8b7c-279a-4910-8f7b-78bfd0da9571" + "df59178d-06ea-4d38-8463-b49b4e304920" ], - "x-ms-ratelimit-remaining-subscription-resource-requests": [ - "749" + "Server": [ + "Kestrel" ], "x-ms-correlation-request-id": [ - "f05c4f31-9f59-4f8c-b547-7bdab1f09bc4" + "7ca4fee5-abc4-42ed-82f2-2b9747f51e0f" ], "x-ms-routing-request-id": [ - "UKWEST:20190304T160306Z:f05c4f31-9f59-4f8c-b547-7bdab1f09bc4" - ], - "Strict-Transport-Security": [ - "max-age=31536000; includeSubDomains" + "FRANCESOUTH:20220323T162205Z:7ca4fee5-abc4-42ed-82f2-2b9747f51e0f" ], "X-Content-Type-Options": [ "nosniff" ], + "Date": [ + "Wed, 23 Mar 2022 16:22:04 GMT" + ], "Content-Length": [ - "736" + "3297" ], "Content-Type": [ "application/json; charset=utf-8" @@ -60,12 +63,10 @@ "-1" ] }, - "ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/pricings/VirtualMachines\",\r\n \"name\": \"VirtualMachines\",\r\n \"type\": \"Microsoft.Security/pricings\",\r\n \"properties\": {\r\n \"pricingTier\": \"Standard\",\r\n \"freeTrialRemainingTime\": \"PT0S\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/pricings/SqlServers\",\r\n \"name\": \"SqlServers\",\r\n \"type\": \"Microsoft.Security/pricings\",\r\n \"properties\": {\r\n \"pricingTier\": \"Free\",\r\n \"freeTrialRemainingTime\": \"PT0S\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/pricings/AppServices\",\r\n \"name\": \"AppServices\",\r\n \"type\": \"Microsoft.Security/pricings\",\r\n \"properties\": {\r\n \"pricingTier\": \"Standard\",\r\n \"freeTrialRemainingTime\": \"PT0S\"\r\n }\r\n }\r\n ]\r\n}", + "ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/pricings/VirtualMachines\",\r\n \"name\": \"VirtualMachines\",\r\n \"type\": \"Microsoft.Security/pricings\",\r\n \"properties\": {\r\n \"subPlan\": \"P2\",\r\n \"pricingTier\": \"Standard\",\r\n \"freeTrialRemainingTime\": \"PT0S\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/pricings/SqlServers\",\r\n \"name\": \"SqlServers\",\r\n \"type\": \"Microsoft.Security/pricings\",\r\n \"properties\": {\r\n \"pricingTier\": \"Standard\",\r\n \"freeTrialRemainingTime\": \"PT0S\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/pricings/AppServices\",\r\n \"name\": \"AppServices\",\r\n \"type\": \"Microsoft.Security/pricings\",\r\n \"properties\": {\r\n \"pricingTier\": \"Standard\",\r\n \"freeTrialRemainingTime\": \"PT0S\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/pricings/StorageAccounts\",\r\n \"name\": \"StorageAccounts\",\r\n \"type\": \"Microsoft.Security/pricings\",\r\n \"properties\": {\r\n \"pricingTier\": \"Standard\",\r\n \"freeTrialRemainingTime\": \"PT0S\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/pricings/SqlServerVirtualMachines\",\r\n \"name\": \"SqlServerVirtualMachines\",\r\n \"type\": \"Microsoft.Security/pricings\",\r\n \"properties\": {\r\n \"pricingTier\": \"Standard\",\r\n \"freeTrialRemainingTime\": \"PT0S\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/pricings/KubernetesService\",\r\n \"name\": \"KubernetesService\",\r\n \"type\": \"Microsoft.Security/pricings\",\r\n \"properties\": {\r\n \"pricingTier\": \"Free\",\r\n \"freeTrialRemainingTime\": \"PT0S\",\r\n \"deprecated\": true,\r\n \"replacedBy\": [\r\n \"Containers\"\r\n ]\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/pricings/ContainerRegistry\",\r\n \"name\": \"ContainerRegistry\",\r\n \"type\": \"Microsoft.Security/pricings\",\r\n \"properties\": {\r\n \"pricingTier\": \"Free\",\r\n \"freeTrialRemainingTime\": \"PT0S\",\r\n \"deprecated\": true,\r\n \"replacedBy\": [\r\n \"Containers\"\r\n ]\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/pricings/KeyVaults\",\r\n \"name\": \"KeyVaults\",\r\n \"type\": \"Microsoft.Security/pricings\",\r\n \"properties\": {\r\n \"pricingTier\": \"Standard\",\r\n \"freeTrialRemainingTime\": \"PT0S\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/pricings/Dns\",\r\n \"name\": \"Dns\",\r\n \"type\": \"Microsoft.Security/pricings\",\r\n \"properties\": {\r\n \"pricingTier\": \"Standard\",\r\n \"freeTrialRemainingTime\": \"PT0S\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/pricings/Arm\",\r\n \"name\": \"Arm\",\r\n \"type\": \"Microsoft.Security/pricings\",\r\n \"properties\": {\r\n \"pricingTier\": \"Standard\",\r\n \"freeTrialRemainingTime\": \"PT0S\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/pricings/OpenSourceRelationalDatabases\",\r\n \"name\": \"OpenSourceRelationalDatabases\",\r\n \"type\": \"Microsoft.Security/pricings\",\r\n \"properties\": {\r\n \"pricingTier\": \"Standard\",\r\n \"freeTrialRemainingTime\": \"PT0S\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/pricings/CosmosDbs\",\r\n \"name\": \"CosmosDbs\",\r\n \"type\": \"Microsoft.Security/pricings\",\r\n \"properties\": {\r\n \"pricingTier\": \"Free\",\r\n \"freeTrialRemainingTime\": \"PT0S\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/pricings/Containers\",\r\n \"name\": \"Containers\",\r\n \"type\": \"Microsoft.Security/pricings\",\r\n \"properties\": {\r\n \"pricingTier\": \"Standard\",\r\n \"freeTrialRemainingTime\": \"PT0S\"\r\n }\r\n }\r\n ]\r\n}", "StatusCode": 200 } ], "Names": {}, - "Variables": { - "SubscriptionId": "487bb485-b5b0-471e-9c0d-10717612f869" - } + "Variables": {} } \ No newline at end of file diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/PricingsTests/Pricings_UpdateSubscriptionPricing.json b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/PricingsTests/Pricings_UpdateSubscriptionPricing.json index f29b113c4fcb..e9d8eb8a5c75 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/PricingsTests/Pricings_UpdateSubscriptionPricing.json +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/PricingsTests/Pricings_UpdateSubscriptionPricing.json @@ -1,22 +1,22 @@ { "Entries": [ { - "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/pricings/VirtualMachines?api-version=2018-06-01", - "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvcHJpY2luZ3MvVmlydHVhbE1hY2hpbmVzP2FwaS12ZXJzaW9uPTIwMTgtMDYtMDE=", + "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/pricings/VirtualMachines?api-version=2022-03-01", + "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvcHJpY2luZ3MvVmlydHVhbE1hY2hpbmVzP2FwaS12ZXJzaW9uPTIwMjItMDMtMDE=", "RequestMethod": "PUT", "RequestBody": "{\r\n \"properties\": {\r\n \"pricingTier\": \"Standard\"\r\n }\r\n}", "RequestHeaders": { "x-ms-client-request-id": [ - "8710e1be-fc7c-4055-ab97-01f5914b83c3" + "57d5a20a-acb3-4161-a9d7-7ba50fb01194" ], - "accept-language": [ + "Accept-Language": [ "en-US" ], "User-Agent": [ - "FxVersion/4.6.26614.01", + "FxVersion/4.700.22.11601", "OSName/Windows", - "OSVersion/Microsoft.Windows.10.0.17763.", - "Microsoft.Azure.Management.Security.SecurityCenterClient/0.11.0.0" + "OSVersion/Microsoft.Windows.10.0.22000", + "Microsoft.Azure.Management.Security.SecurityCenterClient/3.0.0.0" ], "Content-Type": [ "application/json; charset=utf-8" @@ -29,35 +29,38 @@ "Cache-Control": [ "no-cache" ], - "Date": [ - "Mon, 04 Mar 2019 16:03:04 GMT" - ], "Pragma": [ "no-cache" ], - "Server": [ - "Microsoft-HTTPAPI/2.0" + "x-ms-ratelimit-remaining-subscription-resource-requests": [ + "249" + ], + "Strict-Transport-Security": [ + "max-age=31536000; includeSubDomains" + ], + "api-supported-versions": [ + "1.0" ], "x-ms-request-id": [ - "2f81d8a9-a1dc-4b9b-8f6d-0d07ea3e0254" + "6b8731ac-5a7d-4a45-8c62-c0c3dca33940" ], - "x-ms-ratelimit-remaining-subscription-resource-requests": [ - "249" + "Server": [ + "Kestrel" ], "x-ms-correlation-request-id": [ - "eb1fb4ad-3d84-4c13-8223-52ec64954935" + "733eb631-df5e-4c88-9fcd-63f5bfb8a34c" ], "x-ms-routing-request-id": [ - "UKWEST:20190304T160305Z:eb1fb4ad-3d84-4c13-8223-52ec64954935" - ], - "Strict-Transport-Security": [ - "max-age=31536000; includeSubDomains" + "FRANCESOUTH:20220323T162203Z:733eb631-df5e-4c88-9fcd-63f5bfb8a34c" ], "X-Content-Type-Options": [ "nosniff" ], + "Date": [ + "Wed, 23 Mar 2022 16:22:03 GMT" + ], "Content-Length": [ - "248" + "263" ], "Content-Type": [ "application/json; charset=utf-8" @@ -66,7 +69,7 @@ "-1" ] }, - "ResponseBody": "{\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/pricings/VirtualMachines\",\r\n \"name\": \"VirtualMachines\",\r\n \"type\": \"Microsoft.Security/pricings\",\r\n \"properties\": {\r\n \"pricingTier\": \"Standard\",\r\n \"freeTrialRemainingTime\": \"PT0S\"\r\n }\r\n}", + "ResponseBody": "{\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/pricings/VirtualMachines\",\r\n \"name\": \"VirtualMachines\",\r\n \"type\": \"Microsoft.Security/pricings\",\r\n \"properties\": {\r\n \"subPlan\": \"P2\",\r\n \"pricingTier\": \"Standard\",\r\n \"freeTrialRemainingTime\": \"PT0S\"\r\n }\r\n}", "StatusCode": 200 } ], diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_GetResourceGroupLevelAlerts.json b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_GetResourceGroupLevelAlerts.json index c2a134de0feb..6d3f3982c157 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_GetResourceGroupLevelAlerts.json +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_GetResourceGroupLevelAlerts.json @@ -1,22 +1,22 @@ { "Entries": [ { - "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/alerts?api-version=2021-01-01", - "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvYWxlcnRzP2FwaS12ZXJzaW9uPTIwMjEtMDEtMDE=", + "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/alerts?api-version=2021-11-01", + "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvYWxlcnRzP2FwaS12ZXJzaW9uPTIwMjEtMTEtMDE=", "RequestMethod": "GET", "RequestBody": "", "RequestHeaders": { "x-ms-client-request-id": [ - "6c8f4700-fd09-426b-a034-6cc2c3c3ee2b" + "56d63570-d3e6-4ac1-9efb-4e5a25f21e02" ], "Accept-Language": [ "en-US" ], "User-Agent": [ - "FxVersion/4.6.30015.01", + "FxVersion/4.700.22.11601", "OSName/Windows", - "OSVersion/Microsoft.Windows.10.0.14393.", - "Microsoft.Azure.Management.Security.SecurityCenterClient/2.2.0.0" + "OSVersion/Microsoft.Windows.10.0.22000", + "Microsoft.Azure.Management.Security.SecurityCenterClient/3.0.0.0" ] }, "ResponseHeaders": { @@ -31,16 +31,16 @@ "" ], "x-ms-ratelimit-remaining-subscription-resource-requests": [ - "749" + "748" ], "x-ms-request-id": [ - "504a6539-6f9e-4e8b-b9b9-8eaaa2daba77" + "233c5f05-3abf-4707-9f5f-17c702c3956e" ], "x-ms-correlation-request-id": [ - "504a6539-6f9e-4e8b-b9b9-8eaaa2daba77" + "233c5f05-3abf-4707-9f5f-17c702c3956e" ], "x-ms-routing-request-id": [ - "UAECENTRAL:20210805T103508Z:504a6539-6f9e-4e8b-b9b9-8eaaa2daba77" + "FRANCESOUTH:20220322T170023Z:233c5f05-3abf-4707-9f5f-17c702c3956e" ], "Strict-Transport-Security": [ "max-age=31536000; includeSubDomains" @@ -49,7 +49,7 @@ "nosniff" ], "Date": [ - "Thu, 05 Aug 2021 10:35:08 GMT" + "Tue, 22 Mar 2022 17:00:23 GMT" ], "Content-Type": [ "application/json; charset=utf-8" @@ -58,29 +58,29 @@ "-1" ], "Content-Length": [ - "4539" + "59382" ] }, - "ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Security/locations/centralus/alerts/2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"name\": \"2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2021-06-12T19:40:33.8308539Z\",\r\n \"processingEndTimeUtc\": \"2021-06-12T19:40:32.548439Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Azure Security Center\",\r\n \"productComponentName\": \"Storage Accounts\",\r\n \"alertType\": \"Storage.Blob_AnonymousScan.Containers\",\r\n \"startTimeUtc\": \"2021-06-12T18:11:54.456Z\",\r\n \"endTimeUtc\": \"2021-06-12T18:11:54.456Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"correlationKey\": \"eQXuNbERVh6e/t+5e+8g+5PLuHGkeLWBAAjR80eo/KQ=\",\r\n \"intent\": \"Collection\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_1\",\r\n \"azureResourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Storage/storageAccounts/storagefdi4i\",\r\n \"type\": \"AzureResource\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"storagefdi4i\",\r\n \"alertDisplayName\": \"PREVIEW - Anonymous scan of public storage containers\",\r\n \"description\": \"There were 94 failed attempts to anonymously identify publicly accessible containers in your storage account `storagefdi4i`. This might indicate a reconnaissance attack, where the attacker scans your storage account to identify publicly accessible containers and then tries to find sensitive data inside them. In many cases, attackers might successfully access data after a series of failed attempts. It’s therefore important to act on this alert.\",\r\n \"remediationSteps\": [\r\n \"• If public access is not needed for the Azure Storage containers, consider disallowing it on the entire storage account or limiting it selectively on specific containers or blobs (https://docs.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-prevent).\",\r\n \"• We recommend that you always follow the least privilege principle: https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-privileged-access#pa-7-follow-just-enough-administration-least-privilege-principle.\",\r\n \"• To prevent breaches of sensitive data, please review your Azure Storage containers and make sure no sensitive data is stored in them.\",\r\n \"• Consider using identity-based authentication: https://docs.microsoft.com/en-us/azure/storage/files/storage-files-active-directory-overview.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"alert Id\": \"c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"azure AD user\": \"N/A (Azure AD authentication was not used)\",\r\n \"user agent\": \"Go-http-client/1.1\",\r\n \"api type\": \"Blob\",\r\n \"client location\": \"N/A\",\r\n \"number of failed access attempts\": \"94\",\r\n \"among the enumeration terms used\": \"app, bin, blog, deploy, confidential, crm, builds, doc, customers, images, attachments, intranet, backups, customer, exports, img, data, blob, downloads, build, azure, export, files, bucket, database, dev, admin, emails, dist, development, documents, debug, assets, cdn, devops, download, backup, code, erp, logs, cache, iso, creds, bak, credentials, config, file, administrator, attachment, exe\",\r\n \"number of containers successfully accessed\": \"0\",\r\n \"list of containers successfully accessed\": \"\",\r\n \"authentication type\": \"Anonymous\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"operations types\": \"GetContainerProperties\",\r\n \"service type\": \"Azure Blobs\",\r\n \"potential causes\": \"\",\r\n \"resourceType\": \"Storage\",\r\n \"killChainIntent\": \"Collection\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_2\",\r\n \"resourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Storage/storageAccounts/storagefdi4i\",\r\n \"type\": \"azure-resource\"\r\n },\r\n {\r\n \"$id\": \"centralus_3\",\r\n \"address\": \"78.46.106.254\",\r\n \"location\": {\r\n \"countryCode\": \"DE\",\r\n \"countryName\": \"Germany\",\r\n \"state\": \"Bayern\",\r\n \"city\": \"Nuernberg\",\r\n \"longitude\": 11.0768,\r\n \"latitude\": 49.452,\r\n \"asn\": 24940\r\n },\r\n \"type\": \"ip\"\r\n },\r\n {\r\n \"$id\": \"centralus_4\",\r\n \"sourceAddress\": {\r\n \"$ref\": \"centralus_3\"\r\n },\r\n \"protocol\": \"Tcp\",\r\n \"type\": \"network-connection\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security/AlertBlade/alertId/2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/iotsimulator/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n }\r\n ]\r\n}", + "ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324097376141_bc8c9a6a-98d5-446a-ac13-7c52ba1cc1dd\",\r\n \"name\": \"2517543324097376141_bc8c9a6a-98d5-446a-ac13-7c52ba1cc1dd\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T17:00:22.7029774Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T17:00:22.2628838Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:59:50.2623858Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:59:50.2623858Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324097376141_bc8c9a6a-98d5-446a-ac13-7c52ba1cc1dd\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_1\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:59:50\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_2\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324097376141_bc8c9a6a-98d5-446a-ac13-7c52ba1cc1dd/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324117376141_b6b74211-e21b-4e73-b735-b40376472808\",\r\n \"name\": \"2517543324117376141_b6b74211-e21b-4e73-b735-b40376472808\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T17:00:22.6686906Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T17:00:22.2628838Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:59:48.2623858Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:59:48.2623858Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324117376141_b6b74211-e21b-4e73-b735-b40376472808\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_3\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:59:48.2623858Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:59:48\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_4\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324117376141_b6b74211-e21b-4e73-b735-b40376472808/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324137376141_a7cad641-a531-4c31-be03-e8ea3082225d\",\r\n \"name\": \"2517543324137376141_a7cad641-a531-4c31-be03-e8ea3082225d\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T17:00:22.7374844Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T17:00:22.2633863Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:59:46.2623858Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:59:46.2623858Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324137376141_a7cad641-a531-4c31-be03-e8ea3082225d\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_5\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:59:46\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_6\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324137376141_a7cad641-a531-4c31-be03-e8ea3082225d/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324157376141_6ee9be27-47c0-4115-801c-4a8429028be2\",\r\n \"name\": \"2517543324157376141_6ee9be27-47c0-4115-801c-4a8429028be2\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T17:00:22.6547389Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T17:00:22.2633863Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:59:44.2623858Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:59:44.2623858Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324157376141_6ee9be27-47c0-4115-801c-4a8429028be2\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_7\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:59:44\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_8\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324157376141_6ee9be27-47c0-4115-801c-4a8429028be2/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"name\": \"2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3024741Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:33.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:33.0506048Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_9\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:33\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_10\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29\",\r\n \"name\": \"2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3493253Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:31.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:31.0506048Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_11\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:58:31.0506048Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:31\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_12\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70\",\r\n \"name\": \"2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3904646Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:29.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:29.0506048Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_13\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:29\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_14\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1\",\r\n \"name\": \"2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:07.8905051Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:27.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:27.0506048Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_15\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:27\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_16\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b\",\r\n \"name\": \"2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:14.8746852Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:42.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:42.4544756Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_17\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:42\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_18\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd\",\r\n \"name\": \"2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:15.2706467Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:40.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:40.4544756Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_19\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:54:40.4544756Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:40\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_20\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a\",\r\n \"name\": \"2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:15.4735382Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:38.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:38.4544756Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_21\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:38\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_22\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b\",\r\n \"name\": \"2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:14.7779424Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:36.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:36.4544756Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_23\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:36\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_24\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a\",\r\n \"name\": \"2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:35.2107435Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:02.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:02.2273675Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_25\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:02\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_26\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208\",\r\n \"name\": \"2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:45.5185723Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:00.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:00.2273675Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_27\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:54:00.2273675Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:00\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_28\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a\",\r\n \"name\": \"2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:34.5998571Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:53:58.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:53:58.2273675Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_29\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:53:58\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_30\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200\",\r\n \"name\": \"2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:34.9619429Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:53:56.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:53:56.2273675Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_31\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:53:56\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_32\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Security/locations/centralus/alerts/2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874\",\r\n \"name\": \"2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-01-23T00:55:20.7163645Z\",\r\n \"processingEndTimeUtc\": \"2022-01-23T00:55:15.3028632Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"productComponentName\": \"App Services\",\r\n \"alertType\": \"AppServices_Nmap\",\r\n \"startTimeUtc\": \"2022-01-22T23:21:29.978Z\",\r\n \"endTimeUtc\": \"2022-01-22T23:21:29.978Z\",\r\n \"severity\": \"Low\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874\",\r\n \"intent\": \"PreAttack\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_33\",\r\n \"azureResourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Web/sites/iotSimulator-fdi4i\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"iotSimulator-fdi4i\",\r\n \"alertDisplayName\": \"Web fingerprinting detected\",\r\n \"description\": \"Azure App Service activity log indicates a possible web fingerprinting activity on your App Service resource.\\r\\nThe suspicious activity detected is associated with NMAP. Attackers often use this tool for probing the web application to find vulnerabilities.\",\r\n \"remediationSteps\": [\r\n \"If only specific IP addresses should be allowed to access the web app, set IP restrictions (https://docs.microsoft.com/azure/app-service/app-service-ip-restrictions) for it.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"sample URIs\": \"/\",\r\n \"sample Source IP Addresses\": \"122.235.84.213\",\r\n \"sample User Agents\": \"Mozilla/5.0+(compatible;+Nmap+Scripting+Engine;+https://nmap.org/book/nse.html)\",\r\n \"sample Referer\": \"-\",\r\n \"resourceType\": \"App Service\",\r\n \"killChainIntent\": \"PreAttack\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_34\",\r\n \"resourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Web/sites/iotSimulator-fdi4i\",\r\n \"type\": \"azure-resource\"\r\n },\r\n {\r\n \"$id\": \"centralus_35\",\r\n \"address\": \"122.235.84.213\",\r\n \"location\": {\r\n \"countryCode\": \"CN\",\r\n \"countryName\": \"China\",\r\n \"state\": \"Zhejiang\",\r\n \"city\": \"Hangzhou\",\r\n \"longitude\": 120.15889,\r\n \"latitude\": 30.23556,\r\n \"asn\": 4134\r\n },\r\n \"type\": \"ip\"\r\n },\r\n {\r\n \"$id\": \"centralus_36\",\r\n \"sourceAddress\": {\r\n \"$ref\": \"centralus_35\"\r\n },\r\n \"type\": \"network-connection\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/iotsimulator/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n }\r\n ]\r\n}", "StatusCode": 200 }, { - "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Security/locations/centralus/alerts/2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929?api-version=2021-01-01", - "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Jlc291cmNlR3JvdXBzL2lvdHNpbXVsYXRvci9wcm92aWRlcnMvTWljcm9zb2Z0LlNlY3VyaXR5L2xvY2F0aW9ucy9jZW50cmFsdXMvYWxlcnRzLzI1MTc3ODc3OTI4NTU0Mzk5OTlfYzJlOGI4MTAtMDZmNy00MzI3LTk5ODMtNWQ2OTQ5ZjM5OTI5P2FwaS12ZXJzaW9uPTIwMjEtMDEtMDE=", + "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324097376141_bc8c9a6a-98d5-446a-ac13-7c52ba1cc1dd?api-version=2021-11-01", + "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Jlc291cmNlR3JvdXBzL1NhbXBsZS1SRy9wcm92aWRlcnMvTWljcm9zb2Z0LlNlY3VyaXR5L2xvY2F0aW9ucy9jZW50cmFsdXMvYWxlcnRzLzI1MTc1NDMzMjQwOTczNzYxNDFfYmM4YzlhNmEtOThkNS00NDZhLWFjMTMtN2M1MmJhMWNjMWRkP2FwaS12ZXJzaW9uPTIwMjEtMTEtMDE=", "RequestMethod": "GET", "RequestBody": "", "RequestHeaders": { "x-ms-client-request-id": [ - "7cb732cd-dbdf-48b4-af5a-f1986ee37ace" + "dd72eac6-ca07-41ca-95bb-1b610f34e60d" ], "Accept-Language": [ "en-US" ], "User-Agent": [ - "FxVersion/4.6.30015.01", + "FxVersion/4.700.22.11601", "OSName/Windows", - "OSVersion/Microsoft.Windows.10.0.14393.", - "Microsoft.Azure.Management.Security.SecurityCenterClient/2.2.0.0" + "OSVersion/Microsoft.Windows.10.0.22000", + "Microsoft.Azure.Management.Security.SecurityCenterClient/3.0.0.0" ] }, "ResponseHeaders": { @@ -91,7 +91,7 @@ "no-cache" ], "x-ms-ratelimit-remaining-subscription-resource-requests": [ - "749" + "748" ], "Strict-Transport-Security": [ "max-age=31536000; includeSubDomains" @@ -100,22 +100,22 @@ "Kestrel" ], "x-ms-request-id": [ - "d3104d31-2186-4bf1-90c0-a66f0d95fe38" + "614b0553-344b-49c3-abc3-1aecfff12504" ], "x-ms-correlation-request-id": [ - "d3104d31-2186-4bf1-90c0-a66f0d95fe38" + "614b0553-344b-49c3-abc3-1aecfff12504" ], "x-ms-routing-request-id": [ - "UAECENTRAL:20210805T103510Z:d3104d31-2186-4bf1-90c0-a66f0d95fe38" + "FRANCESOUTH:20220322T170024Z:614b0553-344b-49c3-abc3-1aecfff12504" ], "X-Content-Type-Options": [ "nosniff" ], "Date": [ - "Thu, 05 Aug 2021 10:35:10 GMT" + "Tue, 22 Mar 2022 17:00:23 GMT" ], "Content-Length": [ - "4527" + "3650" ], "Content-Type": [ "application/json; charset=utf-8" @@ -124,7 +124,7 @@ "-1" ] }, - "ResponseBody": "{\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Security/locations/centralus/alerts/2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"name\": \"2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2021-06-12T19:40:33.8308539Z\",\r\n \"processingEndTimeUtc\": \"2021-06-12T19:40:32.548439Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Azure Security Center\",\r\n \"productComponentName\": \"Storage Accounts\",\r\n \"alertType\": \"Storage.Blob_AnonymousScan.Containers\",\r\n \"startTimeUtc\": \"2021-06-12T18:11:54.456Z\",\r\n \"endTimeUtc\": \"2021-06-12T18:11:54.456Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"correlationKey\": \"eQXuNbERVh6e/t+5e+8g+5PLuHGkeLWBAAjR80eo/KQ=\",\r\n \"intent\": \"Collection\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_1\",\r\n \"azureResourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Storage/storageAccounts/storagefdi4i\",\r\n \"type\": \"AzureResource\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"storagefdi4i\",\r\n \"alertDisplayName\": \"PREVIEW - Anonymous scan of public storage containers\",\r\n \"description\": \"There were 94 failed attempts to anonymously identify publicly accessible containers in your storage account `storagefdi4i`. This might indicate a reconnaissance attack, where the attacker scans your storage account to identify publicly accessible containers and then tries to find sensitive data inside them. In many cases, attackers might successfully access data after a series of failed attempts. It’s therefore important to act on this alert.\",\r\n \"remediationSteps\": [\r\n \"• If public access is not needed for the Azure Storage containers, consider disallowing it on the entire storage account or limiting it selectively on specific containers or blobs (https://docs.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-prevent).\",\r\n \"• We recommend that you always follow the least privilege principle: https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-privileged-access#pa-7-follow-just-enough-administration-least-privilege-principle.\",\r\n \"• To prevent breaches of sensitive data, please review your Azure Storage containers and make sure no sensitive data is stored in them.\",\r\n \"• Consider using identity-based authentication: https://docs.microsoft.com/en-us/azure/storage/files/storage-files-active-directory-overview.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"alert Id\": \"c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"azure AD user\": \"N/A (Azure AD authentication was not used)\",\r\n \"user agent\": \"Go-http-client/1.1\",\r\n \"api type\": \"Blob\",\r\n \"client location\": \"N/A\",\r\n \"number of failed access attempts\": \"94\",\r\n \"among the enumeration terms used\": \"app, bin, blog, deploy, confidential, crm, builds, doc, customers, images, attachments, intranet, backups, customer, exports, img, data, blob, downloads, build, azure, export, files, bucket, database, dev, admin, emails, dist, development, documents, debug, assets, cdn, devops, download, backup, code, erp, logs, cache, iso, creds, bak, credentials, config, file, administrator, attachment, exe\",\r\n \"number of containers successfully accessed\": \"0\",\r\n \"list of containers successfully accessed\": \"\",\r\n \"authentication type\": \"Anonymous\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"operations types\": \"GetContainerProperties\",\r\n \"service type\": \"Azure Blobs\",\r\n \"potential causes\": \"\",\r\n \"resourceType\": \"Storage\",\r\n \"killChainIntent\": \"Collection\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_2\",\r\n \"resourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Storage/storageAccounts/storagefdi4i\",\r\n \"type\": \"azure-resource\"\r\n },\r\n {\r\n \"$id\": \"centralus_3\",\r\n \"address\": \"78.46.106.254\",\r\n \"location\": {\r\n \"countryCode\": \"DE\",\r\n \"countryName\": \"Germany\",\r\n \"state\": \"Bayern\",\r\n \"city\": \"Nuernberg\",\r\n \"longitude\": 11.0768,\r\n \"latitude\": 49.452,\r\n \"asn\": 24940\r\n },\r\n \"type\": \"ip\"\r\n },\r\n {\r\n \"$id\": \"centralus_4\",\r\n \"sourceAddress\": {\r\n \"$ref\": \"centralus_3\"\r\n },\r\n \"protocol\": \"Tcp\",\r\n \"type\": \"network-connection\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security/AlertBlade/alertId/2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/iotsimulator/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n}", + "ResponseBody": "{\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324097376141_bc8c9a6a-98d5-446a-ac13-7c52ba1cc1dd\",\r\n \"name\": \"2517543324097376141_bc8c9a6a-98d5-446a-ac13-7c52ba1cc1dd\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T17:00:22.7029774Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T17:00:22.2628838Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:59:50.2623858Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:59:50.2623858Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324097376141_bc8c9a6a-98d5-446a-ac13-7c52ba1cc1dd\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_1\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:59:50\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_2\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324097376141_bc8c9a6a-98d5-446a-ac13-7c52ba1cc1dd/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n}", "StatusCode": 200 } ], diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_GetSubscriptionLevelAlert.json b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_GetSubscriptionLevelAlert.json index b5c1c7877fc3..89e058081087 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_GetSubscriptionLevelAlert.json +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_GetSubscriptionLevelAlert.json @@ -1,22 +1,22 @@ { "Entries": [ { - "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/alerts?api-version=2021-01-01", - "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvYWxlcnRzP2FwaS12ZXJzaW9uPTIwMjEtMDEtMDE=", + "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/alerts?api-version=2021-11-01", + "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvYWxlcnRzP2FwaS12ZXJzaW9uPTIwMjEtMTEtMDE=", "RequestMethod": "GET", "RequestBody": "", "RequestHeaders": { "x-ms-client-request-id": [ - "1d91701b-6d12-4d9b-9a2b-8f8fd9058834" + "d033b7fe-010e-4403-be5f-3c3a235b55c6" ], "Accept-Language": [ "en-US" ], "User-Agent": [ - "FxVersion/4.6.30015.01", + "FxVersion/4.700.22.11601", "OSName/Windows", - "OSVersion/Microsoft.Windows.10.0.14393.", - "Microsoft.Azure.Management.Security.SecurityCenterClient/2.2.0.0" + "OSVersion/Microsoft.Windows.10.0.22000", + "Microsoft.Azure.Management.Security.SecurityCenterClient/3.0.0.0" ] }, "ResponseHeaders": { @@ -34,13 +34,13 @@ "749" ], "x-ms-request-id": [ - "b5cf4fbf-f399-4eec-838d-44b98b9c2633" + "c3a2df13-36a5-4c87-90af-da8fe37dbb28" ], "x-ms-correlation-request-id": [ - "b5cf4fbf-f399-4eec-838d-44b98b9c2633" + "c3a2df13-36a5-4c87-90af-da8fe37dbb28" ], "x-ms-routing-request-id": [ - "UAECENTRAL:20210805T103459Z:b5cf4fbf-f399-4eec-838d-44b98b9c2633" + "FRANCESOUTH:20220322T170010Z:c3a2df13-36a5-4c87-90af-da8fe37dbb28" ], "Strict-Transport-Security": [ "max-age=31536000; includeSubDomains" @@ -49,7 +49,7 @@ "nosniff" ], "Date": [ - "Thu, 05 Aug 2021 10:34:59 GMT" + "Tue, 22 Mar 2022 17:00:10 GMT" ], "Content-Type": [ "application/json; charset=utf-8" @@ -58,29 +58,29 @@ "-1" ], "Content-Length": [ - "4539" + "45217" ] }, - "ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Security/locations/centralus/alerts/2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"name\": \"2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2021-06-12T19:40:33.8308539Z\",\r\n \"processingEndTimeUtc\": \"2021-06-12T19:40:32.548439Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Azure Security Center\",\r\n \"productComponentName\": \"Storage Accounts\",\r\n \"alertType\": \"Storage.Blob_AnonymousScan.Containers\",\r\n \"startTimeUtc\": \"2021-06-12T18:11:54.456Z\",\r\n \"endTimeUtc\": \"2021-06-12T18:11:54.456Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"correlationKey\": \"eQXuNbERVh6e/t+5e+8g+5PLuHGkeLWBAAjR80eo/KQ=\",\r\n \"intent\": \"Collection\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_1\",\r\n \"azureResourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Storage/storageAccounts/storagefdi4i\",\r\n \"type\": \"AzureResource\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"storagefdi4i\",\r\n \"alertDisplayName\": \"PREVIEW - Anonymous scan of public storage containers\",\r\n \"description\": \"There were 94 failed attempts to anonymously identify publicly accessible containers in your storage account `storagefdi4i`. This might indicate a reconnaissance attack, where the attacker scans your storage account to identify publicly accessible containers and then tries to find sensitive data inside them. In many cases, attackers might successfully access data after a series of failed attempts. It’s therefore important to act on this alert.\",\r\n \"remediationSteps\": [\r\n \"• If public access is not needed for the Azure Storage containers, consider disallowing it on the entire storage account or limiting it selectively on specific containers or blobs (https://docs.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-prevent).\",\r\n \"• We recommend that you always follow the least privilege principle: https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-privileged-access#pa-7-follow-just-enough-administration-least-privilege-principle.\",\r\n \"• To prevent breaches of sensitive data, please review your Azure Storage containers and make sure no sensitive data is stored in them.\",\r\n \"• Consider using identity-based authentication: https://docs.microsoft.com/en-us/azure/storage/files/storage-files-active-directory-overview.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"alert Id\": \"c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"azure AD user\": \"N/A (Azure AD authentication was not used)\",\r\n \"user agent\": \"Go-http-client/1.1\",\r\n \"api type\": \"Blob\",\r\n \"client location\": \"N/A\",\r\n \"number of failed access attempts\": \"94\",\r\n \"among the enumeration terms used\": \"app, bin, blog, deploy, confidential, crm, builds, doc, customers, images, attachments, intranet, backups, customer, exports, img, data, blob, downloads, build, azure, export, files, bucket, database, dev, admin, emails, dist, development, documents, debug, assets, cdn, devops, download, backup, code, erp, logs, cache, iso, creds, bak, credentials, config, file, administrator, attachment, exe\",\r\n \"number of containers successfully accessed\": \"0\",\r\n \"list of containers successfully accessed\": \"\",\r\n \"authentication type\": \"Anonymous\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"operations types\": \"GetContainerProperties\",\r\n \"service type\": \"Azure Blobs\",\r\n \"potential causes\": \"\",\r\n \"resourceType\": \"Storage\",\r\n \"killChainIntent\": \"Collection\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_2\",\r\n \"resourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Storage/storageAccounts/storagefdi4i\",\r\n \"type\": \"azure-resource\"\r\n },\r\n {\r\n \"$id\": \"centralus_3\",\r\n \"address\": \"78.46.106.254\",\r\n \"location\": {\r\n \"countryCode\": \"DE\",\r\n \"countryName\": \"Germany\",\r\n \"state\": \"Bayern\",\r\n \"city\": \"Nuernberg\",\r\n \"longitude\": 11.0768,\r\n \"latitude\": 49.452,\r\n \"asn\": 24940\r\n },\r\n \"type\": \"ip\"\r\n },\r\n {\r\n \"$id\": \"centralus_4\",\r\n \"sourceAddress\": {\r\n \"$ref\": \"centralus_3\"\r\n },\r\n \"protocol\": \"Tcp\",\r\n \"type\": \"network-connection\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security/AlertBlade/alertId/2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/iotsimulator/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n }\r\n ]\r\n}", + "ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"name\": \"2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3024741Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:33.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:33.0506048Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_1\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:33\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_2\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29\",\r\n \"name\": \"2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3493253Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:31.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:31.0506048Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_3\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:58:31.0506048Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:31\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_4\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70\",\r\n \"name\": \"2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3904646Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:29.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:29.0506048Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_5\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:29\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_6\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1\",\r\n \"name\": \"2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:07.8905051Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:27.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:27.0506048Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_7\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:27\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_8\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b\",\r\n \"name\": \"2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:14.8746852Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:42.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:42.4544756Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_9\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:42\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_10\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd\",\r\n \"name\": \"2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:15.2706467Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:40.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:40.4544756Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_11\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:54:40.4544756Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:40\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_12\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a\",\r\n \"name\": \"2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:15.4735382Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:38.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:38.4544756Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_13\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:38\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_14\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b\",\r\n \"name\": \"2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:14.7779424Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:36.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:36.4544756Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_15\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:36\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_16\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a\",\r\n \"name\": \"2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:35.2107435Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:02.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:02.2273675Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_17\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:02\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_18\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208\",\r\n \"name\": \"2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:45.5185723Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:00.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:00.2273675Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_19\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:54:00.2273675Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:00\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_20\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a\",\r\n \"name\": \"2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:34.5998571Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:53:58.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:53:58.2273675Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_21\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:53:58\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_22\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200\",\r\n \"name\": \"2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:34.9619429Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:53:56.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:53:56.2273675Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_23\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:53:56\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_24\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Security/locations/centralus/alerts/2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874\",\r\n \"name\": \"2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-01-23T00:55:20.7163645Z\",\r\n \"processingEndTimeUtc\": \"2022-01-23T00:55:15.3028632Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"productComponentName\": \"App Services\",\r\n \"alertType\": \"AppServices_Nmap\",\r\n \"startTimeUtc\": \"2022-01-22T23:21:29.978Z\",\r\n \"endTimeUtc\": \"2022-01-22T23:21:29.978Z\",\r\n \"severity\": \"Low\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874\",\r\n \"intent\": \"PreAttack\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_25\",\r\n \"azureResourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Web/sites/iotSimulator-fdi4i\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"iotSimulator-fdi4i\",\r\n \"alertDisplayName\": \"Web fingerprinting detected\",\r\n \"description\": \"Azure App Service activity log indicates a possible web fingerprinting activity on your App Service resource.\\r\\nThe suspicious activity detected is associated with NMAP. Attackers often use this tool for probing the web application to find vulnerabilities.\",\r\n \"remediationSteps\": [\r\n \"If only specific IP addresses should be allowed to access the web app, set IP restrictions (https://docs.microsoft.com/azure/app-service/app-service-ip-restrictions) for it.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"sample URIs\": \"/\",\r\n \"sample Source IP Addresses\": \"122.235.84.213\",\r\n \"sample User Agents\": \"Mozilla/5.0+(compatible;+Nmap+Scripting+Engine;+https://nmap.org/book/nse.html)\",\r\n \"sample Referer\": \"-\",\r\n \"resourceType\": \"App Service\",\r\n \"killChainIntent\": \"PreAttack\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_26\",\r\n \"resourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Web/sites/iotSimulator-fdi4i\",\r\n \"type\": \"azure-resource\"\r\n },\r\n {\r\n \"$id\": \"centralus_27\",\r\n \"address\": \"122.235.84.213\",\r\n \"location\": {\r\n \"countryCode\": \"CN\",\r\n \"countryName\": \"China\",\r\n \"state\": \"Zhejiang\",\r\n \"city\": \"Hangzhou\",\r\n \"longitude\": 120.15889,\r\n \"latitude\": 30.23556,\r\n \"asn\": 4134\r\n },\r\n \"type\": \"ip\"\r\n },\r\n {\r\n \"$id\": \"centralus_28\",\r\n \"sourceAddress\": {\r\n \"$ref\": \"centralus_27\"\r\n },\r\n \"type\": \"network-connection\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/iotsimulator/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n }\r\n ]\r\n}", "StatusCode": 200 }, { - "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/locations/centralus/alerts/2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929?api-version=2021-01-01", - "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvbG9jYXRpb25zL2NlbnRyYWx1cy9hbGVydHMvMjUxNzc4Nzc5Mjg1NTQzOTk5OV9jMmU4YjgxMC0wNmY3LTQzMjctOTk4My01ZDY5NDlmMzk5Mjk/YXBpLXZlcnNpb249MjAyMS0wMS0wMQ==", + "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/locations/centralus/alerts/2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7?api-version=2021-11-01", + "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvbG9jYXRpb25zL2NlbnRyYWx1cy9hbGVydHMvMjUxNzU0MzMyNDg2OTQ5Mzk1MV9hYTZhNzQyMi0zNDM4LTRiMjgtYWJmOC02ODY5YWY1YWJjZDc/YXBpLXZlcnNpb249MjAyMS0xMS0wMQ==", "RequestMethod": "GET", "RequestBody": "", "RequestHeaders": { "x-ms-client-request-id": [ - "371b0dd3-c35f-4cfe-9783-d92ed8df4435" + "d1c633aa-9ae6-4e50-b0bf-172b41aa741c" ], "Accept-Language": [ "en-US" ], "User-Agent": [ - "FxVersion/4.6.30015.01", + "FxVersion/4.700.22.11601", "OSName/Windows", - "OSVersion/Microsoft.Windows.10.0.14393.", - "Microsoft.Azure.Management.Security.SecurityCenterClient/2.2.0.0" + "OSVersion/Microsoft.Windows.10.0.22000", + "Microsoft.Azure.Management.Security.SecurityCenterClient/3.0.0.0" ] }, "ResponseHeaders": { @@ -100,22 +100,22 @@ "Kestrel" ], "x-ms-request-id": [ - "b367329a-17c4-4535-b292-245b5f65424b" + "ffbe539d-7e10-441e-b812-8f614cccc756" ], "x-ms-correlation-request-id": [ - "b367329a-17c4-4535-b292-245b5f65424b" + "ffbe539d-7e10-441e-b812-8f614cccc756" ], "x-ms-routing-request-id": [ - "UAECENTRAL:20210805T103501Z:b367329a-17c4-4535-b292-245b5f65424b" + "FRANCESOUTH:20220322T170011Z:ffbe539d-7e10-441e-b812-8f614cccc756" ], "X-Content-Type-Options": [ "nosniff" ], "Date": [ - "Thu, 05 Aug 2021 10:35:00 GMT" + "Tue, 22 Mar 2022 17:00:10 GMT" ], "Content-Length": [ - "4527" + "3653" ], "Content-Type": [ "application/json; charset=utf-8" @@ -124,7 +124,7 @@ "-1" ] }, - "ResponseBody": "{\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Security/locations/centralus/alerts/2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"name\": \"2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2021-06-12T19:40:33.8308539Z\",\r\n \"processingEndTimeUtc\": \"2021-06-12T19:40:32.548439Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Azure Security Center\",\r\n \"productComponentName\": \"Storage Accounts\",\r\n \"alertType\": \"Storage.Blob_AnonymousScan.Containers\",\r\n \"startTimeUtc\": \"2021-06-12T18:11:54.456Z\",\r\n \"endTimeUtc\": \"2021-06-12T18:11:54.456Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"correlationKey\": \"eQXuNbERVh6e/t+5e+8g+5PLuHGkeLWBAAjR80eo/KQ=\",\r\n \"intent\": \"Collection\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_1\",\r\n \"azureResourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Storage/storageAccounts/storagefdi4i\",\r\n \"type\": \"AzureResource\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"storagefdi4i\",\r\n \"alertDisplayName\": \"PREVIEW - Anonymous scan of public storage containers\",\r\n \"description\": \"There were 94 failed attempts to anonymously identify publicly accessible containers in your storage account `storagefdi4i`. This might indicate a reconnaissance attack, where the attacker scans your storage account to identify publicly accessible containers and then tries to find sensitive data inside them. In many cases, attackers might successfully access data after a series of failed attempts. It’s therefore important to act on this alert.\",\r\n \"remediationSteps\": [\r\n \"• If public access is not needed for the Azure Storage containers, consider disallowing it on the entire storage account or limiting it selectively on specific containers or blobs (https://docs.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-prevent).\",\r\n \"• We recommend that you always follow the least privilege principle: https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-privileged-access#pa-7-follow-just-enough-administration-least-privilege-principle.\",\r\n \"• To prevent breaches of sensitive data, please review your Azure Storage containers and make sure no sensitive data is stored in them.\",\r\n \"• Consider using identity-based authentication: https://docs.microsoft.com/en-us/azure/storage/files/storage-files-active-directory-overview.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"alert Id\": \"c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"azure AD user\": \"N/A (Azure AD authentication was not used)\",\r\n \"user agent\": \"Go-http-client/1.1\",\r\n \"api type\": \"Blob\",\r\n \"client location\": \"N/A\",\r\n \"number of failed access attempts\": \"94\",\r\n \"among the enumeration terms used\": \"app, bin, blog, deploy, confidential, crm, builds, doc, customers, images, attachments, intranet, backups, customer, exports, img, data, blob, downloads, build, azure, export, files, bucket, database, dev, admin, emails, dist, development, documents, debug, assets, cdn, devops, download, backup, code, erp, logs, cache, iso, creds, bak, credentials, config, file, administrator, attachment, exe\",\r\n \"number of containers successfully accessed\": \"0\",\r\n \"list of containers successfully accessed\": \"\",\r\n \"authentication type\": \"Anonymous\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"operations types\": \"GetContainerProperties\",\r\n \"service type\": \"Azure Blobs\",\r\n \"potential causes\": \"\",\r\n \"resourceType\": \"Storage\",\r\n \"killChainIntent\": \"Collection\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_2\",\r\n \"resourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Storage/storageAccounts/storagefdi4i\",\r\n \"type\": \"azure-resource\"\r\n },\r\n {\r\n \"$id\": \"centralus_3\",\r\n \"address\": \"78.46.106.254\",\r\n \"location\": {\r\n \"countryCode\": \"DE\",\r\n \"countryName\": \"Germany\",\r\n \"state\": \"Bayern\",\r\n \"city\": \"Nuernberg\",\r\n \"longitude\": 11.0768,\r\n \"latitude\": 49.452,\r\n \"asn\": 24940\r\n },\r\n \"type\": \"ip\"\r\n },\r\n {\r\n \"$id\": \"centralus_4\",\r\n \"sourceAddress\": {\r\n \"$ref\": \"centralus_3\"\r\n },\r\n \"protocol\": \"Tcp\",\r\n \"type\": \"network-connection\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security/AlertBlade/alertId/2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/iotsimulator/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n}", + "ResponseBody": "{\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"name\": \"2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3024741Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:33.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:33.0506048Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_1\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:33\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_2\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n}", "StatusCode": 200 } ], diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_List.json b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_List.json index da844605cee6..1d11e4571911 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_List.json +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_List.json @@ -1,22 +1,22 @@ { "Entries": [ { - "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/alerts?api-version=2021-01-01", - "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvYWxlcnRzP2FwaS12ZXJzaW9uPTIwMjEtMDEtMDE=", + "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/alerts?api-version=2021-11-01", + "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvYWxlcnRzP2FwaS12ZXJzaW9uPTIwMjEtMTEtMDE=", "RequestMethod": "GET", "RequestBody": "", "RequestHeaders": { "x-ms-client-request-id": [ - "3615de57-71c1-4ee3-a90d-30d0f3c6fe22" + "46572fcc-c895-4c31-82f3-aa47f196c8bf" ], "Accept-Language": [ "en-US" ], "User-Agent": [ - "FxVersion/4.6.30015.01", + "FxVersion/4.700.22.11601", "OSName/Windows", - "OSVersion/Microsoft.Windows.10.0.14393.", - "Microsoft.Azure.Management.Security.SecurityCenterClient/2.2.0.0" + "OSVersion/Microsoft.Windows.10.0.22000", + "Microsoft.Azure.Management.Security.SecurityCenterClient/3.0.0.0" ] }, "ResponseHeaders": { @@ -31,16 +31,16 @@ "" ], "x-ms-ratelimit-remaining-subscription-resource-requests": [ - "747" + "748" ], "x-ms-request-id": [ - "d0a7470d-2880-4074-81a8-c29f6e0efd10" + "a2a4600d-bf26-4982-8723-1f6b56a072f9" ], "x-ms-correlation-request-id": [ - "d0a7470d-2880-4074-81a8-c29f6e0efd10" + "a2a4600d-bf26-4982-8723-1f6b56a072f9" ], "x-ms-routing-request-id": [ - "UAECENTRAL:20210805T103503Z:d0a7470d-2880-4074-81a8-c29f6e0efd10" + "FRANCESOUTH:20220322T170014Z:a2a4600d-bf26-4982-8723-1f6b56a072f9" ], "Strict-Transport-Security": [ "max-age=31536000; includeSubDomains" @@ -49,7 +49,7 @@ "nosniff" ], "Date": [ - "Thu, 05 Aug 2021 10:35:02 GMT" + "Tue, 22 Mar 2022 17:00:13 GMT" ], "Content-Type": [ "application/json; charset=utf-8" @@ -58,10 +58,10 @@ "-1" ], "Content-Length": [ - "4539" + "45217" ] }, - "ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Security/locations/centralus/alerts/2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"name\": \"2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2021-06-12T19:40:33.8308539Z\",\r\n \"processingEndTimeUtc\": \"2021-06-12T19:40:32.548439Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Azure Security Center\",\r\n \"productComponentName\": \"Storage Accounts\",\r\n \"alertType\": \"Storage.Blob_AnonymousScan.Containers\",\r\n \"startTimeUtc\": \"2021-06-12T18:11:54.456Z\",\r\n \"endTimeUtc\": \"2021-06-12T18:11:54.456Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"correlationKey\": \"eQXuNbERVh6e/t+5e+8g+5PLuHGkeLWBAAjR80eo/KQ=\",\r\n \"intent\": \"Collection\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_1\",\r\n \"azureResourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Storage/storageAccounts/storagefdi4i\",\r\n \"type\": \"AzureResource\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"storagefdi4i\",\r\n \"alertDisplayName\": \"PREVIEW - Anonymous scan of public storage containers\",\r\n \"description\": \"There were 94 failed attempts to anonymously identify publicly accessible containers in your storage account `storagefdi4i`. This might indicate a reconnaissance attack, where the attacker scans your storage account to identify publicly accessible containers and then tries to find sensitive data inside them. In many cases, attackers might successfully access data after a series of failed attempts. It’s therefore important to act on this alert.\",\r\n \"remediationSteps\": [\r\n \"• If public access is not needed for the Azure Storage containers, consider disallowing it on the entire storage account or limiting it selectively on specific containers or blobs (https://docs.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-prevent).\",\r\n \"• We recommend that you always follow the least privilege principle: https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-privileged-access#pa-7-follow-just-enough-administration-least-privilege-principle.\",\r\n \"• To prevent breaches of sensitive data, please review your Azure Storage containers and make sure no sensitive data is stored in them.\",\r\n \"• Consider using identity-based authentication: https://docs.microsoft.com/en-us/azure/storage/files/storage-files-active-directory-overview.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"alert Id\": \"c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"azure AD user\": \"N/A (Azure AD authentication was not used)\",\r\n \"user agent\": \"Go-http-client/1.1\",\r\n \"api type\": \"Blob\",\r\n \"client location\": \"N/A\",\r\n \"number of failed access attempts\": \"94\",\r\n \"among the enumeration terms used\": \"app, bin, blog, deploy, confidential, crm, builds, doc, customers, images, attachments, intranet, backups, customer, exports, img, data, blob, downloads, build, azure, export, files, bucket, database, dev, admin, emails, dist, development, documents, debug, assets, cdn, devops, download, backup, code, erp, logs, cache, iso, creds, bak, credentials, config, file, administrator, attachment, exe\",\r\n \"number of containers successfully accessed\": \"0\",\r\n \"list of containers successfully accessed\": \"\",\r\n \"authentication type\": \"Anonymous\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"operations types\": \"GetContainerProperties\",\r\n \"service type\": \"Azure Blobs\",\r\n \"potential causes\": \"\",\r\n \"resourceType\": \"Storage\",\r\n \"killChainIntent\": \"Collection\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_2\",\r\n \"resourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Storage/storageAccounts/storagefdi4i\",\r\n \"type\": \"azure-resource\"\r\n },\r\n {\r\n \"$id\": \"centralus_3\",\r\n \"address\": \"78.46.106.254\",\r\n \"location\": {\r\n \"countryCode\": \"DE\",\r\n \"countryName\": \"Germany\",\r\n \"state\": \"Bayern\",\r\n \"city\": \"Nuernberg\",\r\n \"longitude\": 11.0768,\r\n \"latitude\": 49.452,\r\n \"asn\": 24940\r\n },\r\n \"type\": \"ip\"\r\n },\r\n {\r\n \"$id\": \"centralus_4\",\r\n \"sourceAddress\": {\r\n \"$ref\": \"centralus_3\"\r\n },\r\n \"protocol\": \"Tcp\",\r\n \"type\": \"network-connection\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security/AlertBlade/alertId/2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/iotsimulator/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n }\r\n ]\r\n}", + "ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"name\": \"2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3024741Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:33.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:33.0506048Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_1\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:33\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_2\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29\",\r\n \"name\": \"2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3493253Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:31.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:31.0506048Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_3\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:58:31.0506048Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:31\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_4\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70\",\r\n \"name\": \"2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3904646Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:29.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:29.0506048Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_5\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:29\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_6\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1\",\r\n \"name\": \"2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:07.8905051Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:27.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:27.0506048Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_7\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:27\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_8\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b\",\r\n \"name\": \"2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:14.8746852Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:42.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:42.4544756Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_9\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:42\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_10\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd\",\r\n \"name\": \"2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:15.2706467Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:40.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:40.4544756Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_11\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:54:40.4544756Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:40\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_12\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a\",\r\n \"name\": \"2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:15.4735382Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:38.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:38.4544756Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_13\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:38\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_14\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b\",\r\n \"name\": \"2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:14.7779424Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:36.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:36.4544756Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_15\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:36\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_16\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a\",\r\n \"name\": \"2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:35.2107435Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:02.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:02.2273675Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_17\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:02\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_18\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208\",\r\n \"name\": \"2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:45.5185723Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:00.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:00.2273675Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_19\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:54:00.2273675Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:00\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_20\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a\",\r\n \"name\": \"2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:34.5998571Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:53:58.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:53:58.2273675Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_21\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:53:58\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_22\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200\",\r\n \"name\": \"2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:34.9619429Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:53:56.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:53:56.2273675Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_23\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:53:56\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_24\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Security/locations/centralus/alerts/2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874\",\r\n \"name\": \"2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-01-23T00:55:20.7163645Z\",\r\n \"processingEndTimeUtc\": \"2022-01-23T00:55:15.3028632Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"productComponentName\": \"App Services\",\r\n \"alertType\": \"AppServices_Nmap\",\r\n \"startTimeUtc\": \"2022-01-22T23:21:29.978Z\",\r\n \"endTimeUtc\": \"2022-01-22T23:21:29.978Z\",\r\n \"severity\": \"Low\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874\",\r\n \"intent\": \"PreAttack\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_25\",\r\n \"azureResourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Web/sites/iotSimulator-fdi4i\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"iotSimulator-fdi4i\",\r\n \"alertDisplayName\": \"Web fingerprinting detected\",\r\n \"description\": \"Azure App Service activity log indicates a possible web fingerprinting activity on your App Service resource.\\r\\nThe suspicious activity detected is associated with NMAP. Attackers often use this tool for probing the web application to find vulnerabilities.\",\r\n \"remediationSteps\": [\r\n \"If only specific IP addresses should be allowed to access the web app, set IP restrictions (https://docs.microsoft.com/azure/app-service/app-service-ip-restrictions) for it.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"sample URIs\": \"/\",\r\n \"sample Source IP Addresses\": \"122.235.84.213\",\r\n \"sample User Agents\": \"Mozilla/5.0+(compatible;+Nmap+Scripting+Engine;+https://nmap.org/book/nse.html)\",\r\n \"sample Referer\": \"-\",\r\n \"resourceType\": \"App Service\",\r\n \"killChainIntent\": \"PreAttack\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_26\",\r\n \"resourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Web/sites/iotSimulator-fdi4i\",\r\n \"type\": \"azure-resource\"\r\n },\r\n {\r\n \"$id\": \"centralus_27\",\r\n \"address\": \"122.235.84.213\",\r\n \"location\": {\r\n \"countryCode\": \"CN\",\r\n \"countryName\": \"China\",\r\n \"state\": \"Zhejiang\",\r\n \"city\": \"Hangzhou\",\r\n \"longitude\": 120.15889,\r\n \"latitude\": 30.23556,\r\n \"asn\": 4134\r\n },\r\n \"type\": \"ip\"\r\n },\r\n {\r\n \"$id\": \"centralus_28\",\r\n \"sourceAddress\": {\r\n \"$ref\": \"centralus_27\"\r\n },\r\n \"type\": \"network-connection\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/iotsimulator/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n }\r\n ]\r\n}", "StatusCode": 200 } ], diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_ListByResourceGroup.json b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_ListByResourceGroup.json index b0849baf79b6..57beba132bcf 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_ListByResourceGroup.json +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_ListByResourceGroup.json @@ -1,22 +1,22 @@ { "Entries": [ { - "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/alerts?api-version=2021-01-01", - "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvYWxlcnRzP2FwaS12ZXJzaW9uPTIwMjEtMDEtMDE=", + "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/alerts?api-version=2021-11-01", + "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvYWxlcnRzP2FwaS12ZXJzaW9uPTIwMjEtMTEtMDE=", "RequestMethod": "GET", "RequestBody": "", "RequestHeaders": { "x-ms-client-request-id": [ - "4ce8520a-6fa2-4123-b3e6-ea3ed3caa35d" + "0e7a13e2-3d4d-49b1-83bf-cf8a04dc5283" ], "Accept-Language": [ "en-US" ], "User-Agent": [ - "FxVersion/4.6.30015.01", + "FxVersion/4.700.22.11601", "OSName/Windows", - "OSVersion/Microsoft.Windows.10.0.14393.", - "Microsoft.Azure.Management.Security.SecurityCenterClient/2.2.0.0" + "OSVersion/Microsoft.Windows.10.0.22000", + "Microsoft.Azure.Management.Security.SecurityCenterClient/3.0.0.0" ] }, "ResponseHeaders": { @@ -31,16 +31,16 @@ "" ], "x-ms-ratelimit-remaining-subscription-resource-requests": [ - "748" + "749" ], "x-ms-request-id": [ - "038e3986-4f83-4fd7-9a01-fb47de00b168" + "06df5ca3-e474-41ed-aeb9-878cce9430cc" ], "x-ms-correlation-request-id": [ - "038e3986-4f83-4fd7-9a01-fb47de00b168" + "06df5ca3-e474-41ed-aeb9-878cce9430cc" ], "x-ms-routing-request-id": [ - "UAECENTRAL:20210805T103505Z:038e3986-4f83-4fd7-9a01-fb47de00b168" + "FRANCESOUTH:20220322T170018Z:06df5ca3-e474-41ed-aeb9-878cce9430cc" ], "Strict-Transport-Security": [ "max-age=31536000; includeSubDomains" @@ -49,7 +49,7 @@ "nosniff" ], "Date": [ - "Thu, 05 Aug 2021 10:35:05 GMT" + "Tue, 22 Mar 2022 17:00:17 GMT" ], "Content-Type": [ "application/json; charset=utf-8" @@ -58,29 +58,29 @@ "-1" ], "Content-Length": [ - "4539" + "45217" ] }, - "ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Security/locations/centralus/alerts/2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"name\": \"2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2021-06-12T19:40:33.8308539Z\",\r\n \"processingEndTimeUtc\": \"2021-06-12T19:40:32.548439Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Azure Security Center\",\r\n \"productComponentName\": \"Storage Accounts\",\r\n \"alertType\": \"Storage.Blob_AnonymousScan.Containers\",\r\n \"startTimeUtc\": \"2021-06-12T18:11:54.456Z\",\r\n \"endTimeUtc\": \"2021-06-12T18:11:54.456Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"correlationKey\": \"eQXuNbERVh6e/t+5e+8g+5PLuHGkeLWBAAjR80eo/KQ=\",\r\n \"intent\": \"Collection\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_1\",\r\n \"azureResourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Storage/storageAccounts/storagefdi4i\",\r\n \"type\": \"AzureResource\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"storagefdi4i\",\r\n \"alertDisplayName\": \"PREVIEW - Anonymous scan of public storage containers\",\r\n \"description\": \"There were 94 failed attempts to anonymously identify publicly accessible containers in your storage account `storagefdi4i`. This might indicate a reconnaissance attack, where the attacker scans your storage account to identify publicly accessible containers and then tries to find sensitive data inside them. In many cases, attackers might successfully access data after a series of failed attempts. It’s therefore important to act on this alert.\",\r\n \"remediationSteps\": [\r\n \"• If public access is not needed for the Azure Storage containers, consider disallowing it on the entire storage account or limiting it selectively on specific containers or blobs (https://docs.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-prevent).\",\r\n \"• We recommend that you always follow the least privilege principle: https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-privileged-access#pa-7-follow-just-enough-administration-least-privilege-principle.\",\r\n \"• To prevent breaches of sensitive data, please review your Azure Storage containers and make sure no sensitive data is stored in them.\",\r\n \"• Consider using identity-based authentication: https://docs.microsoft.com/en-us/azure/storage/files/storage-files-active-directory-overview.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"alert Id\": \"c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"azure AD user\": \"N/A (Azure AD authentication was not used)\",\r\n \"user agent\": \"Go-http-client/1.1\",\r\n \"api type\": \"Blob\",\r\n \"client location\": \"N/A\",\r\n \"number of failed access attempts\": \"94\",\r\n \"among the enumeration terms used\": \"app, bin, blog, deploy, confidential, crm, builds, doc, customers, images, attachments, intranet, backups, customer, exports, img, data, blob, downloads, build, azure, export, files, bucket, database, dev, admin, emails, dist, development, documents, debug, assets, cdn, devops, download, backup, code, erp, logs, cache, iso, creds, bak, credentials, config, file, administrator, attachment, exe\",\r\n \"number of containers successfully accessed\": \"0\",\r\n \"list of containers successfully accessed\": \"\",\r\n \"authentication type\": \"Anonymous\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"operations types\": \"GetContainerProperties\",\r\n \"service type\": \"Azure Blobs\",\r\n \"potential causes\": \"\",\r\n \"resourceType\": \"Storage\",\r\n \"killChainIntent\": \"Collection\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_2\",\r\n \"resourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Storage/storageAccounts/storagefdi4i\",\r\n \"type\": \"azure-resource\"\r\n },\r\n {\r\n \"$id\": \"centralus_3\",\r\n \"address\": \"78.46.106.254\",\r\n \"location\": {\r\n \"countryCode\": \"DE\",\r\n \"countryName\": \"Germany\",\r\n \"state\": \"Bayern\",\r\n \"city\": \"Nuernberg\",\r\n \"longitude\": 11.0768,\r\n \"latitude\": 49.452,\r\n \"asn\": 24940\r\n },\r\n \"type\": \"ip\"\r\n },\r\n {\r\n \"$id\": \"centralus_4\",\r\n \"sourceAddress\": {\r\n \"$ref\": \"centralus_3\"\r\n },\r\n \"protocol\": \"Tcp\",\r\n \"type\": \"network-connection\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security/AlertBlade/alertId/2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/iotsimulator/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n }\r\n ]\r\n}", + "ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"name\": \"2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3024741Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:33.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:33.0506048Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_1\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:33\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_2\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29\",\r\n \"name\": \"2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3493253Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:31.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:31.0506048Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_3\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:58:31.0506048Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:31\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_4\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70\",\r\n \"name\": \"2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3904646Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:29.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:29.0506048Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_5\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:29\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_6\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1\",\r\n \"name\": \"2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:07.8905051Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:27.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:27.0506048Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_7\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:27\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_8\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b\",\r\n \"name\": \"2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:14.8746852Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:42.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:42.4544756Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_9\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:42\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_10\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd\",\r\n \"name\": \"2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:15.2706467Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:40.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:40.4544756Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_11\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:54:40.4544756Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:40\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_12\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a\",\r\n \"name\": \"2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:15.4735382Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:38.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:38.4544756Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_13\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:38\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_14\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b\",\r\n \"name\": \"2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:14.7779424Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:36.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:36.4544756Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_15\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:36\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_16\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a\",\r\n \"name\": \"2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:35.2107435Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:02.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:02.2273675Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_17\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:02\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_18\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208\",\r\n \"name\": \"2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:45.5185723Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:00.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:00.2273675Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_19\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:54:00.2273675Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:00\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_20\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a\",\r\n \"name\": \"2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:34.5998571Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:53:58.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:53:58.2273675Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_21\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:53:58\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_22\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200\",\r\n \"name\": \"2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:34.9619429Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:53:56.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:53:56.2273675Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_23\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:53:56\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_24\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Security/locations/centralus/alerts/2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874\",\r\n \"name\": \"2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-01-23T00:55:20.7163645Z\",\r\n \"processingEndTimeUtc\": \"2022-01-23T00:55:15.3028632Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"productComponentName\": \"App Services\",\r\n \"alertType\": \"AppServices_Nmap\",\r\n \"startTimeUtc\": \"2022-01-22T23:21:29.978Z\",\r\n \"endTimeUtc\": \"2022-01-22T23:21:29.978Z\",\r\n \"severity\": \"Low\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874\",\r\n \"intent\": \"PreAttack\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_25\",\r\n \"azureResourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Web/sites/iotSimulator-fdi4i\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"iotSimulator-fdi4i\",\r\n \"alertDisplayName\": \"Web fingerprinting detected\",\r\n \"description\": \"Azure App Service activity log indicates a possible web fingerprinting activity on your App Service resource.\\r\\nThe suspicious activity detected is associated with NMAP. Attackers often use this tool for probing the web application to find vulnerabilities.\",\r\n \"remediationSteps\": [\r\n \"If only specific IP addresses should be allowed to access the web app, set IP restrictions (https://docs.microsoft.com/azure/app-service/app-service-ip-restrictions) for it.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"sample URIs\": \"/\",\r\n \"sample Source IP Addresses\": \"122.235.84.213\",\r\n \"sample User Agents\": \"Mozilla/5.0+(compatible;+Nmap+Scripting+Engine;+https://nmap.org/book/nse.html)\",\r\n \"sample Referer\": \"-\",\r\n \"resourceType\": \"App Service\",\r\n \"killChainIntent\": \"PreAttack\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_26\",\r\n \"resourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Web/sites/iotSimulator-fdi4i\",\r\n \"type\": \"azure-resource\"\r\n },\r\n {\r\n \"$id\": \"centralus_27\",\r\n \"address\": \"122.235.84.213\",\r\n \"location\": {\r\n \"countryCode\": \"CN\",\r\n \"countryName\": \"China\",\r\n \"state\": \"Zhejiang\",\r\n \"city\": \"Hangzhou\",\r\n \"longitude\": 120.15889,\r\n \"latitude\": 30.23556,\r\n \"asn\": 4134\r\n },\r\n \"type\": \"ip\"\r\n },\r\n {\r\n \"$id\": \"centralus_28\",\r\n \"sourceAddress\": {\r\n \"$ref\": \"centralus_27\"\r\n },\r\n \"type\": \"network-connection\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/iotsimulator/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n }\r\n ]\r\n}", "StatusCode": 200 }, { - "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Security/alerts?api-version=2021-01-01", - "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Jlc291cmNlR3JvdXBzL2lvdHNpbXVsYXRvci9wcm92aWRlcnMvTWljcm9zb2Z0LlNlY3VyaXR5L2FsZXJ0cz9hcGktdmVyc2lvbj0yMDIxLTAxLTAx", + "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/alerts?api-version=2021-11-01", + "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Jlc291cmNlR3JvdXBzL1NhbXBsZS1SRy9wcm92aWRlcnMvTWljcm9zb2Z0LlNlY3VyaXR5L2FsZXJ0cz9hcGktdmVyc2lvbj0yMDIxLTExLTAx", "RequestMethod": "GET", "RequestBody": "", "RequestHeaders": { "x-ms-client-request-id": [ - "62b127ab-977f-4066-8953-729b2ba31084" + "710ceac1-142b-40ef-94dd-d59d34ef6711" ], "Accept-Language": [ "en-US" ], "User-Agent": [ - "FxVersion/4.6.30015.01", + "FxVersion/4.700.22.11601", "OSName/Windows", - "OSVersion/Microsoft.Windows.10.0.14393.", - "Microsoft.Azure.Management.Security.SecurityCenterClient/2.2.0.0" + "OSVersion/Microsoft.Windows.10.0.22000", + "Microsoft.Azure.Management.Security.SecurityCenterClient/3.0.0.0" ] }, "ResponseHeaders": { @@ -95,16 +95,16 @@ "" ], "x-ms-ratelimit-remaining-subscription-resource-requests": [ - "747" + "748" ], "x-ms-request-id": [ - "061285de-ba0f-4bf9-93b5-7c65b0e9d78d" + "367988d1-b472-43ea-8d2a-8704958053c7" ], "x-ms-correlation-request-id": [ - "061285de-ba0f-4bf9-93b5-7c65b0e9d78d" + "367988d1-b472-43ea-8d2a-8704958053c7" ], "x-ms-routing-request-id": [ - "UAECENTRAL:20210805T103506Z:061285de-ba0f-4bf9-93b5-7c65b0e9d78d" + "FRANCESOUTH:20220322T170019Z:367988d1-b472-43ea-8d2a-8704958053c7" ], "Strict-Transport-Security": [ "max-age=31536000; includeSubDomains" @@ -113,7 +113,7 @@ "nosniff" ], "Date": [ - "Thu, 05 Aug 2021 10:35:05 GMT" + "Tue, 22 Mar 2022 17:00:18 GMT" ], "Content-Type": [ "application/json; charset=utf-8" @@ -122,10 +122,10 @@ "-1" ], "Content-Length": [ - "4539" + "42506" ] }, - "ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Security/locations/centralus/alerts/2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"name\": \"2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2021-06-12T19:40:33.8308539Z\",\r\n \"processingEndTimeUtc\": \"2021-06-12T19:40:32.548439Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Azure Security Center\",\r\n \"productComponentName\": \"Storage Accounts\",\r\n \"alertType\": \"Storage.Blob_AnonymousScan.Containers\",\r\n \"startTimeUtc\": \"2021-06-12T18:11:54.456Z\",\r\n \"endTimeUtc\": \"2021-06-12T18:11:54.456Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"correlationKey\": \"eQXuNbERVh6e/t+5e+8g+5PLuHGkeLWBAAjR80eo/KQ=\",\r\n \"intent\": \"Collection\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_1\",\r\n \"azureResourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Storage/storageAccounts/storagefdi4i\",\r\n \"type\": \"AzureResource\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"storagefdi4i\",\r\n \"alertDisplayName\": \"PREVIEW - Anonymous scan of public storage containers\",\r\n \"description\": \"There were 94 failed attempts to anonymously identify publicly accessible containers in your storage account `storagefdi4i`. This might indicate a reconnaissance attack, where the attacker scans your storage account to identify publicly accessible containers and then tries to find sensitive data inside them. In many cases, attackers might successfully access data after a series of failed attempts. It’s therefore important to act on this alert.\",\r\n \"remediationSteps\": [\r\n \"• If public access is not needed for the Azure Storage containers, consider disallowing it on the entire storage account or limiting it selectively on specific containers or blobs (https://docs.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-prevent).\",\r\n \"• We recommend that you always follow the least privilege principle: https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-privileged-access#pa-7-follow-just-enough-administration-least-privilege-principle.\",\r\n \"• To prevent breaches of sensitive data, please review your Azure Storage containers and make sure no sensitive data is stored in them.\",\r\n \"• Consider using identity-based authentication: https://docs.microsoft.com/en-us/azure/storage/files/storage-files-active-directory-overview.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"alert Id\": \"c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"azure AD user\": \"N/A (Azure AD authentication was not used)\",\r\n \"user agent\": \"Go-http-client/1.1\",\r\n \"api type\": \"Blob\",\r\n \"client location\": \"N/A\",\r\n \"number of failed access attempts\": \"94\",\r\n \"among the enumeration terms used\": \"app, bin, blog, deploy, confidential, crm, builds, doc, customers, images, attachments, intranet, backups, customer, exports, img, data, blob, downloads, build, azure, export, files, bucket, database, dev, admin, emails, dist, development, documents, debug, assets, cdn, devops, download, backup, code, erp, logs, cache, iso, creds, bak, credentials, config, file, administrator, attachment, exe\",\r\n \"number of containers successfully accessed\": \"0\",\r\n \"list of containers successfully accessed\": \"\",\r\n \"authentication type\": \"Anonymous\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"operations types\": \"GetContainerProperties\",\r\n \"service type\": \"Azure Blobs\",\r\n \"potential causes\": \"\",\r\n \"resourceType\": \"Storage\",\r\n \"killChainIntent\": \"Collection\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_2\",\r\n \"resourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Storage/storageAccounts/storagefdi4i\",\r\n \"type\": \"azure-resource\"\r\n },\r\n {\r\n \"$id\": \"centralus_3\",\r\n \"address\": \"78.46.106.254\",\r\n \"location\": {\r\n \"countryCode\": \"DE\",\r\n \"countryName\": \"Germany\",\r\n \"state\": \"Bayern\",\r\n \"city\": \"Nuernberg\",\r\n \"longitude\": 11.0768,\r\n \"latitude\": 49.452,\r\n \"asn\": 24940\r\n },\r\n \"type\": \"ip\"\r\n },\r\n {\r\n \"$id\": \"centralus_4\",\r\n \"sourceAddress\": {\r\n \"$ref\": \"centralus_3\"\r\n },\r\n \"protocol\": \"Tcp\",\r\n \"type\": \"network-connection\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security/AlertBlade/alertId/2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/iotsimulator/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n }\r\n ]\r\n}", + "ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"name\": \"2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3024741Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:33.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:33.0506048Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_1\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:33\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_2\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29\",\r\n \"name\": \"2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3493253Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:31.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:31.0506048Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_3\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:58:31.0506048Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:31\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_4\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70\",\r\n \"name\": \"2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3904646Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:29.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:29.0506048Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_5\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:29\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_6\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1\",\r\n \"name\": \"2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:07.8905051Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:27.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:27.0506048Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_7\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:27\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_8\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b\",\r\n \"name\": \"2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:14.8746852Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:42.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:42.4544756Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_9\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:42\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_10\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd\",\r\n \"name\": \"2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:15.2706467Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:40.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:40.4544756Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_11\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:54:40.4544756Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:40\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_12\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a\",\r\n \"name\": \"2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:15.4735382Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:38.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:38.4544756Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_13\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:38\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_14\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b\",\r\n \"name\": \"2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:14.7779424Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:36.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:36.4544756Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_15\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:36\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_16\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a\",\r\n \"name\": \"2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:35.2107435Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:02.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:02.2273675Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_17\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:02\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_18\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208\",\r\n \"name\": \"2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:45.5185723Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:00.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:00.2273675Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_19\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:54:00.2273675Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:00\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_20\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a\",\r\n \"name\": \"2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:34.5998571Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:53:58.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:53:58.2273675Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_21\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:53:58\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_22\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200\",\r\n \"name\": \"2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:34.9619429Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:53:56.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:53:56.2273675Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_23\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:53:56\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_24\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n }\r\n ]\r\n}", "StatusCode": 200 } ], diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_ListResourceGroupLevelAlertsByRegion.json b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_ListResourceGroupLevelAlertsByRegion.json index ec0f82032cb1..6dea46698996 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_ListResourceGroupLevelAlertsByRegion.json +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_ListResourceGroupLevelAlertsByRegion.json @@ -1,22 +1,22 @@ { "Entries": [ { - "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/alerts?api-version=2021-01-01", - "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvYWxlcnRzP2FwaS12ZXJzaW9uPTIwMjEtMDEtMDE=", + "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/alerts?api-version=2021-11-01", + "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvYWxlcnRzP2FwaS12ZXJzaW9uPTIwMjEtMTEtMDE=", "RequestMethod": "GET", "RequestBody": "", "RequestHeaders": { "x-ms-client-request-id": [ - "e8ec7255-bf04-4eeb-9bd3-f3ed151efb21" + "5571e931-6fbb-447c-a1c4-e34c5e7faee5" ], "Accept-Language": [ "en-US" ], "User-Agent": [ - "FxVersion/4.6.30015.01", + "FxVersion/4.700.22.11601", "OSName/Windows", - "OSVersion/Microsoft.Windows.10.0.14393.", - "Microsoft.Azure.Management.Security.SecurityCenterClient/2.2.0.0" + "OSVersion/Microsoft.Windows.10.0.22000", + "Microsoft.Azure.Management.Security.SecurityCenterClient/3.0.0.0" ] }, "ResponseHeaders": { @@ -31,16 +31,16 @@ "" ], "x-ms-ratelimit-remaining-subscription-resource-requests": [ - "748" + "749" ], "x-ms-request-id": [ - "fe868d61-9dad-4159-953d-1d465057088f" + "a7bc086b-0afe-4a95-966d-35cd4a34dce6" ], "x-ms-correlation-request-id": [ - "fe868d61-9dad-4159-953d-1d465057088f" + "a7bc086b-0afe-4a95-966d-35cd4a34dce6" ], "x-ms-routing-request-id": [ - "UAECENTRAL:20210805T103502Z:fe868d61-9dad-4159-953d-1d465057088f" + "FRANCESOUTH:20220322T170012Z:a7bc086b-0afe-4a95-966d-35cd4a34dce6" ], "Strict-Transport-Security": [ "max-age=31536000; includeSubDomains" @@ -49,7 +49,7 @@ "nosniff" ], "Date": [ - "Thu, 05 Aug 2021 10:35:01 GMT" + "Tue, 22 Mar 2022 17:00:12 GMT" ], "Content-Type": [ "application/json; charset=utf-8" @@ -58,29 +58,29 @@ "-1" ], "Content-Length": [ - "4539" + "45217" ] }, - "ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Security/locations/centralus/alerts/2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"name\": \"2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2021-06-12T19:40:33.8308539Z\",\r\n \"processingEndTimeUtc\": \"2021-06-12T19:40:32.548439Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Azure Security Center\",\r\n \"productComponentName\": \"Storage Accounts\",\r\n \"alertType\": \"Storage.Blob_AnonymousScan.Containers\",\r\n \"startTimeUtc\": \"2021-06-12T18:11:54.456Z\",\r\n \"endTimeUtc\": \"2021-06-12T18:11:54.456Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"correlationKey\": \"eQXuNbERVh6e/t+5e+8g+5PLuHGkeLWBAAjR80eo/KQ=\",\r\n \"intent\": \"Collection\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_1\",\r\n \"azureResourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Storage/storageAccounts/storagefdi4i\",\r\n \"type\": \"AzureResource\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"storagefdi4i\",\r\n \"alertDisplayName\": \"PREVIEW - Anonymous scan of public storage containers\",\r\n \"description\": \"There were 94 failed attempts to anonymously identify publicly accessible containers in your storage account `storagefdi4i`. This might indicate a reconnaissance attack, where the attacker scans your storage account to identify publicly accessible containers and then tries to find sensitive data inside them. In many cases, attackers might successfully access data after a series of failed attempts. It’s therefore important to act on this alert.\",\r\n \"remediationSteps\": [\r\n \"• If public access is not needed for the Azure Storage containers, consider disallowing it on the entire storage account or limiting it selectively on specific containers or blobs (https://docs.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-prevent).\",\r\n \"• We recommend that you always follow the least privilege principle: https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-privileged-access#pa-7-follow-just-enough-administration-least-privilege-principle.\",\r\n \"• To prevent breaches of sensitive data, please review your Azure Storage containers and make sure no sensitive data is stored in them.\",\r\n \"• Consider using identity-based authentication: https://docs.microsoft.com/en-us/azure/storage/files/storage-files-active-directory-overview.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"alert Id\": \"c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"azure AD user\": \"N/A (Azure AD authentication was not used)\",\r\n \"user agent\": \"Go-http-client/1.1\",\r\n \"api type\": \"Blob\",\r\n \"client location\": \"N/A\",\r\n \"number of failed access attempts\": \"94\",\r\n \"among the enumeration terms used\": \"app, bin, blog, deploy, confidential, crm, builds, doc, customers, images, attachments, intranet, backups, customer, exports, img, data, blob, downloads, build, azure, export, files, bucket, database, dev, admin, emails, dist, development, documents, debug, assets, cdn, devops, download, backup, code, erp, logs, cache, iso, creds, bak, credentials, config, file, administrator, attachment, exe\",\r\n \"number of containers successfully accessed\": \"0\",\r\n \"list of containers successfully accessed\": \"\",\r\n \"authentication type\": \"Anonymous\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"operations types\": \"GetContainerProperties\",\r\n \"service type\": \"Azure Blobs\",\r\n \"potential causes\": \"\",\r\n \"resourceType\": \"Storage\",\r\n \"killChainIntent\": \"Collection\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_2\",\r\n \"resourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Storage/storageAccounts/storagefdi4i\",\r\n \"type\": \"azure-resource\"\r\n },\r\n {\r\n \"$id\": \"centralus_3\",\r\n \"address\": \"78.46.106.254\",\r\n \"location\": {\r\n \"countryCode\": \"DE\",\r\n \"countryName\": \"Germany\",\r\n \"state\": \"Bayern\",\r\n \"city\": \"Nuernberg\",\r\n \"longitude\": 11.0768,\r\n \"latitude\": 49.452,\r\n \"asn\": 24940\r\n },\r\n \"type\": \"ip\"\r\n },\r\n {\r\n \"$id\": \"centralus_4\",\r\n \"sourceAddress\": {\r\n \"$ref\": \"centralus_3\"\r\n },\r\n \"protocol\": \"Tcp\",\r\n \"type\": \"network-connection\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security/AlertBlade/alertId/2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/iotsimulator/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n }\r\n ]\r\n}", + "ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"name\": \"2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3024741Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:33.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:33.0506048Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_1\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:33\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_2\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29\",\r\n \"name\": \"2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3493253Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:31.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:31.0506048Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_3\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:58:31.0506048Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:31\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_4\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70\",\r\n \"name\": \"2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3904646Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:29.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:29.0506048Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_5\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:29\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_6\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1\",\r\n \"name\": \"2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:07.8905051Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:27.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:27.0506048Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_7\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:27\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_8\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b\",\r\n \"name\": \"2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:14.8746852Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:42.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:42.4544756Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_9\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:42\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_10\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd\",\r\n \"name\": \"2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:15.2706467Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:40.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:40.4544756Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_11\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:54:40.4544756Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:40\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_12\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a\",\r\n \"name\": \"2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:15.4735382Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:38.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:38.4544756Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_13\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:38\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_14\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b\",\r\n \"name\": \"2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:14.7779424Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:36.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:36.4544756Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_15\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:36\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_16\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a\",\r\n \"name\": \"2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:35.2107435Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:02.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:02.2273675Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_17\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:02\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_18\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208\",\r\n \"name\": \"2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:45.5185723Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:00.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:00.2273675Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_19\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:54:00.2273675Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:00\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_20\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a\",\r\n \"name\": \"2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:34.5998571Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:53:58.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:53:58.2273675Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_21\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:53:58\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_22\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200\",\r\n \"name\": \"2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:34.9619429Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:53:56.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:53:56.2273675Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_23\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:53:56\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_24\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Security/locations/centralus/alerts/2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874\",\r\n \"name\": \"2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-01-23T00:55:20.7163645Z\",\r\n \"processingEndTimeUtc\": \"2022-01-23T00:55:15.3028632Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"productComponentName\": \"App Services\",\r\n \"alertType\": \"AppServices_Nmap\",\r\n \"startTimeUtc\": \"2022-01-22T23:21:29.978Z\",\r\n \"endTimeUtc\": \"2022-01-22T23:21:29.978Z\",\r\n \"severity\": \"Low\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874\",\r\n \"intent\": \"PreAttack\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_25\",\r\n \"azureResourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Web/sites/iotSimulator-fdi4i\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"iotSimulator-fdi4i\",\r\n \"alertDisplayName\": \"Web fingerprinting detected\",\r\n \"description\": \"Azure App Service activity log indicates a possible web fingerprinting activity on your App Service resource.\\r\\nThe suspicious activity detected is associated with NMAP. Attackers often use this tool for probing the web application to find vulnerabilities.\",\r\n \"remediationSteps\": [\r\n \"If only specific IP addresses should be allowed to access the web app, set IP restrictions (https://docs.microsoft.com/azure/app-service/app-service-ip-restrictions) for it.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"sample URIs\": \"/\",\r\n \"sample Source IP Addresses\": \"122.235.84.213\",\r\n \"sample User Agents\": \"Mozilla/5.0+(compatible;+Nmap+Scripting+Engine;+https://nmap.org/book/nse.html)\",\r\n \"sample Referer\": \"-\",\r\n \"resourceType\": \"App Service\",\r\n \"killChainIntent\": \"PreAttack\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_26\",\r\n \"resourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Web/sites/iotSimulator-fdi4i\",\r\n \"type\": \"azure-resource\"\r\n },\r\n {\r\n \"$id\": \"centralus_27\",\r\n \"address\": \"122.235.84.213\",\r\n \"location\": {\r\n \"countryCode\": \"CN\",\r\n \"countryName\": \"China\",\r\n \"state\": \"Zhejiang\",\r\n \"city\": \"Hangzhou\",\r\n \"longitude\": 120.15889,\r\n \"latitude\": 30.23556,\r\n \"asn\": 4134\r\n },\r\n \"type\": \"ip\"\r\n },\r\n {\r\n \"$id\": \"centralus_28\",\r\n \"sourceAddress\": {\r\n \"$ref\": \"centralus_27\"\r\n },\r\n \"type\": \"network-connection\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/iotsimulator/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n }\r\n ]\r\n}", "StatusCode": 200 }, { - "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Security/locations/centralus/alerts?api-version=2021-01-01", - "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Jlc291cmNlR3JvdXBzL2lvdHNpbXVsYXRvci9wcm92aWRlcnMvTWljcm9zb2Z0LlNlY3VyaXR5L2xvY2F0aW9ucy9jZW50cmFsdXMvYWxlcnRzP2FwaS12ZXJzaW9uPTIwMjEtMDEtMDE=", + "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts?api-version=2021-11-01", + "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Jlc291cmNlR3JvdXBzL1NhbXBsZS1SRy9wcm92aWRlcnMvTWljcm9zb2Z0LlNlY3VyaXR5L2xvY2F0aW9ucy9jZW50cmFsdXMvYWxlcnRzP2FwaS12ZXJzaW9uPTIwMjEtMTEtMDE=", "RequestMethod": "GET", "RequestBody": "", "RequestHeaders": { "x-ms-client-request-id": [ - "192c84d9-367c-40f2-8a5f-712edb51d269" + "0f9325e0-60d7-4ac7-8a4f-1d9b42d80857" ], "Accept-Language": [ "en-US" ], "User-Agent": [ - "FxVersion/4.6.30015.01", + "FxVersion/4.700.22.11601", "OSName/Windows", - "OSVersion/Microsoft.Windows.10.0.14393.", - "Microsoft.Azure.Management.Security.SecurityCenterClient/2.2.0.0" + "OSVersion/Microsoft.Windows.10.0.22000", + "Microsoft.Azure.Management.Security.SecurityCenterClient/3.0.0.0" ] }, "ResponseHeaders": { @@ -100,22 +100,22 @@ "Kestrel" ], "x-ms-request-id": [ - "f1fc17ac-04d0-44bb-9399-e666c668e623" + "3a38a54c-6d11-4c29-a8ad-68b4c32bbe16" ], "x-ms-correlation-request-id": [ - "f1fc17ac-04d0-44bb-9399-e666c668e623" + "3a38a54c-6d11-4c29-a8ad-68b4c32bbe16" ], "x-ms-routing-request-id": [ - "UAECENTRAL:20210805T103502Z:f1fc17ac-04d0-44bb-9399-e666c668e623" + "FRANCESOUTH:20220322T170012Z:3a38a54c-6d11-4c29-a8ad-68b4c32bbe16" ], "X-Content-Type-Options": [ "nosniff" ], "Date": [ - "Thu, 05 Aug 2021 10:35:02 GMT" + "Tue, 22 Mar 2022 17:00:12 GMT" ], "Content-Length": [ - "4539" + "42506" ], "Content-Type": [ "application/json; charset=utf-8" @@ -124,7 +124,7 @@ "-1" ] }, - "ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Security/locations/centralus/alerts/2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"name\": \"2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2021-06-12T19:40:33.8308539Z\",\r\n \"processingEndTimeUtc\": \"2021-06-12T19:40:32.548439Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Azure Security Center\",\r\n \"productComponentName\": \"Storage Accounts\",\r\n \"alertType\": \"Storage.Blob_AnonymousScan.Containers\",\r\n \"startTimeUtc\": \"2021-06-12T18:11:54.456Z\",\r\n \"endTimeUtc\": \"2021-06-12T18:11:54.456Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"correlationKey\": \"eQXuNbERVh6e/t+5e+8g+5PLuHGkeLWBAAjR80eo/KQ=\",\r\n \"intent\": \"Collection\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_1\",\r\n \"azureResourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Storage/storageAccounts/storagefdi4i\",\r\n \"type\": \"AzureResource\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"storagefdi4i\",\r\n \"alertDisplayName\": \"PREVIEW - Anonymous scan of public storage containers\",\r\n \"description\": \"There were 94 failed attempts to anonymously identify publicly accessible containers in your storage account `storagefdi4i`. This might indicate a reconnaissance attack, where the attacker scans your storage account to identify publicly accessible containers and then tries to find sensitive data inside them. In many cases, attackers might successfully access data after a series of failed attempts. It’s therefore important to act on this alert.\",\r\n \"remediationSteps\": [\r\n \"• If public access is not needed for the Azure Storage containers, consider disallowing it on the entire storage account or limiting it selectively on specific containers or blobs (https://docs.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-prevent).\",\r\n \"• We recommend that you always follow the least privilege principle: https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-privileged-access#pa-7-follow-just-enough-administration-least-privilege-principle.\",\r\n \"• To prevent breaches of sensitive data, please review your Azure Storage containers and make sure no sensitive data is stored in them.\",\r\n \"• Consider using identity-based authentication: https://docs.microsoft.com/en-us/azure/storage/files/storage-files-active-directory-overview.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"alert Id\": \"c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"azure AD user\": \"N/A (Azure AD authentication was not used)\",\r\n \"user agent\": \"Go-http-client/1.1\",\r\n \"api type\": \"Blob\",\r\n \"client location\": \"N/A\",\r\n \"number of failed access attempts\": \"94\",\r\n \"among the enumeration terms used\": \"app, bin, blog, deploy, confidential, crm, builds, doc, customers, images, attachments, intranet, backups, customer, exports, img, data, blob, downloads, build, azure, export, files, bucket, database, dev, admin, emails, dist, development, documents, debug, assets, cdn, devops, download, backup, code, erp, logs, cache, iso, creds, bak, credentials, config, file, administrator, attachment, exe\",\r\n \"number of containers successfully accessed\": \"0\",\r\n \"list of containers successfully accessed\": \"\",\r\n \"authentication type\": \"Anonymous\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"operations types\": \"GetContainerProperties\",\r\n \"service type\": \"Azure Blobs\",\r\n \"potential causes\": \"\",\r\n \"resourceType\": \"Storage\",\r\n \"killChainIntent\": \"Collection\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_2\",\r\n \"resourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Storage/storageAccounts/storagefdi4i\",\r\n \"type\": \"azure-resource\"\r\n },\r\n {\r\n \"$id\": \"centralus_3\",\r\n \"address\": \"78.46.106.254\",\r\n \"location\": {\r\n \"countryCode\": \"DE\",\r\n \"countryName\": \"Germany\",\r\n \"state\": \"Bayern\",\r\n \"city\": \"Nuernberg\",\r\n \"longitude\": 11.0768,\r\n \"latitude\": 49.452,\r\n \"asn\": 24940\r\n },\r\n \"type\": \"ip\"\r\n },\r\n {\r\n \"$id\": \"centralus_4\",\r\n \"sourceAddress\": {\r\n \"$ref\": \"centralus_3\"\r\n },\r\n \"protocol\": \"Tcp\",\r\n \"type\": \"network-connection\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security/AlertBlade/alertId/2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/iotsimulator/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n }\r\n ]\r\n}", + "ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"name\": \"2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3024741Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:33.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:33.0506048Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_1\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:33\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_2\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29\",\r\n \"name\": \"2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3493253Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:31.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:31.0506048Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_3\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:58:31.0506048Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:31\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_4\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70\",\r\n \"name\": \"2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3904646Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:29.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:29.0506048Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_5\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:29\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_6\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1\",\r\n \"name\": \"2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:07.8905051Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:27.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:27.0506048Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_7\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:27\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_8\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b\",\r\n \"name\": \"2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:14.8746852Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:42.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:42.4544756Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_9\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:42\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_10\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd\",\r\n \"name\": \"2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:15.2706467Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:40.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:40.4544756Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_11\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:54:40.4544756Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:40\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_12\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a\",\r\n \"name\": \"2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:15.4735382Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:38.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:38.4544756Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_13\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:38\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_14\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b\",\r\n \"name\": \"2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:14.7779424Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:36.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:36.4544756Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_15\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:36\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_16\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a\",\r\n \"name\": \"2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:35.2107435Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:02.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:02.2273675Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_17\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:02\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_18\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208\",\r\n \"name\": \"2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:45.5185723Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:00.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:00.2273675Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_19\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:54:00.2273675Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:00\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_20\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a\",\r\n \"name\": \"2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:34.5998571Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:53:58.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:53:58.2273675Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_21\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:53:58\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_22\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200\",\r\n \"name\": \"2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:34.9619429Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:53:56.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:53:56.2273675Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_23\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:53:56\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_24\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n }\r\n ]\r\n}", "StatusCode": 200 } ], diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_ListSubscriptionLevelAlertsByRegion.json b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_ListSubscriptionLevelAlertsByRegion.json index cf95195bae2d..4661cba318f3 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_ListSubscriptionLevelAlertsByRegion.json +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_ListSubscriptionLevelAlertsByRegion.json @@ -1,22 +1,22 @@ { "Entries": [ { - "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/alerts?api-version=2021-01-01", - "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvYWxlcnRzP2FwaS12ZXJzaW9uPTIwMjEtMDEtMDE=", + "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/alerts?api-version=2021-11-01", + "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvYWxlcnRzP2FwaS12ZXJzaW9uPTIwMjEtMTEtMDE=", "RequestMethod": "GET", "RequestBody": "", "RequestHeaders": { "x-ms-client-request-id": [ - "924fbffb-e817-422c-997c-7148dbf48e1d" + "140dd203-2bcc-4f56-b206-0d42be1fa8e9" ], "Accept-Language": [ "en-US" ], "User-Agent": [ - "FxVersion/4.6.30015.01", + "FxVersion/4.700.22.11601", "OSName/Windows", - "OSVersion/Microsoft.Windows.10.0.14393.", - "Microsoft.Azure.Management.Security.SecurityCenterClient/2.2.0.0" + "OSVersion/Microsoft.Windows.10.0.22000", + "Microsoft.Azure.Management.Security.SecurityCenterClient/3.0.0.0" ] }, "ResponseHeaders": { @@ -31,16 +31,16 @@ "" ], "x-ms-ratelimit-remaining-subscription-resource-requests": [ - "749" + "748" ], "x-ms-request-id": [ - "ee571509-95a1-48d7-85b0-8741a686f73f" + "9599f591-88a2-44e8-9211-ae32e38c9638" ], "x-ms-correlation-request-id": [ - "ee571509-95a1-48d7-85b0-8741a686f73f" + "9599f591-88a2-44e8-9211-ae32e38c9638" ], "x-ms-routing-request-id": [ - "UAECENTRAL:20210805T103504Z:ee571509-95a1-48d7-85b0-8741a686f73f" + "FRANCESOUTH:20220322T170016Z:9599f591-88a2-44e8-9211-ae32e38c9638" ], "Strict-Transport-Security": [ "max-age=31536000; includeSubDomains" @@ -49,7 +49,7 @@ "nosniff" ], "Date": [ - "Thu, 05 Aug 2021 10:35:03 GMT" + "Tue, 22 Mar 2022 17:00:16 GMT" ], "Content-Type": [ "application/json; charset=utf-8" @@ -58,29 +58,29 @@ "-1" ], "Content-Length": [ - "4539" + "45217" ] }, - "ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Security/locations/centralus/alerts/2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"name\": \"2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2021-06-12T19:40:33.8308539Z\",\r\n \"processingEndTimeUtc\": \"2021-06-12T19:40:32.548439Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Azure Security Center\",\r\n \"productComponentName\": \"Storage Accounts\",\r\n \"alertType\": \"Storage.Blob_AnonymousScan.Containers\",\r\n \"startTimeUtc\": \"2021-06-12T18:11:54.456Z\",\r\n \"endTimeUtc\": \"2021-06-12T18:11:54.456Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"correlationKey\": \"eQXuNbERVh6e/t+5e+8g+5PLuHGkeLWBAAjR80eo/KQ=\",\r\n \"intent\": \"Collection\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_1\",\r\n \"azureResourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Storage/storageAccounts/storagefdi4i\",\r\n \"type\": \"AzureResource\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"storagefdi4i\",\r\n \"alertDisplayName\": \"PREVIEW - Anonymous scan of public storage containers\",\r\n \"description\": \"There were 94 failed attempts to anonymously identify publicly accessible containers in your storage account `storagefdi4i`. This might indicate a reconnaissance attack, where the attacker scans your storage account to identify publicly accessible containers and then tries to find sensitive data inside them. In many cases, attackers might successfully access data after a series of failed attempts. It’s therefore important to act on this alert.\",\r\n \"remediationSteps\": [\r\n \"• If public access is not needed for the Azure Storage containers, consider disallowing it on the entire storage account or limiting it selectively on specific containers or blobs (https://docs.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-prevent).\",\r\n \"• We recommend that you always follow the least privilege principle: https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-privileged-access#pa-7-follow-just-enough-administration-least-privilege-principle.\",\r\n \"• To prevent breaches of sensitive data, please review your Azure Storage containers and make sure no sensitive data is stored in them.\",\r\n \"• Consider using identity-based authentication: https://docs.microsoft.com/en-us/azure/storage/files/storage-files-active-directory-overview.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"alert Id\": \"c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"azure AD user\": \"N/A (Azure AD authentication was not used)\",\r\n \"user agent\": \"Go-http-client/1.1\",\r\n \"api type\": \"Blob\",\r\n \"client location\": \"N/A\",\r\n \"number of failed access attempts\": \"94\",\r\n \"among the enumeration terms used\": \"app, bin, blog, deploy, confidential, crm, builds, doc, customers, images, attachments, intranet, backups, customer, exports, img, data, blob, downloads, build, azure, export, files, bucket, database, dev, admin, emails, dist, development, documents, debug, assets, cdn, devops, download, backup, code, erp, logs, cache, iso, creds, bak, credentials, config, file, administrator, attachment, exe\",\r\n \"number of containers successfully accessed\": \"0\",\r\n \"list of containers successfully accessed\": \"\",\r\n \"authentication type\": \"Anonymous\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"operations types\": \"GetContainerProperties\",\r\n \"service type\": \"Azure Blobs\",\r\n \"potential causes\": \"\",\r\n \"resourceType\": \"Storage\",\r\n \"killChainIntent\": \"Collection\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_2\",\r\n \"resourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Storage/storageAccounts/storagefdi4i\",\r\n \"type\": \"azure-resource\"\r\n },\r\n {\r\n \"$id\": \"centralus_3\",\r\n \"address\": \"78.46.106.254\",\r\n \"location\": {\r\n \"countryCode\": \"DE\",\r\n \"countryName\": \"Germany\",\r\n \"state\": \"Bayern\",\r\n \"city\": \"Nuernberg\",\r\n \"longitude\": 11.0768,\r\n \"latitude\": 49.452,\r\n \"asn\": 24940\r\n },\r\n \"type\": \"ip\"\r\n },\r\n {\r\n \"$id\": \"centralus_4\",\r\n \"sourceAddress\": {\r\n \"$ref\": \"centralus_3\"\r\n },\r\n \"protocol\": \"Tcp\",\r\n \"type\": \"network-connection\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security/AlertBlade/alertId/2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/iotsimulator/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n }\r\n ]\r\n}", + "ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"name\": \"2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3024741Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:33.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:33.0506048Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_1\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:33\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_2\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29\",\r\n \"name\": \"2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3493253Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:31.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:31.0506048Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_3\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:58:31.0506048Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:31\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_4\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70\",\r\n \"name\": \"2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3904646Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:29.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:29.0506048Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_5\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:29\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_6\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1\",\r\n \"name\": \"2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:07.8905051Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:27.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:27.0506048Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_7\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:27\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_8\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b\",\r\n \"name\": \"2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:14.8746852Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:42.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:42.4544756Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_9\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:42\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_10\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd\",\r\n \"name\": \"2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:15.2706467Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:40.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:40.4544756Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_11\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:54:40.4544756Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:40\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_12\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a\",\r\n \"name\": \"2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:15.4735382Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:38.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:38.4544756Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_13\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:38\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_14\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b\",\r\n \"name\": \"2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:14.7779424Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:36.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:36.4544756Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_15\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:36\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_16\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a\",\r\n \"name\": \"2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:35.2107435Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:02.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:02.2273675Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_17\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:02\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_18\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208\",\r\n \"name\": \"2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:45.5185723Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:00.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:00.2273675Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_19\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:54:00.2273675Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:00\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_20\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a\",\r\n \"name\": \"2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:34.5998571Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:53:58.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:53:58.2273675Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_21\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:53:58\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_22\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200\",\r\n \"name\": \"2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:34.9619429Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:53:56.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:53:56.2273675Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_23\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:53:56\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_24\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Security/locations/centralus/alerts/2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874\",\r\n \"name\": \"2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-01-23T00:55:20.7163645Z\",\r\n \"processingEndTimeUtc\": \"2022-01-23T00:55:15.3028632Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"productComponentName\": \"App Services\",\r\n \"alertType\": \"AppServices_Nmap\",\r\n \"startTimeUtc\": \"2022-01-22T23:21:29.978Z\",\r\n \"endTimeUtc\": \"2022-01-22T23:21:29.978Z\",\r\n \"severity\": \"Low\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874\",\r\n \"intent\": \"PreAttack\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_25\",\r\n \"azureResourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Web/sites/iotSimulator-fdi4i\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"iotSimulator-fdi4i\",\r\n \"alertDisplayName\": \"Web fingerprinting detected\",\r\n \"description\": \"Azure App Service activity log indicates a possible web fingerprinting activity on your App Service resource.\\r\\nThe suspicious activity detected is associated with NMAP. Attackers often use this tool for probing the web application to find vulnerabilities.\",\r\n \"remediationSteps\": [\r\n \"If only specific IP addresses should be allowed to access the web app, set IP restrictions (https://docs.microsoft.com/azure/app-service/app-service-ip-restrictions) for it.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"sample URIs\": \"/\",\r\n \"sample Source IP Addresses\": \"122.235.84.213\",\r\n \"sample User Agents\": \"Mozilla/5.0+(compatible;+Nmap+Scripting+Engine;+https://nmap.org/book/nse.html)\",\r\n \"sample Referer\": \"-\",\r\n \"resourceType\": \"App Service\",\r\n \"killChainIntent\": \"PreAttack\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_26\",\r\n \"resourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Web/sites/iotSimulator-fdi4i\",\r\n \"type\": \"azure-resource\"\r\n },\r\n {\r\n \"$id\": \"centralus_27\",\r\n \"address\": \"122.235.84.213\",\r\n \"location\": {\r\n \"countryCode\": \"CN\",\r\n \"countryName\": \"China\",\r\n \"state\": \"Zhejiang\",\r\n \"city\": \"Hangzhou\",\r\n \"longitude\": 120.15889,\r\n \"latitude\": 30.23556,\r\n \"asn\": 4134\r\n },\r\n \"type\": \"ip\"\r\n },\r\n {\r\n \"$id\": \"centralus_28\",\r\n \"sourceAddress\": {\r\n \"$ref\": \"centralus_27\"\r\n },\r\n \"type\": \"network-connection\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/iotsimulator/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n }\r\n ]\r\n}", "StatusCode": 200 }, { - "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/locations/centralus/alerts?api-version=2021-01-01", - "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvbG9jYXRpb25zL2NlbnRyYWx1cy9hbGVydHM/YXBpLXZlcnNpb249MjAyMS0wMS0wMQ==", + "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/locations/centralus/alerts?api-version=2021-11-01", + "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvbG9jYXRpb25zL2NlbnRyYWx1cy9hbGVydHM/YXBpLXZlcnNpb249MjAyMS0xMS0wMQ==", "RequestMethod": "GET", "RequestBody": "", "RequestHeaders": { "x-ms-client-request-id": [ - "a3d032db-b194-4aa5-a69f-1a4bc5adf8cb" + "41f1863a-6938-48ef-986b-2b12f69fec60" ], "Accept-Language": [ "en-US" ], "User-Agent": [ - "FxVersion/4.6.30015.01", + "FxVersion/4.700.22.11601", "OSName/Windows", - "OSVersion/Microsoft.Windows.10.0.14393.", - "Microsoft.Azure.Management.Security.SecurityCenterClient/2.2.0.0" + "OSVersion/Microsoft.Windows.10.0.22000", + "Microsoft.Azure.Management.Security.SecurityCenterClient/3.0.0.0" ] }, "ResponseHeaders": { @@ -100,22 +100,22 @@ "Kestrel" ], "x-ms-request-id": [ - "75c9f9c4-a410-4072-940f-62615d957fc3" + "a76d9954-82e1-4f88-adef-bf7acec30762" ], "x-ms-correlation-request-id": [ - "75c9f9c4-a410-4072-940f-62615d957fc3" + "a76d9954-82e1-4f88-adef-bf7acec30762" ], "x-ms-routing-request-id": [ - "UAECENTRAL:20210805T103504Z:75c9f9c4-a410-4072-940f-62615d957fc3" + "FRANCESOUTH:20220322T170016Z:a76d9954-82e1-4f88-adef-bf7acec30762" ], "X-Content-Type-Options": [ "nosniff" ], "Date": [ - "Thu, 05 Aug 2021 10:35:04 GMT" + "Tue, 22 Mar 2022 17:00:16 GMT" ], "Content-Length": [ - "4539" + "45217" ], "Content-Type": [ "application/json; charset=utf-8" @@ -124,7 +124,7 @@ "-1" ] }, - "ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Security/locations/centralus/alerts/2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"name\": \"2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2021-06-12T19:40:33.8308539Z\",\r\n \"processingEndTimeUtc\": \"2021-06-12T19:40:32.548439Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Azure Security Center\",\r\n \"productComponentName\": \"Storage Accounts\",\r\n \"alertType\": \"Storage.Blob_AnonymousScan.Containers\",\r\n \"startTimeUtc\": \"2021-06-12T18:11:54.456Z\",\r\n \"endTimeUtc\": \"2021-06-12T18:11:54.456Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"correlationKey\": \"eQXuNbERVh6e/t+5e+8g+5PLuHGkeLWBAAjR80eo/KQ=\",\r\n \"intent\": \"Collection\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_1\",\r\n \"azureResourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Storage/storageAccounts/storagefdi4i\",\r\n \"type\": \"AzureResource\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"storagefdi4i\",\r\n \"alertDisplayName\": \"PREVIEW - Anonymous scan of public storage containers\",\r\n \"description\": \"There were 94 failed attempts to anonymously identify publicly accessible containers in your storage account `storagefdi4i`. This might indicate a reconnaissance attack, where the attacker scans your storage account to identify publicly accessible containers and then tries to find sensitive data inside them. In many cases, attackers might successfully access data after a series of failed attempts. It’s therefore important to act on this alert.\",\r\n \"remediationSteps\": [\r\n \"• If public access is not needed for the Azure Storage containers, consider disallowing it on the entire storage account or limiting it selectively on specific containers or blobs (https://docs.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-prevent).\",\r\n \"• We recommend that you always follow the least privilege principle: https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-privileged-access#pa-7-follow-just-enough-administration-least-privilege-principle.\",\r\n \"• To prevent breaches of sensitive data, please review your Azure Storage containers and make sure no sensitive data is stored in them.\",\r\n \"• Consider using identity-based authentication: https://docs.microsoft.com/en-us/azure/storage/files/storage-files-active-directory-overview.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"alert Id\": \"c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"azure AD user\": \"N/A (Azure AD authentication was not used)\",\r\n \"user agent\": \"Go-http-client/1.1\",\r\n \"api type\": \"Blob\",\r\n \"client location\": \"N/A\",\r\n \"number of failed access attempts\": \"94\",\r\n \"among the enumeration terms used\": \"app, bin, blog, deploy, confidential, crm, builds, doc, customers, images, attachments, intranet, backups, customer, exports, img, data, blob, downloads, build, azure, export, files, bucket, database, dev, admin, emails, dist, development, documents, debug, assets, cdn, devops, download, backup, code, erp, logs, cache, iso, creds, bak, credentials, config, file, administrator, attachment, exe\",\r\n \"number of containers successfully accessed\": \"0\",\r\n \"list of containers successfully accessed\": \"\",\r\n \"authentication type\": \"Anonymous\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"operations types\": \"GetContainerProperties\",\r\n \"service type\": \"Azure Blobs\",\r\n \"potential causes\": \"\",\r\n \"resourceType\": \"Storage\",\r\n \"killChainIntent\": \"Collection\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_2\",\r\n \"resourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Storage/storageAccounts/storagefdi4i\",\r\n \"type\": \"azure-resource\"\r\n },\r\n {\r\n \"$id\": \"centralus_3\",\r\n \"address\": \"78.46.106.254\",\r\n \"location\": {\r\n \"countryCode\": \"DE\",\r\n \"countryName\": \"Germany\",\r\n \"state\": \"Bayern\",\r\n \"city\": \"Nuernberg\",\r\n \"longitude\": 11.0768,\r\n \"latitude\": 49.452,\r\n \"asn\": 24940\r\n },\r\n \"type\": \"ip\"\r\n },\r\n {\r\n \"$id\": \"centralus_4\",\r\n \"sourceAddress\": {\r\n \"$ref\": \"centralus_3\"\r\n },\r\n \"protocol\": \"Tcp\",\r\n \"type\": \"network-connection\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security/AlertBlade/alertId/2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/iotsimulator/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n }\r\n ]\r\n}", + "ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"name\": \"2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3024741Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:33.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:33.0506048Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_1\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:33\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_2\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29\",\r\n \"name\": \"2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3493253Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:31.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:31.0506048Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_3\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:58:31.0506048Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:31\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_4\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70\",\r\n \"name\": \"2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3904646Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:29.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:29.0506048Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_5\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:29\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_6\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1\",\r\n \"name\": \"2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:07.8905051Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:27.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:27.0506048Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_7\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:27\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_8\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b\",\r\n \"name\": \"2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:14.8746852Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:42.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:42.4544756Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_9\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:42\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_10\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd\",\r\n \"name\": \"2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:15.2706467Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:40.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:40.4544756Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_11\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:54:40.4544756Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:40\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_12\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a\",\r\n \"name\": \"2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:15.4735382Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:38.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:38.4544756Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_13\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:38\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_14\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b\",\r\n \"name\": \"2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:14.7779424Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:36.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:36.4544756Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_15\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:36\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_16\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a\",\r\n \"name\": \"2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:35.2107435Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:02.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:02.2273675Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_17\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:02\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_18\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208\",\r\n \"name\": \"2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:45.5185723Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:00.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:00.2273675Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_19\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:54:00.2273675Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:00\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_20\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a\",\r\n \"name\": \"2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:34.5998571Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:53:58.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:53:58.2273675Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_21\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:53:58\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_22\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200\",\r\n \"name\": \"2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:34.9619429Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:53:56.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:53:56.2273675Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_23\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:53:56\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_24\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Security/locations/centralus/alerts/2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874\",\r\n \"name\": \"2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-01-23T00:55:20.7163645Z\",\r\n \"processingEndTimeUtc\": \"2022-01-23T00:55:15.3028632Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"productComponentName\": \"App Services\",\r\n \"alertType\": \"AppServices_Nmap\",\r\n \"startTimeUtc\": \"2022-01-22T23:21:29.978Z\",\r\n \"endTimeUtc\": \"2022-01-22T23:21:29.978Z\",\r\n \"severity\": \"Low\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874\",\r\n \"intent\": \"PreAttack\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_25\",\r\n \"azureResourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Web/sites/iotSimulator-fdi4i\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"iotSimulator-fdi4i\",\r\n \"alertDisplayName\": \"Web fingerprinting detected\",\r\n \"description\": \"Azure App Service activity log indicates a possible web fingerprinting activity on your App Service resource.\\r\\nThe suspicious activity detected is associated with NMAP. Attackers often use this tool for probing the web application to find vulnerabilities.\",\r\n \"remediationSteps\": [\r\n \"If only specific IP addresses should be allowed to access the web app, set IP restrictions (https://docs.microsoft.com/azure/app-service/app-service-ip-restrictions) for it.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"sample URIs\": \"/\",\r\n \"sample Source IP Addresses\": \"122.235.84.213\",\r\n \"sample User Agents\": \"Mozilla/5.0+(compatible;+Nmap+Scripting+Engine;+https://nmap.org/book/nse.html)\",\r\n \"sample Referer\": \"-\",\r\n \"resourceType\": \"App Service\",\r\n \"killChainIntent\": \"PreAttack\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_26\",\r\n \"resourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Web/sites/iotSimulator-fdi4i\",\r\n \"type\": \"azure-resource\"\r\n },\r\n {\r\n \"$id\": \"centralus_27\",\r\n \"address\": \"122.235.84.213\",\r\n \"location\": {\r\n \"countryCode\": \"CN\",\r\n \"countryName\": \"China\",\r\n \"state\": \"Zhejiang\",\r\n \"city\": \"Hangzhou\",\r\n \"longitude\": 120.15889,\r\n \"latitude\": 30.23556,\r\n \"asn\": 4134\r\n },\r\n \"type\": \"ip\"\r\n },\r\n {\r\n \"$id\": \"centralus_28\",\r\n \"sourceAddress\": {\r\n \"$ref\": \"centralus_27\"\r\n },\r\n \"type\": \"network-connection\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/iotsimulator/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n }\r\n ]\r\n}", "StatusCode": 200 } ], diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_SimulateAlert.json b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_SimulateAlert.json new file mode 100644 index 000000000000..a04c4c764612 --- /dev/null +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_SimulateAlert.json @@ -0,0 +1,69 @@ +{ + "Entries": [ + { + "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/locations/centralus/alerts/default/simulate?api-version=2021-11-01", + "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvbG9jYXRpb25zL2NlbnRyYWx1cy9hbGVydHMvZGVmYXVsdC9zaW11bGF0ZT9hcGktdmVyc2lvbj0yMDIxLTExLTAx", + "RequestMethod": "POST", + "RequestBody": "{\r\n \"properties\": {\r\n \"kind\": \"Bundles\",\r\n \"bundles\": [\r\n \"StorageAccounts\"\r\n ]\r\n }\r\n}", + "RequestHeaders": { + "x-ms-client-request-id": [ + "8a9b5aff-cf74-4953-acf3-6c96f56e021c" + ], + "Accept-Language": [ + "en-US" + ], + "User-Agent": [ + "FxVersion/4.700.22.11601", + "OSName/Windows", + "OSVersion/Microsoft.Windows.10.0.22000", + "Microsoft.Azure.Management.Security.SecurityCenterClient/3.0.0.0" + ], + "Content-Type": [ + "application/json; charset=utf-8" + ], + "Content-Length": [ + "150" + ] + }, + "ResponseHeaders": { + "Cache-Control": [ + "no-cache" + ], + "Pragma": [ + "no-cache" + ], + "Strict-Transport-Security": [ + "max-age=31536000; includeSubDomains" + ], + "Server": [ + "Kestrel" + ], + "x-ms-ratelimit-remaining-subscription-writes": [ + "1199" + ], + "x-ms-request-id": [ + "21a9771b-7286-4b16-86ab-72f104c0e10c" + ], + "x-ms-correlation-request-id": [ + "21a9771b-7286-4b16-86ab-72f104c0e10c" + ], + "x-ms-routing-request-id": [ + "FRANCESOUTH:20220322T170022Z:21a9771b-7286-4b16-86ab-72f104c0e10c" + ], + "X-Content-Type-Options": [ + "nosniff" + ], + "Date": [ + "Tue, 22 Mar 2022 17:00:21 GMT" + ], + "Expires": [ + "-1" + ] + }, + "ResponseBody": "", + "StatusCode": 204 + } + ], + "Names": {}, + "Variables": {} +} \ No newline at end of file diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_UpdateResourceGroupLevelAlertState.json b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_UpdateResourceGroupLevelAlertState.json index a5335b323540..830713d33d19 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_UpdateResourceGroupLevelAlertState.json +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_UpdateResourceGroupLevelAlertState.json @@ -1,22 +1,22 @@ { "Entries": [ { - "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/alerts?api-version=2021-01-01", - "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvYWxlcnRzP2FwaS12ZXJzaW9uPTIwMjEtMDEtMDE=", + "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/alerts?api-version=2021-11-01", + "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvYWxlcnRzP2FwaS12ZXJzaW9uPTIwMjEtMTEtMDE=", "RequestMethod": "GET", "RequestBody": "", "RequestHeaders": { "x-ms-client-request-id": [ - "aeb0846f-d5e9-456e-ac31-7db0b03b1f51" + "3457382a-e835-40c5-9691-57389779102f" ], "Accept-Language": [ "en-US" ], "User-Agent": [ - "FxVersion/4.6.30015.01", + "FxVersion/4.700.22.11601", "OSName/Windows", - "OSVersion/Microsoft.Windows.10.0.14393.", - "Microsoft.Azure.Management.Security.SecurityCenterClient/2.2.0.0" + "OSVersion/Microsoft.Windows.10.0.22000", + "Microsoft.Azure.Management.Security.SecurityCenterClient/3.0.0.0" ] }, "ResponseHeaders": { @@ -34,13 +34,13 @@ "749" ], "x-ms-request-id": [ - "9434840c-6fcc-4130-b0a3-362d452fb00c" + "713a0f72-b637-44b4-ad2a-fa526a68dcb1" ], "x-ms-correlation-request-id": [ - "9434840c-6fcc-4130-b0a3-362d452fb00c" + "713a0f72-b637-44b4-ad2a-fa526a68dcb1" ], "x-ms-routing-request-id": [ - "UAECENTRAL:20210808T121020Z:9434840c-6fcc-4130-b0a3-362d452fb00c" + "FRANCESOUTH:20220322T170008Z:713a0f72-b637-44b4-ad2a-fa526a68dcb1" ], "Strict-Transport-Security": [ "max-age=31536000; includeSubDomains" @@ -49,7 +49,7 @@ "nosniff" ], "Date": [ - "Sun, 08 Aug 2021 12:10:19 GMT" + "Tue, 22 Mar 2022 17:00:08 GMT" ], "Content-Type": [ "application/json; charset=utf-8" @@ -58,29 +58,29 @@ "-1" ], "Content-Length": [ - "4539" + "45214" ] }, - "ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Security/locations/centralus/alerts/2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"name\": \"2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2021-06-12T19:40:33.8308539Z\",\r\n \"processingEndTimeUtc\": \"2021-06-12T19:40:32.548439Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Azure Security Center\",\r\n \"productComponentName\": \"Storage Accounts\",\r\n \"alertType\": \"Storage.Blob_AnonymousScan.Containers\",\r\n \"startTimeUtc\": \"2021-06-12T18:11:54.456Z\",\r\n \"endTimeUtc\": \"2021-06-12T18:11:54.456Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"correlationKey\": \"eQXuNbERVh6e/t+5e+8g+5PLuHGkeLWBAAjR80eo/KQ=\",\r\n \"intent\": \"Collection\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_1\",\r\n \"azureResourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Storage/storageAccounts/storagefdi4i\",\r\n \"type\": \"AzureResource\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"storagefdi4i\",\r\n \"alertDisplayName\": \"PREVIEW - Anonymous scan of public storage containers\",\r\n \"description\": \"There were 94 failed attempts to anonymously identify publicly accessible containers in your storage account `storagefdi4i`. This might indicate a reconnaissance attack, where the attacker scans your storage account to identify publicly accessible containers and then tries to find sensitive data inside them. In many cases, attackers might successfully access data after a series of failed attempts. It’s therefore important to act on this alert.\",\r\n \"remediationSteps\": [\r\n \"• If public access is not needed for the Azure Storage containers, consider disallowing it on the entire storage account or limiting it selectively on specific containers or blobs (https://docs.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-prevent).\",\r\n \"• We recommend that you always follow the least privilege principle: https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-privileged-access#pa-7-follow-just-enough-administration-least-privilege-principle.\",\r\n \"• To prevent breaches of sensitive data, please review your Azure Storage containers and make sure no sensitive data is stored in them.\",\r\n \"• Consider using identity-based authentication: https://docs.microsoft.com/en-us/azure/storage/files/storage-files-active-directory-overview.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"alert Id\": \"c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"azure AD user\": \"N/A (Azure AD authentication was not used)\",\r\n \"user agent\": \"Go-http-client/1.1\",\r\n \"api type\": \"Blob\",\r\n \"client location\": \"N/A\",\r\n \"number of failed access attempts\": \"94\",\r\n \"among the enumeration terms used\": \"app, bin, blog, deploy, confidential, crm, builds, doc, customers, images, attachments, intranet, backups, customer, exports, img, data, blob, downloads, build, azure, export, files, bucket, database, dev, admin, emails, dist, development, documents, debug, assets, cdn, devops, download, backup, code, erp, logs, cache, iso, creds, bak, credentials, config, file, administrator, attachment, exe\",\r\n \"number of containers successfully accessed\": \"0\",\r\n \"list of containers successfully accessed\": \"\",\r\n \"authentication type\": \"Anonymous\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"operations types\": \"GetContainerProperties\",\r\n \"service type\": \"Azure Blobs\",\r\n \"potential causes\": \"\",\r\n \"resourceType\": \"Storage\",\r\n \"killChainIntent\": \"Collection\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_2\",\r\n \"resourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Storage/storageAccounts/storagefdi4i\",\r\n \"type\": \"azure-resource\"\r\n },\r\n {\r\n \"$id\": \"centralus_3\",\r\n \"address\": \"78.46.106.254\",\r\n \"location\": {\r\n \"countryCode\": \"DE\",\r\n \"countryName\": \"Germany\",\r\n \"state\": \"Bayern\",\r\n \"city\": \"Nuernberg\",\r\n \"longitude\": 11.0768,\r\n \"latitude\": 49.452,\r\n \"asn\": 24940\r\n },\r\n \"type\": \"ip\"\r\n },\r\n {\r\n \"$id\": \"centralus_4\",\r\n \"sourceAddress\": {\r\n \"$ref\": \"centralus_3\"\r\n },\r\n \"protocol\": \"Tcp\",\r\n \"type\": \"network-connection\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security/AlertBlade/alertId/2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/iotsimulator/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n }\r\n ]\r\n}", + "ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"name\": \"2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3024741Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:33.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:33.0506048Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_1\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:33\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_2\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29\",\r\n \"name\": \"2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3493253Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:31.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:31.0506048Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_3\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:58:31.0506048Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:31\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_4\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70\",\r\n \"name\": \"2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3904646Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:29.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:29.0506048Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_5\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:29\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_6\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1\",\r\n \"name\": \"2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:07.8905051Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:27.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:27.0506048Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_7\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:27\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_8\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b\",\r\n \"name\": \"2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:14.8746852Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:42.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:42.4544756Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_9\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:42\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_10\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd\",\r\n \"name\": \"2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:15.2706467Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:40.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:40.4544756Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_11\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:54:40.4544756Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:40\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_12\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a\",\r\n \"name\": \"2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:15.4735382Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:38.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:38.4544756Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_13\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:38\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_14\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b\",\r\n \"name\": \"2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:14.7779424Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:36.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:36.4544756Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_15\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:36\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_16\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a\",\r\n \"name\": \"2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:35.2107435Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:02.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:02.2273675Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_17\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:02\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_18\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208\",\r\n \"name\": \"2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:45.5185723Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:00.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:00.2273675Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_19\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:54:00.2273675Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:00\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_20\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a\",\r\n \"name\": \"2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:34.5998571Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:53:58.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:53:58.2273675Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_21\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:53:58\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_22\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200\",\r\n \"name\": \"2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:34.9619429Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:53:56.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:53:56.2273675Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_23\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:53:56\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_24\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Security/locations/centralus/alerts/2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874\",\r\n \"name\": \"2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-01-23T00:55:20.7163645Z\",\r\n \"processingEndTimeUtc\": \"2022-01-23T00:55:15.3028632Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"productComponentName\": \"App Services\",\r\n \"alertType\": \"AppServices_Nmap\",\r\n \"startTimeUtc\": \"2022-01-22T23:21:29.978Z\",\r\n \"endTimeUtc\": \"2022-01-22T23:21:29.978Z\",\r\n \"severity\": \"Low\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874\",\r\n \"intent\": \"PreAttack\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_25\",\r\n \"azureResourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Web/sites/iotSimulator-fdi4i\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"iotSimulator-fdi4i\",\r\n \"alertDisplayName\": \"Web fingerprinting detected\",\r\n \"description\": \"Azure App Service activity log indicates a possible web fingerprinting activity on your App Service resource.\\r\\nThe suspicious activity detected is associated with NMAP. Attackers often use this tool for probing the web application to find vulnerabilities.\",\r\n \"remediationSteps\": [\r\n \"If only specific IP addresses should be allowed to access the web app, set IP restrictions (https://docs.microsoft.com/azure/app-service/app-service-ip-restrictions) for it.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"sample URIs\": \"/\",\r\n \"sample Source IP Addresses\": \"122.235.84.213\",\r\n \"sample User Agents\": \"Mozilla/5.0+(compatible;+Nmap+Scripting+Engine;+https://nmap.org/book/nse.html)\",\r\n \"sample Referer\": \"-\",\r\n \"resourceType\": \"App Service\",\r\n \"killChainIntent\": \"PreAttack\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_26\",\r\n \"resourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Web/sites/iotSimulator-fdi4i\",\r\n \"type\": \"azure-resource\"\r\n },\r\n {\r\n \"$id\": \"centralus_27\",\r\n \"address\": \"122.235.84.213\",\r\n \"location\": {\r\n \"countryCode\": \"CN\",\r\n \"countryName\": \"China\",\r\n \"state\": \"Zhejiang\",\r\n \"city\": \"Hangzhou\",\r\n \"longitude\": 120.15889,\r\n \"latitude\": 30.23556,\r\n \"asn\": 4134\r\n },\r\n \"type\": \"ip\"\r\n },\r\n {\r\n \"$id\": \"centralus_28\",\r\n \"sourceAddress\": {\r\n \"$ref\": \"centralus_27\"\r\n },\r\n \"type\": \"network-connection\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/iotsimulator/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n }\r\n ]\r\n}", "StatusCode": 200 }, { - "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Security/locations/centralus/alerts/2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929/dismiss?api-version=2021-01-01", - "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Jlc291cmNlR3JvdXBzL2lvdHNpbXVsYXRvci9wcm92aWRlcnMvTWljcm9zb2Z0LlNlY3VyaXR5L2xvY2F0aW9ucy9jZW50cmFsdXMvYWxlcnRzLzI1MTc3ODc3OTI4NTU0Mzk5OTlfYzJlOGI4MTAtMDZmNy00MzI3LTk5ODMtNWQ2OTQ5ZjM5OTI5L2Rpc21pc3M/YXBpLXZlcnNpb249MjAyMS0wMS0wMQ==", + "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7/dismiss?api-version=2021-11-01", + "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Jlc291cmNlR3JvdXBzL1NhbXBsZS1SRy9wcm92aWRlcnMvTWljcm9zb2Z0LlNlY3VyaXR5L2xvY2F0aW9ucy9jZW50cmFsdXMvYWxlcnRzLzI1MTc1NDMzMjQ4Njk0OTM5NTFfYWE2YTc0MjItMzQzOC00YjI4LWFiZjgtNjg2OWFmNWFiY2Q3L2Rpc21pc3M/YXBpLXZlcnNpb249MjAyMS0xMS0wMQ==", "RequestMethod": "POST", "RequestBody": "", "RequestHeaders": { "x-ms-client-request-id": [ - "6e06af18-17f0-4f5a-823c-eaf80c4e9f52" + "ab97a932-0c41-403e-809c-7c5a586ed8af" ], "Accept-Language": [ "en-US" ], "User-Agent": [ - "FxVersion/4.6.30015.01", + "FxVersion/4.700.22.11601", "OSName/Windows", - "OSVersion/Microsoft.Windows.10.0.14393.", - "Microsoft.Azure.Management.Security.SecurityCenterClient/2.2.0.0" + "OSVersion/Microsoft.Windows.10.0.22000", + "Microsoft.Azure.Management.Security.SecurityCenterClient/3.0.0.0" ] }, "ResponseHeaders": { @@ -100,25 +100,22 @@ "1199" ], "x-ms-request-id": [ - "33e1f3e0-221e-49c8-b913-b4a695e93ced" + "9d267f77-9af3-4372-ac24-5dfc0717f8ed" ], "x-ms-correlation-request-id": [ - "33e1f3e0-221e-49c8-b913-b4a695e93ced" + "9d267f77-9af3-4372-ac24-5dfc0717f8ed" ], "x-ms-routing-request-id": [ - "UAECENTRAL:20210808T121020Z:33e1f3e0-221e-49c8-b913-b4a695e93ced" + "FRANCESOUTH:20220322T170009Z:9d267f77-9af3-4372-ac24-5dfc0717f8ed" ], "X-Content-Type-Options": [ "nosniff" ], "Date": [ - "Sun, 08 Aug 2021 12:10:20 GMT" + "Tue, 22 Mar 2022 17:00:08 GMT" ], "Expires": [ "-1" - ], - "Content-Length": [ - "0" ] }, "ResponseBody": "", diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_UpdateSubscriptionLevelAlertState.json b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_UpdateSubscriptionLevelAlertState.json index 35a43431d694..abee0ffff47f 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_UpdateSubscriptionLevelAlertState.json +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SessionRecords/SecurityAlertsTests/SecurityAlerts_UpdateSubscriptionLevelAlertState.json @@ -1,22 +1,22 @@ { "Entries": [ { - "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/alerts?api-version=2021-01-01", - "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvYWxlcnRzP2FwaS12ZXJzaW9uPTIwMjEtMDEtMDE=", + "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/alerts?api-version=2021-11-01", + "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvYWxlcnRzP2FwaS12ZXJzaW9uPTIwMjEtMTEtMDE=", "RequestMethod": "GET", "RequestBody": "", "RequestHeaders": { "x-ms-client-request-id": [ - "7d4c6269-49ca-490b-a4ac-3ea2ad9578fc" + "6e233756-eec6-4c10-89cf-a615f7edef57" ], "Accept-Language": [ "en-US" ], "User-Agent": [ - "FxVersion/4.6.30015.01", + "FxVersion/4.700.22.11601", "OSName/Windows", - "OSVersion/Microsoft.Windows.10.0.14393.", - "Microsoft.Azure.Management.Security.SecurityCenterClient/2.2.0.0" + "OSVersion/Microsoft.Windows.10.0.22000", + "Microsoft.Azure.Management.Security.SecurityCenterClient/3.0.0.0" ] }, "ResponseHeaders": { @@ -31,16 +31,16 @@ "" ], "x-ms-ratelimit-remaining-subscription-resource-requests": [ - "749" + "748" ], "x-ms-request-id": [ - "b29757be-8851-4e85-b5e1-fb7837e6d82d" + "bed5b930-efcc-46c4-ba1c-95db44c25d38" ], "x-ms-correlation-request-id": [ - "b29757be-8851-4e85-b5e1-fb7837e6d82d" + "bed5b930-efcc-46c4-ba1c-95db44c25d38" ], "x-ms-routing-request-id": [ - "UAECENTRAL:20210808T121021Z:b29757be-8851-4e85-b5e1-fb7837e6d82d" + "FRANCESOUTH:20220322T170020Z:bed5b930-efcc-46c4-ba1c-95db44c25d38" ], "Strict-Transport-Security": [ "max-age=31536000; includeSubDomains" @@ -49,7 +49,7 @@ "nosniff" ], "Date": [ - "Sun, 08 Aug 2021 12:10:21 GMT" + "Tue, 22 Mar 2022 17:00:20 GMT" ], "Content-Type": [ "application/json; charset=utf-8" @@ -58,29 +58,29 @@ "-1" ], "Content-Length": [ - "4539" + "45217" ] }, - "ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Security/locations/centralus/alerts/2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"name\": \"2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2021-06-12T19:40:33.8308539Z\",\r\n \"processingEndTimeUtc\": \"2021-06-12T19:40:32.548439Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Azure Security Center\",\r\n \"productComponentName\": \"Storage Accounts\",\r\n \"alertType\": \"Storage.Blob_AnonymousScan.Containers\",\r\n \"startTimeUtc\": \"2021-06-12T18:11:54.456Z\",\r\n \"endTimeUtc\": \"2021-06-12T18:11:54.456Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"correlationKey\": \"eQXuNbERVh6e/t+5e+8g+5PLuHGkeLWBAAjR80eo/KQ=\",\r\n \"intent\": \"Collection\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_1\",\r\n \"azureResourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Storage/storageAccounts/storagefdi4i\",\r\n \"type\": \"AzureResource\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"storagefdi4i\",\r\n \"alertDisplayName\": \"PREVIEW - Anonymous scan of public storage containers\",\r\n \"description\": \"There were 94 failed attempts to anonymously identify publicly accessible containers in your storage account `storagefdi4i`. This might indicate a reconnaissance attack, where the attacker scans your storage account to identify publicly accessible containers and then tries to find sensitive data inside them. In many cases, attackers might successfully access data after a series of failed attempts. It’s therefore important to act on this alert.\",\r\n \"remediationSteps\": [\r\n \"• If public access is not needed for the Azure Storage containers, consider disallowing it on the entire storage account or limiting it selectively on specific containers or blobs (https://docs.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-prevent).\",\r\n \"• We recommend that you always follow the least privilege principle: https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-privileged-access#pa-7-follow-just-enough-administration-least-privilege-principle.\",\r\n \"• To prevent breaches of sensitive data, please review your Azure Storage containers and make sure no sensitive data is stored in them.\",\r\n \"• Consider using identity-based authentication: https://docs.microsoft.com/en-us/azure/storage/files/storage-files-active-directory-overview.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"alert Id\": \"c2e8b810-06f7-4327-9983-5d6949f39929\",\r\n \"azure AD user\": \"N/A (Azure AD authentication was not used)\",\r\n \"user agent\": \"Go-http-client/1.1\",\r\n \"api type\": \"Blob\",\r\n \"client location\": \"N/A\",\r\n \"number of failed access attempts\": \"94\",\r\n \"among the enumeration terms used\": \"app, bin, blog, deploy, confidential, crm, builds, doc, customers, images, attachments, intranet, backups, customer, exports, img, data, blob, downloads, build, azure, export, files, bucket, database, dev, admin, emails, dist, development, documents, debug, assets, cdn, devops, download, backup, code, erp, logs, cache, iso, creds, bak, credentials, config, file, administrator, attachment, exe\",\r\n \"number of containers successfully accessed\": \"0\",\r\n \"list of containers successfully accessed\": \"\",\r\n \"authentication type\": \"Anonymous\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"operations types\": \"GetContainerProperties\",\r\n \"service type\": \"Azure Blobs\",\r\n \"potential causes\": \"\",\r\n \"resourceType\": \"Storage\",\r\n \"killChainIntent\": \"Collection\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_2\",\r\n \"resourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Storage/storageAccounts/storagefdi4i\",\r\n \"type\": \"azure-resource\"\r\n },\r\n {\r\n \"$id\": \"centralus_3\",\r\n \"address\": \"78.46.106.254\",\r\n \"location\": {\r\n \"countryCode\": \"DE\",\r\n \"countryName\": \"Germany\",\r\n \"state\": \"Bayern\",\r\n \"city\": \"Nuernberg\",\r\n \"longitude\": 11.0768,\r\n \"latitude\": 49.452,\r\n \"asn\": 24940\r\n },\r\n \"type\": \"ip\"\r\n },\r\n {\r\n \"$id\": \"centralus_4\",\r\n \"sourceAddress\": {\r\n \"$ref\": \"centralus_3\"\r\n },\r\n \"protocol\": \"Tcp\",\r\n \"type\": \"network-connection\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security/AlertBlade/alertId/2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/iotsimulator/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n }\r\n ]\r\n}", + "ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"name\": \"2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3024741Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:33.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:33.0506048Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_1\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:33\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_2\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29\",\r\n \"name\": \"2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3493253Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:31.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:31.0506048Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_3\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:58:31.0506048Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:31\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_4\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324889493951_5f006e93-566e-4428-a65c-6a2aafbedc29/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70\",\r\n \"name\": \"2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:05.3904646Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:29.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:29.0506048Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_5\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:29\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_6\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324909493951_cc9fef27-7db7-474a-9e43-008806d5ed70/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1\",\r\n \"name\": \"2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:59:07.8905051Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:59:05.0506048Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:58:27.0506048Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:58:27.0506048Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_7\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:58:27\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_8\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543324929493951_30faee2d-1f65-40a8-8d6d-749509d85dd1/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b\",\r\n \"name\": \"2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:14.8746852Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:42.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:42.4544756Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_9\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:42\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_10\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327175455243_784b4ca5-87b0-45e9-8f0a-885b7747043b/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd\",\r\n \"name\": \"2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:15.2706467Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:40.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:40.4544756Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_11\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:54:40.4544756Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:40\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_12\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327195455243_77a44da4-692a-4718-a0f8-2e278403bafd/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a\",\r\n \"name\": \"2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:15.4735382Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:38.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:38.4544756Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_13\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:38\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_14\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327215455243_4280a568-2155-45da-acad-9eeed2cf5f5a/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b\",\r\n \"name\": \"2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:55:14.7779424Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:55:14.4544756Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:36.4544756Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:36.4544756Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_15\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:36\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_16\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327235455243_fddde37c-3055-4265-8c1c-96933db0b89b/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a\",\r\n \"name\": \"2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:35.2107435Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Dismissed\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DeletionAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:02.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:02.2273675Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_17\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual deletion in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual deletion in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\",\r\n \"• Perform an undelete if the delete operation was a soft delete. See how to configure soft deletion and more information: https://go.microsoft.com/fwlink/?linkid=2078042\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the data deletion was intended based on information provided above such as IP address, location and user agent used.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account.\\r\\nPotential causes:\\r\\n• An attacker has deleted data from your storage account.\\r\\n• A legitimate user has performed an unusual deletion.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Wasington_Virginia United States\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"Sample agent\",\r\n \"storage container(s) accessed\": \"SampleContainer\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"DeleteBlob\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:02\",\r\n \"test: Pipeline name\": \"1.0.4656.1_sample\",\r\n \"storage file path(s) deleted\": \"eicarRequestedObjectKeyFilePath1.vhd, eicarRequestedObjectKeyFilePath2.pfx\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_18\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327577726324_8f87c83c-23e2-4ad5-b226-a8cddb84c73a/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208\",\r\n \"name\": \"2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:45.5185723Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_PermissionsChangeAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:54:00.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:54:00.2273675Z\",\r\n \"severity\": \"Medium\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208\",\r\n \"intent\": \"Persistence\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_19\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual change of access permissions in a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has performed an unusual change of access permissions of a container in your Azure storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage container permissions are configured correctly.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"• Confirm whether the storage container permissions change was performed for a legitimate purpose.\\r\\n• Review the storage container's access permissions to make sure they are expected. The permissions can be viewed and updated through the Azure Portal or Azure Storage Explorer.\\r\\n• View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.: https://go.microsoft.com/fwlink/?linkid=2075734\",\r\n \"potential causes\": \"This alert indicates that the access permissions of this storage container have been changed in an unusual way.\\r\\nPotential causes:\\r\\n• An attacker has changed container permissions to weaken its security.\\r\\n• A legitimate user has changed container permissions.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"TestAgent 2022-03-22T16:54:00.2273675Z\",\r\n \"storage container(s) accessed\": \"eicarContainerName\",\r\n \"container\": \"eicarContainerName1, eicarContainerName2\",\r\n \"request status\": \"Success\",\r\n \"activity type\": \"SetContainerACL\",\r\n \"test: Slice start time\": \"03/22/2022 16:54:00\",\r\n \"test: Pipeline name\": \"1.0.4656.1_test\",\r\n \"killChainIntent\": \"Persistence\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_20\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327597726324_dd2d6386-a579-4846-b2e0-4e9dc2a28208/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a\",\r\n \"name\": \"2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:34.5998571Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_TorAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:53:58.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:53:58.2273675Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a\",\r\n \"intent\": \"Probing\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_21\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Access from a Tor exit node to a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has accessed your Azure Storage account 'Sample-Storage' from a suspicious IP address (active Tor exit node).\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that this account has been accessed successfully from an IP address that is known as an active exit node of Tor (an anonymizing proxy). The severity of this alert takes into account the authentication type used (if any), and whether this is the first case of such access. \\r\\nPotential causes:\\r\\n• An attacker has accessed your storage account using Tor.\\r\\n• A legitimate user has accessed your storage account using Tor.\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"test: Slice start time\": \"03/22/2022 16:53:58\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"killChainIntent\": \"Probing\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_22\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327617726324_e372e51e-9f3b-4e92-8dde-204b008aa88a/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/Sample-RG/providers/Microsoft.Security/locations/centralus/alerts/2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200\",\r\n \"name\": \"2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-03-22T16:54:34.9619429Z\",\r\n \"processingEndTimeUtc\": \"2022-03-22T16:54:34.2273675Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"alertType\": \"SIMULATED_Storage.Blob_DataExfiltration.AmountOfDataAnomaly\",\r\n \"startTimeUtc\": \"2022-03-22T16:53:56.2273675Z\",\r\n \"endTimeUtc\": \"2022-03-22T16:53:56.2273675Z\",\r\n \"severity\": \"High\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200\",\r\n \"intent\": \"Exfiltration\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_23\",\r\n \"azureResourceId\": \"/SUBSCRIPTIONS/487bb485-b5b0-471e-9c0d-10717612f869/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Storage/storageAccounts/Sample-Storage\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"Sample-Storage\",\r\n \"alertDisplayName\": \"[SAMPLE ALERT] Unusual amount of data extracted from a storage account\",\r\n \"description\": \"THIS IS A SAMPLE ALERT: Someone has extracted an unusual amount of data from your Azure Storage account 'Sample-Storage'.\",\r\n \"remediationSteps\": [\r\n \"• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2075737.\",\r\n \"• Revoke all storage access tokens that may be compromised and ensure that your access tokens are only shared with authorized users.\",\r\n \"• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"resourceType\": \"Storage\",\r\n \"investigation steps\": \"{\\\"displayValue\\\":\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2075734\\\"}\",\r\n \"potential causes\": \"This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this Storage container.\\r\\nPotential causes:\\r\\n• An attacker has extracted a large amount of data from a Storage container (for example: data exfiltration/breach, unauthorized transfer of data).\\r\\n• A legitimate user or application has extracted an unusual amount of data from a Storage container (for example: maintenance activity).\",\r\n \"client IP address\": \"00.00.00.00\",\r\n \"client location\": \"Azure Data Center: East Us\",\r\n \"authentication type\": \"Anonymous\",\r\n \"operations types\": \"GetBlob\",\r\n \"service type\": \"Azure Blobs\",\r\n \"user agent\": \"dummyAgent\",\r\n \"container\": \"eicarTestStorageContainer\",\r\n \"extracted data\": \"140 MB\",\r\n \"test: Slice start time\": \"03/22/2022 16:53:56\",\r\n \"test: Pipeline name\": \"1.0.4656.1_storagetd-brs-a3\",\r\n \"extracted blobs\": \"500\",\r\n \"killChainIntent\": \"Exfiltration\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_24\",\r\n \"address\": \"00.00.00.00\",\r\n \"location\": {\r\n \"countryName\": \"United States\",\r\n \"city\": \"Washington\"\r\n },\r\n \"type\": \"ip\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517543327637726324_88d64184-a858-413c-bd1d-02714ceb1200/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n },\r\n {\r\n \"id\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Security/locations/centralus/alerts/2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874\",\r\n \"name\": \"2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874\",\r\n \"type\": \"Microsoft.Security/Locations/alerts\",\r\n \"properties\": {\r\n \"timeGeneratedUtc\": \"2022-01-23T00:55:20.7163645Z\",\r\n \"processingEndTimeUtc\": \"2022-01-23T00:55:15.3028632Z\",\r\n \"status\": \"Active\",\r\n \"vendorName\": \"Microsoft\",\r\n \"productName\": \"Microsoft Defender for Cloud\",\r\n \"productComponentName\": \"App Services\",\r\n \"alertType\": \"AppServices_Nmap\",\r\n \"startTimeUtc\": \"2022-01-22T23:21:29.978Z\",\r\n \"endTimeUtc\": \"2022-01-22T23:21:29.978Z\",\r\n \"severity\": \"Low\",\r\n \"isIncident\": false,\r\n \"systemAlertId\": \"2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874\",\r\n \"intent\": \"PreAttack\",\r\n \"resourceIdentifiers\": [\r\n {\r\n \"$id\": \"centralus_25\",\r\n \"azureResourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Web/sites/iotSimulator-fdi4i\",\r\n \"type\": \"AzureResource\",\r\n \"azureResourceTenantId\": \"72f988bf-86f1-41af-91ab-2d7cd011db47\"\r\n }\r\n ],\r\n \"compromisedEntity\": \"iotSimulator-fdi4i\",\r\n \"alertDisplayName\": \"Web fingerprinting detected\",\r\n \"description\": \"Azure App Service activity log indicates a possible web fingerprinting activity on your App Service resource.\\r\\nThe suspicious activity detected is associated with NMAP. Attackers often use this tool for probing the web application to find vulnerabilities.\",\r\n \"remediationSteps\": [\r\n \"If only specific IP addresses should be allowed to access the web app, set IP restrictions (https://docs.microsoft.com/azure/app-service/app-service-ip-restrictions) for it.\"\r\n ],\r\n \"extendedProperties\": {\r\n \"sample URIs\": \"/\",\r\n \"sample Source IP Addresses\": \"122.235.84.213\",\r\n \"sample User Agents\": \"Mozilla/5.0+(compatible;+Nmap+Scripting+Engine;+https://nmap.org/book/nse.html)\",\r\n \"sample Referer\": \"-\",\r\n \"resourceType\": \"App Service\",\r\n \"killChainIntent\": \"PreAttack\"\r\n },\r\n \"entities\": [\r\n {\r\n \"$id\": \"centralus_26\",\r\n \"resourceId\": \"/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroups/iotsimulator/providers/Microsoft.Web/sites/iotSimulator-fdi4i\",\r\n \"type\": \"azure-resource\"\r\n },\r\n {\r\n \"$id\": \"centralus_27\",\r\n \"address\": \"122.235.84.213\",\r\n \"location\": {\r\n \"countryCode\": \"CN\",\r\n \"countryName\": \"China\",\r\n \"state\": \"Zhejiang\",\r\n \"city\": \"Hangzhou\",\r\n \"longitude\": 120.15889,\r\n \"latitude\": 30.23556,\r\n \"asn\": 4134\r\n },\r\n \"type\": \"ip\"\r\n },\r\n {\r\n \"$id\": \"centralus_28\",\r\n \"sourceAddress\": {\r\n \"$ref\": \"centralus_27\"\r\n },\r\n \"type\": \"network-connection\"\r\n }\r\n ],\r\n \"alertUri\": \"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517594071100219999_2f02f93b-8545-4263-88f4-3e314d7f5874/subscriptionId/487bb485-b5b0-471e-9c0d-10717612f869/resourceGroup/iotsimulator/referencedFrom/alertDeepLink/location/centralus\"\r\n }\r\n }\r\n ]\r\n}", "StatusCode": 200 }, { - "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/locations/centralus/alerts/2517787792855439999_c2e8b810-06f7-4327-9983-5d6949f39929/dismiss?api-version=2021-01-01", - "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvbG9jYXRpb25zL2NlbnRyYWx1cy9hbGVydHMvMjUxNzc4Nzc5Mjg1NTQzOTk5OV9jMmU4YjgxMC0wNmY3LTQzMjctOTk4My01ZDY5NDlmMzk5MjkvZGlzbWlzcz9hcGktdmVyc2lvbj0yMDIxLTAxLTAx", + "RequestUri": "/subscriptions/487bb485-b5b0-471e-9c0d-10717612f869/providers/Microsoft.Security/locations/centralus/alerts/2517543324869493951_aa6a7422-3438-4b28-abf8-6869af5abcd7/dismiss?api-version=2021-11-01", + "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvNDg3YmI0ODUtYjViMC00NzFlLTljMGQtMTA3MTc2MTJmODY5L3Byb3ZpZGVycy9NaWNyb3NvZnQuU2VjdXJpdHkvbG9jYXRpb25zL2NlbnRyYWx1cy9hbGVydHMvMjUxNzU0MzMyNDg2OTQ5Mzk1MV9hYTZhNzQyMi0zNDM4LTRiMjgtYWJmOC02ODY5YWY1YWJjZDcvZGlzbWlzcz9hcGktdmVyc2lvbj0yMDIxLTExLTAx", "RequestMethod": "POST", "RequestBody": "", "RequestHeaders": { "x-ms-client-request-id": [ - "9a9bfffd-7be3-4af1-8e8b-2e1bc87e4987" + "5c7dc771-13a8-4db7-87a4-0d9f459c4bc5" ], "Accept-Language": [ "en-US" ], "User-Agent": [ - "FxVersion/4.6.30015.01", + "FxVersion/4.700.22.11601", "OSName/Windows", - "OSVersion/Microsoft.Windows.10.0.14393.", - "Microsoft.Azure.Management.Security.SecurityCenterClient/2.2.0.0" + "OSVersion/Microsoft.Windows.10.0.22000", + "Microsoft.Azure.Management.Security.SecurityCenterClient/3.0.0.0" ] }, "ResponseHeaders": { @@ -100,25 +100,22 @@ "1199" ], "x-ms-request-id": [ - "d1b7ca1d-031d-4998-9705-a1a8457e7ee1" + "dba23082-60f9-445a-9ab9-dfd4fad99bfb" ], "x-ms-correlation-request-id": [ - "d1b7ca1d-031d-4998-9705-a1a8457e7ee1" + "dba23082-60f9-445a-9ab9-dfd4fad99bfb" ], "x-ms-routing-request-id": [ - "UAECENTRAL:20210808T121022Z:d1b7ca1d-031d-4998-9705-a1a8457e7ee1" + "FRANCESOUTH:20220322T170021Z:dba23082-60f9-445a-9ab9-dfd4fad99bfb" ], "X-Content-Type-Options": [ "nosniff" ], "Date": [ - "Sun, 08 Aug 2021 12:10:22 GMT" + "Tue, 22 Mar 2022 17:00:20 GMT" ], "Expires": [ "-1" - ], - "Content-Length": [ - "0" ] }, "ResponseBody": "", diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Settings/SettingsTests.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Settings/SettingsTests.cs index f7f3793c70d8..f894d6faba30 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Settings/SettingsTests.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Settings/SettingsTests.cs @@ -35,8 +35,6 @@ private static SecurityCenterClient GetSecurityCenterClient(MockContext context) ? context.GetServiceClient(TestEnvironment, handlers: handler) : context.GetServiceClient(handlers: handler); - securityCenterClient.AscLocation = "centralus"; - return securityCenterClient; } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SubAssessment/SubAssessmentTests.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SubAssessment/SubAssessmentTests.cs index 72f2b00f0b4d..8064b37e845e 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SubAssessment/SubAssessmentTests.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/SubAssessment/SubAssessmentTests.cs @@ -23,7 +23,6 @@ public class SubAssessmentTests : TestBase private static readonly string AssessmentName = "dbd0cb49-b563-45e7-9724-889e799fa648"; // auto-generated private static readonly string SubAssessmentName = "d1164a35-41e9-43aa-bbc7-bfb3ae093cea"; - private static readonly string AscLocation = "centralus"; private static TestEnvironment TestEnvironment { get; set; } #endregion @@ -40,8 +39,6 @@ private static SecurityCenterClient GetSecurityCenterClient(MockContext context) ? context.GetServiceClient(TestEnvironment, handlers: handler) : context.GetServiceClient(handlers: handler); - securityCenterClient.AscLocation = AscLocation; - return securityCenterClient; } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Tasks/SecurityTasksTests.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Tasks/SecurityTasksTests.cs index 2c9fcd666823..c2ffb2203b11 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Tasks/SecurityTasksTests.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Tasks/SecurityTasksTests.cs @@ -19,6 +19,8 @@ public class SecurityTasksTests : TestBase public static TestEnvironment TestEnvironment { get; private set; } + private const string _ascLocation = "centralus"; + private static SecurityCenterClient GetSecurityCenterClient(MockContext context) { if (TestEnvironment == null && HttpMockServer.Mode == HttpRecorderMode.Record) @@ -32,8 +34,6 @@ private static SecurityCenterClient GetSecurityCenterClient(MockContext context) ? context.GetServiceClient(TestEnvironment, handlers: handler) : context.GetServiceClient(handlers: handler); - securityCenterClient.AscLocation = "centralus"; - return securityCenterClient; } @@ -58,7 +58,7 @@ public void SecurityTaskRecommendations_GetResourceGroupLevelTask() using (var context = MockContext.Start(this.GetType())) { var securityCenterClient = GetSecurityCenterClient(context); - var recommendation = securityCenterClient.Tasks.GetResourceGroupLevelTask("myService1", "dcfb6365-799e-5ed4-f344-d86a0a4c2992"); + var recommendation = securityCenterClient.Tasks.GetResourceGroupLevelTask("myService1", _ascLocation, "dcfb6365-799e-5ed4-f344-d86a0a4c2992"); ValidateTask(recommendation); } } @@ -69,7 +69,7 @@ public void SecurityTaskRecommendations_GetSubscriptionLevelTask() using (var context = MockContext.Start(this.GetType())) { var securityCenterClient = GetSecurityCenterClient(context); - var recommendation = securityCenterClient.Tasks.GetSubscriptionLevelTask("08357a1e-c534-756f-cbb9-7b45e73f3137"); + var recommendation = securityCenterClient.Tasks.GetSubscriptionLevelTask(_ascLocation, "08357a1e-c534-756f-cbb9-7b45e73f3137"); ValidateTask(recommendation); } } @@ -80,7 +80,7 @@ public void SecurityTaskRecommendations_ListByHomeRegion() using (var context = MockContext.Start(this.GetType())) { var securityCenterClient = GetSecurityCenterClient(context); - var recommendations = securityCenterClient.Tasks.ListByHomeRegion(); + var recommendations = securityCenterClient.Tasks.ListByHomeRegion(_ascLocation); ValidateTasks(recommendations); } } @@ -91,7 +91,7 @@ public void SecurityTaskRecommendations_ListByResourceGroup() using (var context = MockContext.Start(this.GetType())) { var securityCenterClient = GetSecurityCenterClient(context); - var recommendations = securityCenterClient.Tasks.ListByResourceGroup("myService1"); + var recommendations = securityCenterClient.Tasks.ListByResourceGroup("myService1", _ascLocation); ValidateTasks(recommendations); } } @@ -102,7 +102,7 @@ public void SecurityTaskRecommendations_UpdateResourceGroupLevelTask() using (var context = MockContext.Start(this.GetType())) { var securityCenterClient = GetSecurityCenterClient(context); - securityCenterClient.Tasks.UpdateResourceGroupLevelTaskState("myService1", "dcfb6365-799e-5ed4-f344-d86a0a4c2992", "Dismiss"); + securityCenterClient.Tasks.UpdateResourceGroupLevelTaskState("myService1", _ascLocation, "dcfb6365-799e-5ed4-f344-d86a0a4c2992", "Dismiss"); } } @@ -112,7 +112,7 @@ public void SecurityTaskRecommendations_UpdateSubscriptionLevelTask() using (var context = MockContext.Start(this.GetType())) { var securityCenterClient = GetSecurityCenterClient(context); - securityCenterClient.Tasks.UpdateSubscriptionLevelTaskState("08357a1e-c534-756f-cbb9-7b45e73f3137", "Dismiss"); + securityCenterClient.Tasks.UpdateSubscriptionLevelTaskState(_ascLocation, "08357a1e-c534-756f-cbb9-7b45e73f3137", "Dismiss"); } } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Topology/TopologyTests.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Topology/TopologyTests.cs index dd696b347658..2254b5fc36ec 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Topology/TopologyTests.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/Topology/TopologyTests.cs @@ -15,6 +15,8 @@ public class TopologyTests : TestBase public static TestEnvironment TestEnvironment { get; private set; } + private const string _ascLocation = "westcentralus"; + private static SecurityCenterClient GetSecurityCenterClient(MockContext context) { if (TestEnvironment == null && HttpMockServer.Mode == HttpRecorderMode.Record) @@ -28,8 +30,6 @@ private static SecurityCenterClient GetSecurityCenterClient(MockContext context) ? context.GetServiceClient(TestEnvironment, handlers: handler) : context.GetServiceClient(handlers: handler); - securityCenterClient.AscLocation = "westcentralus"; - return securityCenterClient; } @@ -53,7 +53,7 @@ public void Topology_Get() using (var context = MockContext.Start(this.GetType())) { var securityCenterClient = GetSecurityCenterClient(context); - var topologyResource = securityCenterClient.Topology.Get("MyResourceGroup", "virtualNetworks"); + var topologyResource = securityCenterClient.Topology.Get("MyResourceGroup", _ascLocation, "virtualNetworks"); ValidateTopologyResource(topologyResource); } } diff --git a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/WorkspaceSettings/WorkspaceSettingsTests.cs b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/WorkspaceSettings/WorkspaceSettingsTests.cs index 7164824f031d..7657da58129f 100644 --- a/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/WorkspaceSettings/WorkspaceSettingsTests.cs +++ b/sdk/securitycenter/Microsoft.Azure.Management.SecurityCenter/tests/WorkspaceSettings/WorkspaceSettingsTests.cs @@ -31,8 +31,6 @@ private static SecurityCenterClient GetSecurityCenterClient(MockContext context) ? context.GetServiceClient(TestEnvironment, handlers: handler) : context.GetServiceClient(handlers: handler); - securityCenterClient.AscLocation = "centralus"; - return securityCenterClient; }