diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/__init__.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/__init__.py
index dbbee8f50d97..dc4d700298d4 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/__init__.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/__init__.py
@@ -22,12 +22,12 @@
     from .alert_rule_py3 import AlertRule
     from .alert_rule_kind1_py3 import AlertRuleKind1
     from .alert_rule_template_py3 import AlertRuleTemplate
+    from .data_connector_status_py3 import DataConnectorStatus
+    from .alert_rule_template_properties_base_py3 import AlertRuleTemplatePropertiesBase
     from .aws_cloud_trail_data_connector_data_types_logs_py3 import AwsCloudTrailDataConnectorDataTypesLogs
     from .aws_cloud_trail_data_connector_data_types_py3 import AwsCloudTrailDataConnectorDataTypes
     from .aws_cloud_trail_data_connector_py3 import AwsCloudTrailDataConnector
     from .azure_resource_entity_py3 import AzureResourceEntity
-    from .data_connector_status_py3 import DataConnectorStatus
-    from .base_alert_rule_template_properties_py3 import BaseAlertRuleTemplateProperties
     from .user_info_py3 import UserInfo
     from .bookmark_py3 import Bookmark
     from .case_py3 import Case
@@ -53,10 +53,8 @@
     from .entity_query_py3 import EntityQuery
     from .file_entity_py3 import FileEntity
     from .file_hash_entity_py3 import FileHashEntity
-    from .filter_alert_rule_template_py3 import FilterAlertRuleTemplate
-    from .filter_alert_rule_template_properties_model_py3 import FilterAlertRuleTemplatePropertiesModel
+    from .fusion_alert_rule_py3 import FusionAlertRule
     from .fusion_alert_rule_template_py3 import FusionAlertRuleTemplate
-    from .fusion_alert_rule_template_properties_model_py3 import FusionAlertRuleTemplatePropertiesModel
     from .geo_location_py3 import GeoLocation
     from .host_entity_py3 import HostEntity
     from .threat_intelligence_py3 import ThreatIntelligence
@@ -66,6 +64,9 @@
     from .mcas_data_connector_py3 import MCASDataConnector
     from .mdatp_data_connector_py3 import MDATPDataConnector
     from .malware_entity_py3 import MalwareEntity
+    from .microsoft_security_incident_creation_alert_rule_py3 import MicrosoftSecurityIncidentCreationAlertRule
+    from .microsoft_security_incident_creation_alert_rule_common_properties_py3 import MicrosoftSecurityIncidentCreationAlertRuleCommonProperties
+    from .microsoft_security_incident_creation_alert_rule_template_py3 import MicrosoftSecurityIncidentCreationAlertRuleTemplate
     from .office_consent_py3 import OfficeConsent
     from .office_data_connector_data_types_exchange_py3 import OfficeDataConnectorDataTypesExchange
     from .office_data_connector_data_types_share_point_py3 import OfficeDataConnectorDataTypesSharePoint
@@ -77,9 +78,10 @@
     from .registry_key_entity_py3 import RegistryKeyEntity
     from .registry_value_entity_py3 import RegistryValueEntity
     from .resource_py3 import Resource
+    from .resource_with_etag_py3 import ResourceWithEtag
     from .scheduled_alert_rule_py3 import ScheduledAlertRule
+    from .scheduled_alert_rule_common_properties_py3 import ScheduledAlertRuleCommonProperties
     from .scheduled_alert_rule_template_py3 import ScheduledAlertRuleTemplate
-    from .scheduled_alert_rule_template_properties_model_py3 import ScheduledAlertRuleTemplatePropertiesModel
     from .security_alert_properties_confidence_reasons_item_py3 import SecurityAlertPropertiesConfidenceReasonsItem
     from .security_alert_py3 import SecurityAlert
     from .security_group_entity_py3 import SecurityGroupEntity
@@ -104,12 +106,12 @@
     from .alert_rule import AlertRule
     from .alert_rule_kind1 import AlertRuleKind1
     from .alert_rule_template import AlertRuleTemplate
+    from .data_connector_status import DataConnectorStatus
+    from .alert_rule_template_properties_base import AlertRuleTemplatePropertiesBase
     from .aws_cloud_trail_data_connector_data_types_logs import AwsCloudTrailDataConnectorDataTypesLogs
     from .aws_cloud_trail_data_connector_data_types import AwsCloudTrailDataConnectorDataTypes
     from .aws_cloud_trail_data_connector import AwsCloudTrailDataConnector
     from .azure_resource_entity import AzureResourceEntity
-    from .data_connector_status import DataConnectorStatus
-    from .base_alert_rule_template_properties import BaseAlertRuleTemplateProperties
     from .user_info import UserInfo
     from .bookmark import Bookmark
     from .case import Case
@@ -135,10 +137,8 @@
     from .entity_query import EntityQuery
     from .file_entity import FileEntity
     from .file_hash_entity import FileHashEntity
-    from .filter_alert_rule_template import FilterAlertRuleTemplate
-    from .filter_alert_rule_template_properties_model import FilterAlertRuleTemplatePropertiesModel
+    from .fusion_alert_rule import FusionAlertRule
     from .fusion_alert_rule_template import FusionAlertRuleTemplate
-    from .fusion_alert_rule_template_properties_model import FusionAlertRuleTemplatePropertiesModel
     from .geo_location import GeoLocation
     from .host_entity import HostEntity
     from .threat_intelligence import ThreatIntelligence
@@ -148,6 +148,9 @@
     from .mcas_data_connector import MCASDataConnector
     from .mdatp_data_connector import MDATPDataConnector
     from .malware_entity import MalwareEntity
+    from .microsoft_security_incident_creation_alert_rule import MicrosoftSecurityIncidentCreationAlertRule
+    from .microsoft_security_incident_creation_alert_rule_common_properties import MicrosoftSecurityIncidentCreationAlertRuleCommonProperties
+    from .microsoft_security_incident_creation_alert_rule_template import MicrosoftSecurityIncidentCreationAlertRuleTemplate
     from .office_consent import OfficeConsent
     from .office_data_connector_data_types_exchange import OfficeDataConnectorDataTypesExchange
     from .office_data_connector_data_types_share_point import OfficeDataConnectorDataTypesSharePoint
@@ -159,9 +162,10 @@
     from .registry_key_entity import RegistryKeyEntity
     from .registry_value_entity import RegistryValueEntity
     from .resource import Resource
+    from .resource_with_etag import ResourceWithEtag
     from .scheduled_alert_rule import ScheduledAlertRule
+    from .scheduled_alert_rule_common_properties import ScheduledAlertRuleCommonProperties
     from .scheduled_alert_rule_template import ScheduledAlertRuleTemplate
-    from .scheduled_alert_rule_template_properties_model import ScheduledAlertRuleTemplatePropertiesModel
     from .security_alert_properties_confidence_reasons_item import SecurityAlertPropertiesConfidenceReasonsItem
     from .security_alert import SecurityAlert
     from .security_group_entity import SecurityGroupEntity
@@ -187,11 +191,11 @@
 from .security_insights_enums import (
     AggregationsKind,
     AlertRuleKind,
-    TriggerOperator,
-    AlertSeverity,
-    AttackTactic,
     DataTypeStatus,
     TemplateStatus,
+    AttackTactic,
+    TriggerOperator,
+    AlertSeverity,
     CloseReason,
     CaseSeverity,
     CaseStatus,
@@ -201,6 +205,7 @@
     EntityType,
     FileHashAlgorithm,
     OSFamily,
+    MicrosoftSecurityProductName,
     ElevationToken,
     RegistryHive,
     RegistryValueKind,
@@ -226,12 +231,12 @@
     'AlertRule',
     'AlertRuleKind1',
     'AlertRuleTemplate',
+    'DataConnectorStatus',
+    'AlertRuleTemplatePropertiesBase',
     'AwsCloudTrailDataConnectorDataTypesLogs',
     'AwsCloudTrailDataConnectorDataTypes',
     'AwsCloudTrailDataConnector',
     'AzureResourceEntity',
-    'DataConnectorStatus',
-    'BaseAlertRuleTemplateProperties',
     'UserInfo',
     'Bookmark',
     'Case',
@@ -257,10 +262,8 @@
     'EntityQuery',
     'FileEntity',
     'FileHashEntity',
-    'FilterAlertRuleTemplate',
-    'FilterAlertRuleTemplatePropertiesModel',
+    'FusionAlertRule',
     'FusionAlertRuleTemplate',
-    'FusionAlertRuleTemplatePropertiesModel',
     'GeoLocation',
     'HostEntity',
     'ThreatIntelligence',
@@ -270,6 +273,9 @@
     'MCASDataConnector',
     'MDATPDataConnector',
     'MalwareEntity',
+    'MicrosoftSecurityIncidentCreationAlertRule',
+    'MicrosoftSecurityIncidentCreationAlertRuleCommonProperties',
+    'MicrosoftSecurityIncidentCreationAlertRuleTemplate',
     'OfficeConsent',
     'OfficeDataConnectorDataTypesExchange',
     'OfficeDataConnectorDataTypesSharePoint',
@@ -281,9 +287,10 @@
     'RegistryKeyEntity',
     'RegistryValueEntity',
     'Resource',
+    'ResourceWithEtag',
     'ScheduledAlertRule',
+    'ScheduledAlertRuleCommonProperties',
     'ScheduledAlertRuleTemplate',
-    'ScheduledAlertRuleTemplatePropertiesModel',
     'SecurityAlertPropertiesConfidenceReasonsItem',
     'SecurityAlert',
     'SecurityGroupEntity',
@@ -308,11 +315,11 @@
     'EntityQueryPaged',
     'AggregationsKind',
     'AlertRuleKind',
-    'TriggerOperator',
-    'AlertSeverity',
-    'AttackTactic',
     'DataTypeStatus',
     'TemplateStatus',
+    'AttackTactic',
+    'TriggerOperator',
+    'AlertSeverity',
     'CloseReason',
     'CaseSeverity',
     'CaseStatus',
@@ -322,6 +329,7 @@
     'EntityType',
     'FileHashAlgorithm',
     'OSFamily',
+    'MicrosoftSecurityProductName',
     'ElevationToken',
     'RegistryHive',
     'RegistryValueKind',
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/aad_data_connector.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/aad_data_connector.py
index c742eab7851d..206e18f4df13 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/aad_data_connector.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/aad_data_connector.py
@@ -15,18 +15,9 @@
 class AADDataConnector(DataConnector):
     """Represents AAD (Azure Active Directory) data connector.
 
-    Variables are only populated by the server, and will be ignored when
-    sending a request.
-
     All required parameters must be populated in order to send to Azure.
 
-    :ivar id: Azure resource Id
-    :vartype id: str
-    :ivar name: Azure resource name
-    :vartype name: str
-    :ivar type: Azure resource type
-    :vartype type: str
-    :param etag: Etag of the data connector.
+    :param etag: Etag of the azure resource
     :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
@@ -38,16 +29,10 @@ class AADDataConnector(DataConnector):
     """
 
     _validation = {
-        'id': {'readonly': True},
-        'name': {'readonly': True},
-        'type': {'readonly': True},
         'kind': {'required': True},
     }
 
     _attribute_map = {
-        'id': {'key': 'id', 'type': 'str'},
-        'name': {'key': 'name', 'type': 'str'},
-        'type': {'key': 'type', 'type': 'str'},
         'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
         'tenant_id': {'key': 'properties.tenantId', 'type': 'str'},
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/aad_data_connector_py3.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/aad_data_connector_py3.py
index 6cba1a9e8e22..7c09c7a31c74 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/aad_data_connector_py3.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/aad_data_connector_py3.py
@@ -15,18 +15,9 @@
 class AADDataConnector(DataConnector):
     """Represents AAD (Azure Active Directory) data connector.
 
-    Variables are only populated by the server, and will be ignored when
-    sending a request.
-
     All required parameters must be populated in order to send to Azure.
 
-    :ivar id: Azure resource Id
-    :vartype id: str
-    :ivar name: Azure resource name
-    :vartype name: str
-    :ivar type: Azure resource type
-    :vartype type: str
-    :param etag: Etag of the data connector.
+    :param etag: Etag of the azure resource
     :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
@@ -38,16 +29,10 @@ class AADDataConnector(DataConnector):
     """
 
     _validation = {
-        'id': {'readonly': True},
-        'name': {'readonly': True},
-        'type': {'readonly': True},
         'kind': {'required': True},
     }
 
     _attribute_map = {
-        'id': {'key': 'id', 'type': 'str'},
-        'name': {'key': 'name', 'type': 'str'},
-        'type': {'key': 'type', 'type': 'str'},
         'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
         'tenant_id': {'key': 'properties.tenantId', 'type': 'str'},
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/aatp_data_connector.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/aatp_data_connector.py
index 184bb73bcad5..d4b2cbf36ac4 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/aatp_data_connector.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/aatp_data_connector.py
@@ -15,18 +15,9 @@
 class AATPDataConnector(DataConnector):
     """Represents AATP (Azure Advanced Threat Protection) data connector.
 
-    Variables are only populated by the server, and will be ignored when
-    sending a request.
-
     All required parameters must be populated in order to send to Azure.
 
-    :ivar id: Azure resource Id
-    :vartype id: str
-    :ivar name: Azure resource name
-    :vartype name: str
-    :ivar type: Azure resource type
-    :vartype type: str
-    :param etag: Etag of the data connector.
+    :param etag: Etag of the azure resource
     :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
@@ -38,16 +29,10 @@ class AATPDataConnector(DataConnector):
     """
 
     _validation = {
-        'id': {'readonly': True},
-        'name': {'readonly': True},
-        'type': {'readonly': True},
         'kind': {'required': True},
     }
 
     _attribute_map = {
-        'id': {'key': 'id', 'type': 'str'},
-        'name': {'key': 'name', 'type': 'str'},
-        'type': {'key': 'type', 'type': 'str'},
         'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
         'tenant_id': {'key': 'properties.tenantId', 'type': 'str'},
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/aatp_data_connector_py3.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/aatp_data_connector_py3.py
index 74627fa1fadd..260b6325ac05 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/aatp_data_connector_py3.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/aatp_data_connector_py3.py
@@ -15,18 +15,9 @@
 class AATPDataConnector(DataConnector):
     """Represents AATP (Azure Advanced Threat Protection) data connector.
 
-    Variables are only populated by the server, and will be ignored when
-    sending a request.
-
     All required parameters must be populated in order to send to Azure.
 
-    :ivar id: Azure resource Id
-    :vartype id: str
-    :ivar name: Azure resource name
-    :vartype name: str
-    :ivar type: Azure resource type
-    :vartype type: str
-    :param etag: Etag of the data connector.
+    :param etag: Etag of the azure resource
     :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
@@ -38,16 +29,10 @@ class AATPDataConnector(DataConnector):
     """
 
     _validation = {
-        'id': {'readonly': True},
-        'name': {'readonly': True},
-        'type': {'readonly': True},
         'kind': {'required': True},
     }
 
     _attribute_map = {
-        'id': {'key': 'id', 'type': 'str'},
-        'name': {'key': 'name', 'type': 'str'},
-        'type': {'key': 'type', 'type': 'str'},
         'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
         'tenant_id': {'key': 'properties.tenantId', 'type': 'str'},
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/action.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/action.py
index a0cbebe8700b..c4f388ec15c6 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/action.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/action.py
@@ -9,10 +9,10 @@
 # regenerated.
 # --------------------------------------------------------------------------
 
-from .resource import Resource
+from .resource_with_etag import ResourceWithEtag
 
 
-class Action(Resource):
+class Action(ResourceWithEtag):
     """Action for alert rule.
 
     Variables are only populated by the server, and will be ignored when
@@ -24,7 +24,7 @@ class Action(Resource):
     :vartype name: str
     :ivar type: Azure resource type
     :vartype type: str
-    :param etag: Etag of the action.
+    :param etag: Etag of the azure resource
     :type etag: str
     :param trigger_uri: The uri for the action to trigger.
     :type trigger_uri: str
@@ -46,5 +46,4 @@ class Action(Resource):
 
     def __init__(self, **kwargs):
         super(Action, self).__init__(**kwargs)
-        self.etag = kwargs.get('etag', None)
         self.trigger_uri = kwargs.get('trigger_uri', None)
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/action_py3.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/action_py3.py
index 00ff54308beb..6f9ead30890c 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/action_py3.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/action_py3.py
@@ -9,10 +9,10 @@
 # regenerated.
 # --------------------------------------------------------------------------
 
-from .resource_py3 import Resource
+from .resource_with_etag_py3 import ResourceWithEtag
 
 
-class Action(Resource):
+class Action(ResourceWithEtag):
     """Action for alert rule.
 
     Variables are only populated by the server, and will be ignored when
@@ -24,7 +24,7 @@ class Action(Resource):
     :vartype name: str
     :ivar type: Azure resource type
     :vartype type: str
-    :param etag: Etag of the action.
+    :param etag: Etag of the azure resource
     :type etag: str
     :param trigger_uri: The uri for the action to trigger.
     :type trigger_uri: str
@@ -45,6 +45,5 @@ class Action(Resource):
     }
 
     def __init__(self, *, etag: str=None, trigger_uri: str=None, **kwargs) -> None:
-        super(Action, self).__init__(**kwargs)
-        self.etag = etag
+        super(Action, self).__init__(etag=etag, **kwargs)
         self.trigger_uri = trigger_uri
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/alert_rule.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/alert_rule.py
index 51789552f410..75aa1a8a0c0c 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/alert_rule.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/alert_rule.py
@@ -16,48 +16,31 @@ class AlertRule(Model):
     """Alert rule.
 
     You probably want to use the sub-classes and not this class directly. Known
-    sub-classes are: ScheduledAlertRule
-
-    Variables are only populated by the server, and will be ignored when
-    sending a request.
+    sub-classes are: FusionAlertRule,
+    MicrosoftSecurityIncidentCreationAlertRule, ScheduledAlertRule
 
     All required parameters must be populated in order to send to Azure.
 
-    :ivar id: Azure resource Id
-    :vartype id: str
-    :ivar name: Azure resource name
-    :vartype name: str
-    :ivar type: Azure resource type
-    :vartype type: str
-    :param etag: Etag of the alert rule.
+    :param etag: Etag of the azure resource
     :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
     """
 
     _validation = {
-        'id': {'readonly': True},
-        'name': {'readonly': True},
-        'type': {'readonly': True},
         'kind': {'required': True},
     }
 
     _attribute_map = {
-        'id': {'key': 'id', 'type': 'str'},
-        'name': {'key': 'name', 'type': 'str'},
-        'type': {'key': 'type', 'type': 'str'},
         'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
     }
 
     _subtype_map = {
-        'kind': {'Scheduled': 'ScheduledAlertRule'}
+        'kind': {'Fusion': 'FusionAlertRule', 'MicrosoftSecurityIncidentCreation': 'MicrosoftSecurityIncidentCreationAlertRule', 'Scheduled': 'ScheduledAlertRule'}
     }
 
     def __init__(self, **kwargs):
         super(AlertRule, self).__init__(**kwargs)
-        self.id = None
-        self.name = None
-        self.type = None
         self.etag = kwargs.get('etag', None)
         self.kind = None
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/alert_rule_kind1.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/alert_rule_kind1.py
index d21e590eef6b..48e8f32ddd63 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/alert_rule_kind1.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/alert_rule_kind1.py
@@ -16,7 +16,7 @@ class AlertRuleKind1(Model):
     """Describes an Azure resource with kind.
 
     :param kind: The kind of the alert rule. Possible values include:
-     'Scheduled', 'Filter', 'Fusion'
+     'Scheduled', 'MicrosoftSecurityIncidentCreation', 'Fusion'
     :type kind: str or ~azure.mgmt.securityinsight.models.AlertRuleKind
     """
 
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/alert_rule_kind1_py3.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/alert_rule_kind1_py3.py
index 42357df49b41..791ade71fbec 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/alert_rule_kind1_py3.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/alert_rule_kind1_py3.py
@@ -16,7 +16,7 @@ class AlertRuleKind1(Model):
     """Describes an Azure resource with kind.
 
     :param kind: The kind of the alert rule. Possible values include:
-     'Scheduled', 'Filter', 'Fusion'
+     'Scheduled', 'MicrosoftSecurityIncidentCreation', 'Fusion'
     :type kind: str or ~azure.mgmt.securityinsight.models.AlertRuleKind
     """
 
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/alert_rule_py3.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/alert_rule_py3.py
index 25b5d8606705..0ae295ff2c32 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/alert_rule_py3.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/alert_rule_py3.py
@@ -16,48 +16,31 @@ class AlertRule(Model):
     """Alert rule.
 
     You probably want to use the sub-classes and not this class directly. Known
-    sub-classes are: ScheduledAlertRule
-
-    Variables are only populated by the server, and will be ignored when
-    sending a request.
+    sub-classes are: FusionAlertRule,
+    MicrosoftSecurityIncidentCreationAlertRule, ScheduledAlertRule
 
     All required parameters must be populated in order to send to Azure.
 
-    :ivar id: Azure resource Id
-    :vartype id: str
-    :ivar name: Azure resource name
-    :vartype name: str
-    :ivar type: Azure resource type
-    :vartype type: str
-    :param etag: Etag of the alert rule.
+    :param etag: Etag of the azure resource
     :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
     """
 
     _validation = {
-        'id': {'readonly': True},
-        'name': {'readonly': True},
-        'type': {'readonly': True},
         'kind': {'required': True},
     }
 
     _attribute_map = {
-        'id': {'key': 'id', 'type': 'str'},
-        'name': {'key': 'name', 'type': 'str'},
-        'type': {'key': 'type', 'type': 'str'},
         'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
     }
 
     _subtype_map = {
-        'kind': {'Scheduled': 'ScheduledAlertRule'}
+        'kind': {'Fusion': 'FusionAlertRule', 'MicrosoftSecurityIncidentCreation': 'MicrosoftSecurityIncidentCreationAlertRule', 'Scheduled': 'ScheduledAlertRule'}
     }
 
     def __init__(self, *, etag: str=None, **kwargs) -> None:
         super(AlertRule, self).__init__(**kwargs)
-        self.id = None
-        self.name = None
-        self.type = None
         self.etag = etag
         self.kind = None
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/alert_rule_template.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/alert_rule_template.py
index 1b4ad33cd296..c909aec1d6b0 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/alert_rule_template.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/alert_rule_template.py
@@ -16,7 +16,8 @@ class AlertRuleTemplate(Model):
     """Alert rule template.
 
     You probably want to use the sub-classes and not this class directly. Known
-    sub-classes are: FilterAlertRuleTemplate, FusionAlertRuleTemplate,
+    sub-classes are: FusionAlertRuleTemplate,
+    MicrosoftSecurityIncidentCreationAlertRuleTemplate,
     ScheduledAlertRuleTemplate
 
     Variables are only populated by the server, and will be ignored when
@@ -30,8 +31,6 @@ class AlertRuleTemplate(Model):
     :vartype name: str
     :ivar type: Azure resource type
     :vartype type: str
-    :param etag: Etag of the alert rule.
-    :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
     """
@@ -47,12 +46,11 @@ class AlertRuleTemplate(Model):
         'id': {'key': 'id', 'type': 'str'},
         'name': {'key': 'name', 'type': 'str'},
         'type': {'key': 'type', 'type': 'str'},
-        'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
     }
 
     _subtype_map = {
-        'kind': {'Filter': 'FilterAlertRuleTemplate', 'Fusion': 'FusionAlertRuleTemplate', 'Scheduled': 'ScheduledAlertRuleTemplate'}
+        'kind': {'Fusion': 'FusionAlertRuleTemplate', 'MicrosoftSecurityIncidentCreation': 'MicrosoftSecurityIncidentCreationAlertRuleTemplate', 'Scheduled': 'ScheduledAlertRuleTemplate'}
     }
 
     def __init__(self, **kwargs):
@@ -60,5 +58,4 @@ def __init__(self, **kwargs):
         self.id = None
         self.name = None
         self.type = None
-        self.etag = kwargs.get('etag', None)
         self.kind = None
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/base_alert_rule_template_properties.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/alert_rule_template_properties_base.py
similarity index 88%
rename from sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/base_alert_rule_template_properties.py
rename to sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/alert_rule_template_properties_base.py
index 99f39bc9e473..bc3dfe196187 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/base_alert_rule_template_properties.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/alert_rule_template_properties_base.py
@@ -12,7 +12,7 @@
 from msrest.serialization import Model
 
 
-class BaseAlertRuleTemplateProperties(Model):
+class AlertRuleTemplatePropertiesBase(Model):
     """Base alert rule template property bag.
 
     Variables are only populated by the server, and will be ignored when
@@ -23,7 +23,7 @@ class BaseAlertRuleTemplateProperties(Model):
     :type alert_rules_created_by_template_count: int
     :ivar created_date_utc: The time that this alert rule template has been
      added.
-    :vartype created_date_utc: str
+    :vartype created_date_utc: datetime
     :param description: The description of the alert rule template.
     :type description: str
     :param display_name: The display name for alert rule template.
@@ -46,16 +46,16 @@ class BaseAlertRuleTemplateProperties(Model):
 
     _attribute_map = {
         'alert_rules_created_by_template_count': {'key': 'alertRulesCreatedByTemplateCount', 'type': 'int'},
-        'created_date_utc': {'key': 'createdDateUTC', 'type': 'str'},
+        'created_date_utc': {'key': 'createdDateUTC', 'type': 'iso-8601'},
         'description': {'key': 'description', 'type': 'str'},
         'display_name': {'key': 'displayName', 'type': 'str'},
         'required_data_connectors': {'key': 'requiredDataConnectors', 'type': '[DataConnectorStatus]'},
-        'status': {'key': 'status', 'type': 'TemplateStatus'},
-        'tactics': {'key': 'tactics', 'type': '[AttackTactic]'},
+        'status': {'key': 'status', 'type': 'str'},
+        'tactics': {'key': 'tactics', 'type': '[str]'},
     }
 
     def __init__(self, **kwargs):
-        super(BaseAlertRuleTemplateProperties, self).__init__(**kwargs)
+        super(AlertRuleTemplatePropertiesBase, self).__init__(**kwargs)
         self.alert_rules_created_by_template_count = kwargs.get('alert_rules_created_by_template_count', None)
         self.created_date_utc = None
         self.description = kwargs.get('description', None)
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/base_alert_rule_template_properties_py3.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/alert_rule_template_properties_base_py3.py
similarity index 88%
rename from sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/base_alert_rule_template_properties_py3.py
rename to sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/alert_rule_template_properties_base_py3.py
index 16070851ec89..c0f509e28256 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/base_alert_rule_template_properties_py3.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/alert_rule_template_properties_base_py3.py
@@ -12,7 +12,7 @@
 from msrest.serialization import Model
 
 
-class BaseAlertRuleTemplateProperties(Model):
+class AlertRuleTemplatePropertiesBase(Model):
     """Base alert rule template property bag.
 
     Variables are only populated by the server, and will be ignored when
@@ -23,7 +23,7 @@ class BaseAlertRuleTemplateProperties(Model):
     :type alert_rules_created_by_template_count: int
     :ivar created_date_utc: The time that this alert rule template has been
      added.
-    :vartype created_date_utc: str
+    :vartype created_date_utc: datetime
     :param description: The description of the alert rule template.
     :type description: str
     :param display_name: The display name for alert rule template.
@@ -46,16 +46,16 @@ class BaseAlertRuleTemplateProperties(Model):
 
     _attribute_map = {
         'alert_rules_created_by_template_count': {'key': 'alertRulesCreatedByTemplateCount', 'type': 'int'},
-        'created_date_utc': {'key': 'createdDateUTC', 'type': 'str'},
+        'created_date_utc': {'key': 'createdDateUTC', 'type': 'iso-8601'},
         'description': {'key': 'description', 'type': 'str'},
         'display_name': {'key': 'displayName', 'type': 'str'},
         'required_data_connectors': {'key': 'requiredDataConnectors', 'type': '[DataConnectorStatus]'},
-        'status': {'key': 'status', 'type': 'TemplateStatus'},
-        'tactics': {'key': 'tactics', 'type': '[AttackTactic]'},
+        'status': {'key': 'status', 'type': 'str'},
+        'tactics': {'key': 'tactics', 'type': '[str]'},
     }
 
     def __init__(self, *, alert_rules_created_by_template_count: int=None, description: str=None, display_name: str=None, required_data_connectors=None, status=None, tactics=None, **kwargs) -> None:
-        super(BaseAlertRuleTemplateProperties, self).__init__(**kwargs)
+        super(AlertRuleTemplatePropertiesBase, self).__init__(**kwargs)
         self.alert_rules_created_by_template_count = alert_rules_created_by_template_count
         self.created_date_utc = None
         self.description = description
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/alert_rule_template_py3.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/alert_rule_template_py3.py
index 8b5980f75be7..1f62c61eecb2 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/alert_rule_template_py3.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/alert_rule_template_py3.py
@@ -16,7 +16,8 @@ class AlertRuleTemplate(Model):
     """Alert rule template.
 
     You probably want to use the sub-classes and not this class directly. Known
-    sub-classes are: FilterAlertRuleTemplate, FusionAlertRuleTemplate,
+    sub-classes are: FusionAlertRuleTemplate,
+    MicrosoftSecurityIncidentCreationAlertRuleTemplate,
     ScheduledAlertRuleTemplate
 
     Variables are only populated by the server, and will be ignored when
@@ -30,8 +31,6 @@ class AlertRuleTemplate(Model):
     :vartype name: str
     :ivar type: Azure resource type
     :vartype type: str
-    :param etag: Etag of the alert rule.
-    :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
     """
@@ -47,18 +46,16 @@ class AlertRuleTemplate(Model):
         'id': {'key': 'id', 'type': 'str'},
         'name': {'key': 'name', 'type': 'str'},
         'type': {'key': 'type', 'type': 'str'},
-        'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
     }
 
     _subtype_map = {
-        'kind': {'Filter': 'FilterAlertRuleTemplate', 'Fusion': 'FusionAlertRuleTemplate', 'Scheduled': 'ScheduledAlertRuleTemplate'}
+        'kind': {'Fusion': 'FusionAlertRuleTemplate', 'MicrosoftSecurityIncidentCreation': 'MicrosoftSecurityIncidentCreationAlertRuleTemplate', 'Scheduled': 'ScheduledAlertRuleTemplate'}
     }
 
-    def __init__(self, *, etag: str=None, **kwargs) -> None:
+    def __init__(self, **kwargs) -> None:
         super(AlertRuleTemplate, self).__init__(**kwargs)
         self.id = None
         self.name = None
         self.type = None
-        self.etag = etag
         self.kind = None
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/asc_data_connector.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/asc_data_connector.py
index 3441697c1eca..907225647538 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/asc_data_connector.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/asc_data_connector.py
@@ -15,18 +15,9 @@
 class ASCDataConnector(DataConnector):
     """Represents ASC (Azure Security Center) data connector.
 
-    Variables are only populated by the server, and will be ignored when
-    sending a request.
-
     All required parameters must be populated in order to send to Azure.
 
-    :ivar id: Azure resource Id
-    :vartype id: str
-    :ivar name: Azure resource name
-    :vartype name: str
-    :ivar type: Azure resource type
-    :vartype type: str
-    :param etag: Etag of the data connector.
+    :param etag: Etag of the azure resource
     :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
@@ -39,16 +30,10 @@ class ASCDataConnector(DataConnector):
     """
 
     _validation = {
-        'id': {'readonly': True},
-        'name': {'readonly': True},
-        'type': {'readonly': True},
         'kind': {'required': True},
     }
 
     _attribute_map = {
-        'id': {'key': 'id', 'type': 'str'},
-        'name': {'key': 'name', 'type': 'str'},
-        'type': {'key': 'type', 'type': 'str'},
         'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
         'data_types': {'key': 'properties.dataTypes', 'type': 'AlertsDataTypeOfDataConnector'},
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/asc_data_connector_py3.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/asc_data_connector_py3.py
index 0c5dfcb9bb09..1fa97460d3cd 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/asc_data_connector_py3.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/asc_data_connector_py3.py
@@ -15,18 +15,9 @@
 class ASCDataConnector(DataConnector):
     """Represents ASC (Azure Security Center) data connector.
 
-    Variables are only populated by the server, and will be ignored when
-    sending a request.
-
     All required parameters must be populated in order to send to Azure.
 
-    :ivar id: Azure resource Id
-    :vartype id: str
-    :ivar name: Azure resource name
-    :vartype name: str
-    :ivar type: Azure resource type
-    :vartype type: str
-    :param etag: Etag of the data connector.
+    :param etag: Etag of the azure resource
     :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
@@ -39,16 +30,10 @@ class ASCDataConnector(DataConnector):
     """
 
     _validation = {
-        'id': {'readonly': True},
-        'name': {'readonly': True},
-        'type': {'readonly': True},
         'kind': {'required': True},
     }
 
     _attribute_map = {
-        'id': {'key': 'id', 'type': 'str'},
-        'name': {'key': 'name', 'type': 'str'},
-        'type': {'key': 'type', 'type': 'str'},
         'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
         'data_types': {'key': 'properties.dataTypes', 'type': 'AlertsDataTypeOfDataConnector'},
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/aws_cloud_trail_data_connector.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/aws_cloud_trail_data_connector.py
index 20fc9e7fb8fb..fa36177fa7bd 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/aws_cloud_trail_data_connector.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/aws_cloud_trail_data_connector.py
@@ -15,18 +15,9 @@
 class AwsCloudTrailDataConnector(DataConnector):
     """Represents Amazon Web Services CloudTrail data connector.
 
-    Variables are only populated by the server, and will be ignored when
-    sending a request.
-
     All required parameters must be populated in order to send to Azure.
 
-    :ivar id: Azure resource Id
-    :vartype id: str
-    :ivar name: Azure resource name
-    :vartype name: str
-    :ivar type: Azure resource type
-    :vartype type: str
-    :param etag: Etag of the data connector.
+    :param etag: Etag of the azure resource
     :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
@@ -39,16 +30,10 @@ class AwsCloudTrailDataConnector(DataConnector):
     """
 
     _validation = {
-        'id': {'readonly': True},
-        'name': {'readonly': True},
-        'type': {'readonly': True},
         'kind': {'required': True},
     }
 
     _attribute_map = {
-        'id': {'key': 'id', 'type': 'str'},
-        'name': {'key': 'name', 'type': 'str'},
-        'type': {'key': 'type', 'type': 'str'},
         'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
         'aws_role_arn': {'key': 'properties.awsRoleArn', 'type': 'str'},
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/aws_cloud_trail_data_connector_py3.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/aws_cloud_trail_data_connector_py3.py
index 19660bd70361..2df0cc407407 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/aws_cloud_trail_data_connector_py3.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/aws_cloud_trail_data_connector_py3.py
@@ -15,18 +15,9 @@
 class AwsCloudTrailDataConnector(DataConnector):
     """Represents Amazon Web Services CloudTrail data connector.
 
-    Variables are only populated by the server, and will be ignored when
-    sending a request.
-
     All required parameters must be populated in order to send to Azure.
 
-    :ivar id: Azure resource Id
-    :vartype id: str
-    :ivar name: Azure resource name
-    :vartype name: str
-    :ivar type: Azure resource type
-    :vartype type: str
-    :param etag: Etag of the data connector.
+    :param etag: Etag of the azure resource
     :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
@@ -39,16 +30,10 @@ class AwsCloudTrailDataConnector(DataConnector):
     """
 
     _validation = {
-        'id': {'readonly': True},
-        'name': {'readonly': True},
-        'type': {'readonly': True},
         'kind': {'required': True},
     }
 
     _attribute_map = {
-        'id': {'key': 'id', 'type': 'str'},
-        'name': {'key': 'name', 'type': 'str'},
-        'type': {'key': 'type', 'type': 'str'},
         'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
         'aws_role_arn': {'key': 'properties.awsRoleArn', 'type': 'str'},
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/bookmark.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/bookmark.py
index 0abc81829731..b297f9718572 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/bookmark.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/bookmark.py
@@ -9,10 +9,10 @@
 # regenerated.
 # --------------------------------------------------------------------------
 
-from .resource import Resource
+from .resource_with_etag import ResourceWithEtag
 
 
-class Bookmark(Resource):
+class Bookmark(ResourceWithEtag):
     """Represents a bookmark in Azure Security Insights.
 
     Variables are only populated by the server, and will be ignored when
@@ -26,7 +26,7 @@ class Bookmark(Resource):
     :vartype name: str
     :ivar type: Azure resource type
     :vartype type: str
-    :param etag: Etag of the bookmark.
+    :param etag: Etag of the azure resource
     :type etag: str
     :param created: The time the bookmark was created
     :type created: datetime
@@ -74,7 +74,6 @@ class Bookmark(Resource):
 
     def __init__(self, **kwargs):
         super(Bookmark, self).__init__(**kwargs)
-        self.etag = kwargs.get('etag', None)
         self.created = kwargs.get('created', None)
         self.created_by = kwargs.get('created_by', None)
         self.display_name = kwargs.get('display_name', None)
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/bookmark_py3.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/bookmark_py3.py
index 75a878f1f0d2..26e131894091 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/bookmark_py3.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/bookmark_py3.py
@@ -9,10 +9,10 @@
 # regenerated.
 # --------------------------------------------------------------------------
 
-from .resource_py3 import Resource
+from .resource_with_etag_py3 import ResourceWithEtag
 
 
-class Bookmark(Resource):
+class Bookmark(ResourceWithEtag):
     """Represents a bookmark in Azure Security Insights.
 
     Variables are only populated by the server, and will be ignored when
@@ -26,7 +26,7 @@ class Bookmark(Resource):
     :vartype name: str
     :ivar type: Azure resource type
     :vartype type: str
-    :param etag: Etag of the bookmark.
+    :param etag: Etag of the azure resource
     :type etag: str
     :param created: The time the bookmark was created
     :type created: datetime
@@ -73,8 +73,7 @@ class Bookmark(Resource):
     }
 
     def __init__(self, *, display_name: str, query: str, etag: str=None, created=None, created_by=None, labels=None, notes: str=None, query_result: str=None, updated=None, updated_by=None, **kwargs) -> None:
-        super(Bookmark, self).__init__(**kwargs)
-        self.etag = etag
+        super(Bookmark, self).__init__(etag=etag, **kwargs)
         self.created = created
         self.created_by = created_by
         self.display_name = display_name
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/case.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/case.py
index b3ddd74bf5f2..380c8b38a098 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/case.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/case.py
@@ -9,10 +9,10 @@
 # regenerated.
 # --------------------------------------------------------------------------
 
-from .resource import Resource
+from .resource_with_etag import ResourceWithEtag
 
 
-class Case(Resource):
+class Case(ResourceWithEtag):
     """Represents a case in Azure Security Insights.
 
     Variables are only populated by the server, and will be ignored when
@@ -26,7 +26,7 @@ class Case(Resource):
     :vartype name: str
     :ivar type: Azure resource type
     :vartype type: str
-    :param etag: Etag of the alert rule.
+    :param etag: Etag of the azure resource
     :type etag: str
     :ivar case_number: a sequential number
     :vartype case_number: int
@@ -106,7 +106,6 @@ class Case(Resource):
 
     def __init__(self, **kwargs):
         super(Case, self).__init__(**kwargs)
-        self.etag = kwargs.get('etag', None)
         self.case_number = None
         self.close_reason = kwargs.get('close_reason', None)
         self.closed_reason_text = kwargs.get('closed_reason_text', None)
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/case_py3.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/case_py3.py
index 240e67f39321..fc1f2e99889d 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/case_py3.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/case_py3.py
@@ -9,10 +9,10 @@
 # regenerated.
 # --------------------------------------------------------------------------
 
-from .resource_py3 import Resource
+from .resource_with_etag_py3 import ResourceWithEtag
 
 
-class Case(Resource):
+class Case(ResourceWithEtag):
     """Represents a case in Azure Security Insights.
 
     Variables are only populated by the server, and will be ignored when
@@ -26,7 +26,7 @@ class Case(Resource):
     :vartype name: str
     :ivar type: Azure resource type
     :vartype type: str
-    :param etag: Etag of the alert rule.
+    :param etag: Etag of the azure resource
     :type etag: str
     :ivar case_number: a sequential number
     :vartype case_number: int
@@ -105,8 +105,7 @@ class Case(Resource):
     }
 
     def __init__(self, *, severity, start_time_utc, status, title: str, etag: str=None, close_reason=None, closed_reason_text: str=None, description: str=None, end_time_utc=None, labels=None, owner=None, **kwargs) -> None:
-        super(Case, self).__init__(**kwargs)
-        self.etag = etag
+        super(Case, self).__init__(etag=etag, **kwargs)
         self.case_number = None
         self.close_reason = close_reason
         self.closed_reason_text = closed_reason_text
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/data_connector.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/data_connector.py
index 095722b85825..7e817f2fefa8 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/data_connector.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/data_connector.py
@@ -20,34 +20,19 @@ class DataConnector(Model):
     AwsCloudTrailDataConnector, MCASDataConnector, MDATPDataConnector,
     OfficeDataConnector, TIDataConnector
 
-    Variables are only populated by the server, and will be ignored when
-    sending a request.
-
     All required parameters must be populated in order to send to Azure.
 
-    :ivar id: Azure resource Id
-    :vartype id: str
-    :ivar name: Azure resource name
-    :vartype name: str
-    :ivar type: Azure resource type
-    :vartype type: str
-    :param etag: Etag of the data connector.
+    :param etag: Etag of the azure resource
     :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
     """
 
     _validation = {
-        'id': {'readonly': True},
-        'name': {'readonly': True},
-        'type': {'readonly': True},
         'kind': {'required': True},
     }
 
     _attribute_map = {
-        'id': {'key': 'id', 'type': 'str'},
-        'name': {'key': 'name', 'type': 'str'},
-        'type': {'key': 'type', 'type': 'str'},
         'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
     }
@@ -58,8 +43,5 @@ class DataConnector(Model):
 
     def __init__(self, **kwargs):
         super(DataConnector, self).__init__(**kwargs)
-        self.id = None
-        self.name = None
-        self.type = None
         self.etag = kwargs.get('etag', None)
         self.kind = None
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/data_connector_py3.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/data_connector_py3.py
index f1ceca80d3b5..1c57b9cd6bc1 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/data_connector_py3.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/data_connector_py3.py
@@ -20,34 +20,19 @@ class DataConnector(Model):
     AwsCloudTrailDataConnector, MCASDataConnector, MDATPDataConnector,
     OfficeDataConnector, TIDataConnector
 
-    Variables are only populated by the server, and will be ignored when
-    sending a request.
-
     All required parameters must be populated in order to send to Azure.
 
-    :ivar id: Azure resource Id
-    :vartype id: str
-    :ivar name: Azure resource name
-    :vartype name: str
-    :ivar type: Azure resource type
-    :vartype type: str
-    :param etag: Etag of the data connector.
+    :param etag: Etag of the azure resource
     :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
     """
 
     _validation = {
-        'id': {'readonly': True},
-        'name': {'readonly': True},
-        'type': {'readonly': True},
         'kind': {'required': True},
     }
 
     _attribute_map = {
-        'id': {'key': 'id', 'type': 'str'},
-        'name': {'key': 'name', 'type': 'str'},
-        'type': {'key': 'type', 'type': 'str'},
         'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
     }
@@ -58,8 +43,5 @@ class DataConnector(Model):
 
     def __init__(self, *, etag: str=None, **kwargs) -> None:
         super(DataConnector, self).__init__(**kwargs)
-        self.id = None
-        self.name = None
-        self.type = None
         self.etag = etag
         self.kind = None
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/data_connector_status.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/data_connector_status.py
index 5e8f8d3f3657..d9c3ff2d4af4 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/data_connector_status.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/data_connector_status.py
@@ -24,7 +24,7 @@ class DataConnectorStatus(Model):
 
     _attribute_map = {
         'connector_id': {'key': 'connectorId', 'type': 'str'},
-        'data_types': {'key': 'dataTypes', 'type': '{DataTypeStatus}'},
+        'data_types': {'key': 'dataTypes', 'type': '{str}'},
     }
 
     def __init__(self, **kwargs):
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/data_connector_status_py3.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/data_connector_status_py3.py
index 177633bf2618..355389270c9f 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/data_connector_status_py3.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/data_connector_status_py3.py
@@ -24,7 +24,7 @@ class DataConnectorStatus(Model):
 
     _attribute_map = {
         'connector_id': {'key': 'connectorId', 'type': 'str'},
-        'data_types': {'key': 'dataTypes', 'type': '{DataTypeStatus}'},
+        'data_types': {'key': 'dataTypes', 'type': '{str}'},
     }
 
     def __init__(self, *, connector_id: str=None, data_types=None, **kwargs) -> None:
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/filter_alert_rule_template_properties_model.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/filter_alert_rule_template_properties_model.py
deleted file mode 100644
index 9be1050ae430..000000000000
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/filter_alert_rule_template_properties_model.py
+++ /dev/null
@@ -1,39 +0,0 @@
-# coding=utf-8
-# --------------------------------------------------------------------------
-# Copyright (c) Microsoft Corporation. All rights reserved.
-# Licensed under the MIT License. See License.txt in the project root for
-# license information.
-#
-# Code generated by Microsoft (R) AutoRest Code Generator.
-# Changes may cause incorrect behavior and will be lost if the code is
-# regenerated.
-# --------------------------------------------------------------------------
-
-from msrest.serialization import Model
-
-
-class FilterAlertRuleTemplatePropertiesModel(Model):
-    """Filter alert rule template property bag.
-
-    :param filter_product: The filter product name for this template rule.
-    :type filter_product: str
-    :param filter_severities: the alert’s severities on which the cases will
-     be generated
-    :type filter_severities: list[str or
-     ~azure.mgmt.securityinsight.models.AlertSeverity]
-    :param filter_titles: the alert’s titles on which the cases will be
-     generated
-    :type filter_titles: list[str]
-    """
-
-    _attribute_map = {
-        'filter_product': {'key': 'filterProduct', 'type': 'str'},
-        'filter_severities': {'key': 'filterSeverities', 'type': '[AlertSeverity]'},
-        'filter_titles': {'key': 'filterTitles', 'type': '[str]'},
-    }
-
-    def __init__(self, **kwargs):
-        super(FilterAlertRuleTemplatePropertiesModel, self).__init__(**kwargs)
-        self.filter_product = kwargs.get('filter_product', None)
-        self.filter_severities = kwargs.get('filter_severities', None)
-        self.filter_titles = kwargs.get('filter_titles', None)
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/filter_alert_rule_template_properties_model_py3.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/filter_alert_rule_template_properties_model_py3.py
deleted file mode 100644
index 9c74e0c3a165..000000000000
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/filter_alert_rule_template_properties_model_py3.py
+++ /dev/null
@@ -1,39 +0,0 @@
-# coding=utf-8
-# --------------------------------------------------------------------------
-# Copyright (c) Microsoft Corporation. All rights reserved.
-# Licensed under the MIT License. See License.txt in the project root for
-# license information.
-#
-# Code generated by Microsoft (R) AutoRest Code Generator.
-# Changes may cause incorrect behavior and will be lost if the code is
-# regenerated.
-# --------------------------------------------------------------------------
-
-from msrest.serialization import Model
-
-
-class FilterAlertRuleTemplatePropertiesModel(Model):
-    """Filter alert rule template property bag.
-
-    :param filter_product: The filter product name for this template rule.
-    :type filter_product: str
-    :param filter_severities: the alert’s severities on which the cases will
-     be generated
-    :type filter_severities: list[str or
-     ~azure.mgmt.securityinsight.models.AlertSeverity]
-    :param filter_titles: the alert’s titles on which the cases will be
-     generated
-    :type filter_titles: list[str]
-    """
-
-    _attribute_map = {
-        'filter_product': {'key': 'filterProduct', 'type': 'str'},
-        'filter_severities': {'key': 'filterSeverities', 'type': '[AlertSeverity]'},
-        'filter_titles': {'key': 'filterTitles', 'type': '[str]'},
-    }
-
-    def __init__(self, *, filter_product: str=None, filter_severities=None, filter_titles=None, **kwargs) -> None:
-        super(FilterAlertRuleTemplatePropertiesModel, self).__init__(**kwargs)
-        self.filter_product = filter_product
-        self.filter_severities = filter_severities
-        self.filter_titles = filter_titles
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/fusion_alert_rule.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/fusion_alert_rule.py
new file mode 100644
index 000000000000..4efde82ff055
--- /dev/null
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/fusion_alert_rule.py
@@ -0,0 +1,80 @@
+# coding=utf-8
+# --------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See License.txt in the project root for
+# license information.
+#
+# Code generated by Microsoft (R) AutoRest Code Generator.
+# Changes may cause incorrect behavior and will be lost if the code is
+# regenerated.
+# --------------------------------------------------------------------------
+
+from .alert_rule import AlertRule
+
+
+class FusionAlertRule(AlertRule):
+    """Represents Fusion alert rule.
+
+    Variables are only populated by the server, and will be ignored when
+    sending a request.
+
+    All required parameters must be populated in order to send to Azure.
+
+    :param etag: Etag of the azure resource
+    :type etag: str
+    :param kind: Required. Constant filled by server.
+    :type kind: str
+    :param alert_rule_template_name: Required. The Name of the alert rule
+     template used to create this rule.
+    :type alert_rule_template_name: str
+    :ivar description: The description of the alert rule.
+    :vartype description: str
+    :ivar display_name: The display name for alerts created by this alert
+     rule.
+    :vartype display_name: str
+    :param enabled: Required. Determines whether this alert rule is enabled or
+     disabled.
+    :type enabled: bool
+    :ivar last_modified_utc: The last time that this alert has been modified.
+    :vartype last_modified_utc: datetime
+    :ivar severity: The severity for alerts created by this alert rule.
+     Possible values include: 'High', 'Medium', 'Low', 'Informational'
+    :vartype severity: str or ~azure.mgmt.securityinsight.models.AlertSeverity
+    :ivar tactics: The tactics of the alert rule
+    :vartype tactics: list[str or
+     ~azure.mgmt.securityinsight.models.AttackTactic]
+    """
+
+    _validation = {
+        'kind': {'required': True},
+        'alert_rule_template_name': {'required': True},
+        'description': {'readonly': True},
+        'display_name': {'readonly': True},
+        'enabled': {'required': True},
+        'last_modified_utc': {'readonly': True},
+        'severity': {'readonly': True},
+        'tactics': {'readonly': True},
+    }
+
+    _attribute_map = {
+        'etag': {'key': 'etag', 'type': 'str'},
+        'kind': {'key': 'kind', 'type': 'str'},
+        'alert_rule_template_name': {'key': 'properties.alertRuleTemplateName', 'type': 'str'},
+        'description': {'key': 'properties.description', 'type': 'str'},
+        'display_name': {'key': 'properties.displayName', 'type': 'str'},
+        'enabled': {'key': 'properties.enabled', 'type': 'bool'},
+        'last_modified_utc': {'key': 'properties.lastModifiedUtc', 'type': 'iso-8601'},
+        'severity': {'key': 'properties.severity', 'type': 'str'},
+        'tactics': {'key': 'properties.tactics', 'type': '[str]'},
+    }
+
+    def __init__(self, **kwargs):
+        super(FusionAlertRule, self).__init__(**kwargs)
+        self.alert_rule_template_name = kwargs.get('alert_rule_template_name', None)
+        self.description = None
+        self.display_name = None
+        self.enabled = kwargs.get('enabled', None)
+        self.last_modified_utc = None
+        self.severity = None
+        self.tactics = None
+        self.kind = 'Fusion'
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/fusion_alert_rule_py3.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/fusion_alert_rule_py3.py
new file mode 100644
index 000000000000..b1151b759da1
--- /dev/null
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/fusion_alert_rule_py3.py
@@ -0,0 +1,80 @@
+# coding=utf-8
+# --------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See License.txt in the project root for
+# license information.
+#
+# Code generated by Microsoft (R) AutoRest Code Generator.
+# Changes may cause incorrect behavior and will be lost if the code is
+# regenerated.
+# --------------------------------------------------------------------------
+
+from .alert_rule_py3 import AlertRule
+
+
+class FusionAlertRule(AlertRule):
+    """Represents Fusion alert rule.
+
+    Variables are only populated by the server, and will be ignored when
+    sending a request.
+
+    All required parameters must be populated in order to send to Azure.
+
+    :param etag: Etag of the azure resource
+    :type etag: str
+    :param kind: Required. Constant filled by server.
+    :type kind: str
+    :param alert_rule_template_name: Required. The Name of the alert rule
+     template used to create this rule.
+    :type alert_rule_template_name: str
+    :ivar description: The description of the alert rule.
+    :vartype description: str
+    :ivar display_name: The display name for alerts created by this alert
+     rule.
+    :vartype display_name: str
+    :param enabled: Required. Determines whether this alert rule is enabled or
+     disabled.
+    :type enabled: bool
+    :ivar last_modified_utc: The last time that this alert has been modified.
+    :vartype last_modified_utc: datetime
+    :ivar severity: The severity for alerts created by this alert rule.
+     Possible values include: 'High', 'Medium', 'Low', 'Informational'
+    :vartype severity: str or ~azure.mgmt.securityinsight.models.AlertSeverity
+    :ivar tactics: The tactics of the alert rule
+    :vartype tactics: list[str or
+     ~azure.mgmt.securityinsight.models.AttackTactic]
+    """
+
+    _validation = {
+        'kind': {'required': True},
+        'alert_rule_template_name': {'required': True},
+        'description': {'readonly': True},
+        'display_name': {'readonly': True},
+        'enabled': {'required': True},
+        'last_modified_utc': {'readonly': True},
+        'severity': {'readonly': True},
+        'tactics': {'readonly': True},
+    }
+
+    _attribute_map = {
+        'etag': {'key': 'etag', 'type': 'str'},
+        'kind': {'key': 'kind', 'type': 'str'},
+        'alert_rule_template_name': {'key': 'properties.alertRuleTemplateName', 'type': 'str'},
+        'description': {'key': 'properties.description', 'type': 'str'},
+        'display_name': {'key': 'properties.displayName', 'type': 'str'},
+        'enabled': {'key': 'properties.enabled', 'type': 'bool'},
+        'last_modified_utc': {'key': 'properties.lastModifiedUtc', 'type': 'iso-8601'},
+        'severity': {'key': 'properties.severity', 'type': 'str'},
+        'tactics': {'key': 'properties.tactics', 'type': '[str]'},
+    }
+
+    def __init__(self, *, alert_rule_template_name: str, enabled: bool, etag: str=None, **kwargs) -> None:
+        super(FusionAlertRule, self).__init__(etag=etag, **kwargs)
+        self.alert_rule_template_name = alert_rule_template_name
+        self.description = None
+        self.display_name = None
+        self.enabled = enabled
+        self.last_modified_utc = None
+        self.severity = None
+        self.tactics = None
+        self.kind = 'Fusion'
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/fusion_alert_rule_template.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/fusion_alert_rule_template.py
index 82a5adca56bd..c2e60a40f4a2 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/fusion_alert_rule_template.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/fusion_alert_rule_template.py
@@ -13,7 +13,7 @@
 
 
 class FusionAlertRuleTemplate(AlertRuleTemplate):
-    """Represents fusion alert rule template.
+    """Represents Fusion alert rule template.
 
     Variables are only populated by the server, and will be ignored when
     sending a request.
@@ -26,32 +26,30 @@ class FusionAlertRuleTemplate(AlertRuleTemplate):
     :vartype name: str
     :ivar type: Azure resource type
     :vartype type: str
-    :param etag: Etag of the alert rule.
-    :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
-    :param alert_rules_created_by_template_count: Required. the number of
-     alert rules that were created by this template
+    :param alert_rules_created_by_template_count: the number of alert rules
+     that were created by this template
     :type alert_rules_created_by_template_count: int
-    :ivar created_date_utc: Required. The time that this alert rule template
-     has been added.
-    :vartype created_date_utc: str
-    :param description: Required. The description of the alert rule template.
+    :ivar created_date_utc: The time that this alert rule template has been
+     added.
+    :vartype created_date_utc: datetime
+    :param description: The description of the alert rule template.
     :type description: str
-    :param display_name: Required. The display name for alert rule template.
+    :param display_name: The display name for alert rule template.
     :type display_name: str
     :param required_data_connectors: The required data connectors for this
      template
     :type required_data_connectors:
      list[~azure.mgmt.securityinsight.models.DataConnectorStatus]
-    :param status: Required. The alert rule template status. Possible values
-     include: 'Installed', 'Available', 'NotAvailable'
+    :param status: The alert rule template status. Possible values include:
+     'Installed', 'Available', 'NotAvailable'
     :type status: str or ~azure.mgmt.securityinsight.models.TemplateStatus
     :param tactics: The tactics of the alert rule template
     :type tactics: list[str or
      ~azure.mgmt.securityinsight.models.AttackTactic]
-    :param severity: The severity for alerts created by this alert rule.
-     Possible values include: 'High', 'Medium', 'Low', 'Informational'
+    :param severity: Required. The severity for alerts created by this alert
+     rule. Possible values include: 'High', 'Medium', 'Low', 'Informational'
     :type severity: str or ~azure.mgmt.securityinsight.models.AlertSeverity
     """
 
@@ -60,27 +58,23 @@ class FusionAlertRuleTemplate(AlertRuleTemplate):
         'name': {'readonly': True},
         'type': {'readonly': True},
         'kind': {'required': True},
-        'alert_rules_created_by_template_count': {'required': True},
-        'created_date_utc': {'required': True, 'readonly': True},
-        'description': {'required': True},
-        'display_name': {'required': True},
-        'status': {'required': True},
+        'created_date_utc': {'readonly': True},
+        'severity': {'required': True},
     }
 
     _attribute_map = {
         'id': {'key': 'id', 'type': 'str'},
         'name': {'key': 'name', 'type': 'str'},
         'type': {'key': 'type', 'type': 'str'},
-        'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
         'alert_rules_created_by_template_count': {'key': 'properties.alertRulesCreatedByTemplateCount', 'type': 'int'},
-        'created_date_utc': {'key': 'properties.createdDateUTC', 'type': 'str'},
+        'created_date_utc': {'key': 'properties.createdDateUTC', 'type': 'iso-8601'},
         'description': {'key': 'properties.description', 'type': 'str'},
         'display_name': {'key': 'properties.displayName', 'type': 'str'},
         'required_data_connectors': {'key': 'properties.requiredDataConnectors', 'type': '[DataConnectorStatus]'},
-        'status': {'key': 'properties.status', 'type': 'TemplateStatus'},
-        'tactics': {'key': 'properties.tactics', 'type': '[AttackTactic]'},
-        'severity': {'key': 'properties.severity', 'type': 'AlertSeverity'},
+        'status': {'key': 'properties.status', 'type': 'str'},
+        'tactics': {'key': 'properties.tactics', 'type': '[str]'},
+        'severity': {'key': 'properties.severity', 'type': 'str'},
     }
 
     def __init__(self, **kwargs):
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/fusion_alert_rule_template_properties_model.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/fusion_alert_rule_template_properties_model.py
deleted file mode 100644
index bda0859c9716..000000000000
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/fusion_alert_rule_template_properties_model.py
+++ /dev/null
@@ -1,29 +0,0 @@
-# coding=utf-8
-# --------------------------------------------------------------------------
-# Copyright (c) Microsoft Corporation. All rights reserved.
-# Licensed under the MIT License. See License.txt in the project root for
-# license information.
-#
-# Code generated by Microsoft (R) AutoRest Code Generator.
-# Changes may cause incorrect behavior and will be lost if the code is
-# regenerated.
-# --------------------------------------------------------------------------
-
-from msrest.serialization import Model
-
-
-class FusionAlertRuleTemplatePropertiesModel(Model):
-    """Filter alert rule template property bag.
-
-    :param severity: The severity for alerts created by this alert rule.
-     Possible values include: 'High', 'Medium', 'Low', 'Informational'
-    :type severity: str or ~azure.mgmt.securityinsight.models.AlertSeverity
-    """
-
-    _attribute_map = {
-        'severity': {'key': 'severity', 'type': 'AlertSeverity'},
-    }
-
-    def __init__(self, **kwargs):
-        super(FusionAlertRuleTemplatePropertiesModel, self).__init__(**kwargs)
-        self.severity = kwargs.get('severity', None)
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/fusion_alert_rule_template_properties_model_py3.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/fusion_alert_rule_template_properties_model_py3.py
deleted file mode 100644
index 098b055445a7..000000000000
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/fusion_alert_rule_template_properties_model_py3.py
+++ /dev/null
@@ -1,29 +0,0 @@
-# coding=utf-8
-# --------------------------------------------------------------------------
-# Copyright (c) Microsoft Corporation. All rights reserved.
-# Licensed under the MIT License. See License.txt in the project root for
-# license information.
-#
-# Code generated by Microsoft (R) AutoRest Code Generator.
-# Changes may cause incorrect behavior and will be lost if the code is
-# regenerated.
-# --------------------------------------------------------------------------
-
-from msrest.serialization import Model
-
-
-class FusionAlertRuleTemplatePropertiesModel(Model):
-    """Filter alert rule template property bag.
-
-    :param severity: The severity for alerts created by this alert rule.
-     Possible values include: 'High', 'Medium', 'Low', 'Informational'
-    :type severity: str or ~azure.mgmt.securityinsight.models.AlertSeverity
-    """
-
-    _attribute_map = {
-        'severity': {'key': 'severity', 'type': 'AlertSeverity'},
-    }
-
-    def __init__(self, *, severity=None, **kwargs) -> None:
-        super(FusionAlertRuleTemplatePropertiesModel, self).__init__(**kwargs)
-        self.severity = severity
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/fusion_alert_rule_template_py3.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/fusion_alert_rule_template_py3.py
index eb7088d15391..60cc7cf330f5 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/fusion_alert_rule_template_py3.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/fusion_alert_rule_template_py3.py
@@ -13,7 +13,7 @@
 
 
 class FusionAlertRuleTemplate(AlertRuleTemplate):
-    """Represents fusion alert rule template.
+    """Represents Fusion alert rule template.
 
     Variables are only populated by the server, and will be ignored when
     sending a request.
@@ -26,32 +26,30 @@ class FusionAlertRuleTemplate(AlertRuleTemplate):
     :vartype name: str
     :ivar type: Azure resource type
     :vartype type: str
-    :param etag: Etag of the alert rule.
-    :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
-    :param alert_rules_created_by_template_count: Required. the number of
-     alert rules that were created by this template
+    :param alert_rules_created_by_template_count: the number of alert rules
+     that were created by this template
     :type alert_rules_created_by_template_count: int
-    :ivar created_date_utc: Required. The time that this alert rule template
-     has been added.
-    :vartype created_date_utc: str
-    :param description: Required. The description of the alert rule template.
+    :ivar created_date_utc: The time that this alert rule template has been
+     added.
+    :vartype created_date_utc: datetime
+    :param description: The description of the alert rule template.
     :type description: str
-    :param display_name: Required. The display name for alert rule template.
+    :param display_name: The display name for alert rule template.
     :type display_name: str
     :param required_data_connectors: The required data connectors for this
      template
     :type required_data_connectors:
      list[~azure.mgmt.securityinsight.models.DataConnectorStatus]
-    :param status: Required. The alert rule template status. Possible values
-     include: 'Installed', 'Available', 'NotAvailable'
+    :param status: The alert rule template status. Possible values include:
+     'Installed', 'Available', 'NotAvailable'
     :type status: str or ~azure.mgmt.securityinsight.models.TemplateStatus
     :param tactics: The tactics of the alert rule template
     :type tactics: list[str or
      ~azure.mgmt.securityinsight.models.AttackTactic]
-    :param severity: The severity for alerts created by this alert rule.
-     Possible values include: 'High', 'Medium', 'Low', 'Informational'
+    :param severity: Required. The severity for alerts created by this alert
+     rule. Possible values include: 'High', 'Medium', 'Low', 'Informational'
     :type severity: str or ~azure.mgmt.securityinsight.models.AlertSeverity
     """
 
@@ -60,31 +58,27 @@ class FusionAlertRuleTemplate(AlertRuleTemplate):
         'name': {'readonly': True},
         'type': {'readonly': True},
         'kind': {'required': True},
-        'alert_rules_created_by_template_count': {'required': True},
-        'created_date_utc': {'required': True, 'readonly': True},
-        'description': {'required': True},
-        'display_name': {'required': True},
-        'status': {'required': True},
+        'created_date_utc': {'readonly': True},
+        'severity': {'required': True},
     }
 
     _attribute_map = {
         'id': {'key': 'id', 'type': 'str'},
         'name': {'key': 'name', 'type': 'str'},
         'type': {'key': 'type', 'type': 'str'},
-        'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
         'alert_rules_created_by_template_count': {'key': 'properties.alertRulesCreatedByTemplateCount', 'type': 'int'},
-        'created_date_utc': {'key': 'properties.createdDateUTC', 'type': 'str'},
+        'created_date_utc': {'key': 'properties.createdDateUTC', 'type': 'iso-8601'},
         'description': {'key': 'properties.description', 'type': 'str'},
         'display_name': {'key': 'properties.displayName', 'type': 'str'},
         'required_data_connectors': {'key': 'properties.requiredDataConnectors', 'type': '[DataConnectorStatus]'},
-        'status': {'key': 'properties.status', 'type': 'TemplateStatus'},
-        'tactics': {'key': 'properties.tactics', 'type': '[AttackTactic]'},
-        'severity': {'key': 'properties.severity', 'type': 'AlertSeverity'},
+        'status': {'key': 'properties.status', 'type': 'str'},
+        'tactics': {'key': 'properties.tactics', 'type': '[str]'},
+        'severity': {'key': 'properties.severity', 'type': 'str'},
     }
 
-    def __init__(self, *, alert_rules_created_by_template_count: int, description: str, display_name: str, status, etag: str=None, required_data_connectors=None, tactics=None, severity=None, **kwargs) -> None:
-        super(FusionAlertRuleTemplate, self).__init__(etag=etag, **kwargs)
+    def __init__(self, *, severity, alert_rules_created_by_template_count: int=None, description: str=None, display_name: str=None, required_data_connectors=None, status=None, tactics=None, **kwargs) -> None:
+        super(FusionAlertRuleTemplate, self).__init__(**kwargs)
         self.alert_rules_created_by_template_count = alert_rules_created_by_template_count
         self.created_date_utc = None
         self.description = description
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/mcas_data_connector.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/mcas_data_connector.py
index c5f07dd863aa..5c49887946d1 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/mcas_data_connector.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/mcas_data_connector.py
@@ -15,18 +15,9 @@
 class MCASDataConnector(DataConnector):
     """Represents MCAS (Microsoft Cloud App Security) data connector.
 
-    Variables are only populated by the server, and will be ignored when
-    sending a request.
-
     All required parameters must be populated in order to send to Azure.
 
-    :ivar id: Azure resource Id
-    :vartype id: str
-    :ivar name: Azure resource name
-    :vartype name: str
-    :ivar type: Azure resource type
-    :vartype type: str
-    :param etag: Etag of the data connector.
+    :param etag: Etag of the azure resource
     :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
@@ -38,16 +29,10 @@ class MCASDataConnector(DataConnector):
     """
 
     _validation = {
-        'id': {'readonly': True},
-        'name': {'readonly': True},
-        'type': {'readonly': True},
         'kind': {'required': True},
     }
 
     _attribute_map = {
-        'id': {'key': 'id', 'type': 'str'},
-        'name': {'key': 'name', 'type': 'str'},
-        'type': {'key': 'type', 'type': 'str'},
         'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
         'tenant_id': {'key': 'properties.tenantId', 'type': 'str'},
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/mcas_data_connector_py3.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/mcas_data_connector_py3.py
index 2a976f7357e6..a68f5d1d50b4 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/mcas_data_connector_py3.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/mcas_data_connector_py3.py
@@ -15,18 +15,9 @@
 class MCASDataConnector(DataConnector):
     """Represents MCAS (Microsoft Cloud App Security) data connector.
 
-    Variables are only populated by the server, and will be ignored when
-    sending a request.
-
     All required parameters must be populated in order to send to Azure.
 
-    :ivar id: Azure resource Id
-    :vartype id: str
-    :ivar name: Azure resource name
-    :vartype name: str
-    :ivar type: Azure resource type
-    :vartype type: str
-    :param etag: Etag of the data connector.
+    :param etag: Etag of the azure resource
     :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
@@ -38,16 +29,10 @@ class MCASDataConnector(DataConnector):
     """
 
     _validation = {
-        'id': {'readonly': True},
-        'name': {'readonly': True},
-        'type': {'readonly': True},
         'kind': {'required': True},
     }
 
     _attribute_map = {
-        'id': {'key': 'id', 'type': 'str'},
-        'name': {'key': 'name', 'type': 'str'},
-        'type': {'key': 'type', 'type': 'str'},
         'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
         'tenant_id': {'key': 'properties.tenantId', 'type': 'str'},
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/mdatp_data_connector.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/mdatp_data_connector.py
index 9c60c1d4aa03..625c59a1eb8a 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/mdatp_data_connector.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/mdatp_data_connector.py
@@ -16,18 +16,9 @@ class MDATPDataConnector(DataConnector):
     """Represents MDATP (Microsoft Defender Advanced Threat Protection) data
     connector.
 
-    Variables are only populated by the server, and will be ignored when
-    sending a request.
-
     All required parameters must be populated in order to send to Azure.
 
-    :ivar id: Azure resource Id
-    :vartype id: str
-    :ivar name: Azure resource name
-    :vartype name: str
-    :ivar type: Azure resource type
-    :vartype type: str
-    :param etag: Etag of the data connector.
+    :param etag: Etag of the azure resource
     :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
@@ -39,16 +30,10 @@ class MDATPDataConnector(DataConnector):
     """
 
     _validation = {
-        'id': {'readonly': True},
-        'name': {'readonly': True},
-        'type': {'readonly': True},
         'kind': {'required': True},
     }
 
     _attribute_map = {
-        'id': {'key': 'id', 'type': 'str'},
-        'name': {'key': 'name', 'type': 'str'},
-        'type': {'key': 'type', 'type': 'str'},
         'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
         'tenant_id': {'key': 'properties.tenantId', 'type': 'str'},
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/mdatp_data_connector_py3.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/mdatp_data_connector_py3.py
index 2443b72cfb33..a642f96fde36 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/mdatp_data_connector_py3.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/mdatp_data_connector_py3.py
@@ -16,18 +16,9 @@ class MDATPDataConnector(DataConnector):
     """Represents MDATP (Microsoft Defender Advanced Threat Protection) data
     connector.
 
-    Variables are only populated by the server, and will be ignored when
-    sending a request.
-
     All required parameters must be populated in order to send to Azure.
 
-    :ivar id: Azure resource Id
-    :vartype id: str
-    :ivar name: Azure resource name
-    :vartype name: str
-    :ivar type: Azure resource type
-    :vartype type: str
-    :param etag: Etag of the data connector.
+    :param etag: Etag of the azure resource
     :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
@@ -39,16 +30,10 @@ class MDATPDataConnector(DataConnector):
     """
 
     _validation = {
-        'id': {'readonly': True},
-        'name': {'readonly': True},
-        'type': {'readonly': True},
         'kind': {'required': True},
     }
 
     _attribute_map = {
-        'id': {'key': 'id', 'type': 'str'},
-        'name': {'key': 'name', 'type': 'str'},
-        'type': {'key': 'type', 'type': 'str'},
         'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
         'tenant_id': {'key': 'properties.tenantId', 'type': 'str'},
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/microsoft_security_incident_creation_alert_rule.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/microsoft_security_incident_creation_alert_rule.py
new file mode 100644
index 000000000000..fb3219ea83c6
--- /dev/null
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/microsoft_security_incident_creation_alert_rule.py
@@ -0,0 +1,91 @@
+# coding=utf-8
+# --------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See License.txt in the project root for
+# license information.
+#
+# Code generated by Microsoft (R) AutoRest Code Generator.
+# Changes may cause incorrect behavior and will be lost if the code is
+# regenerated.
+# --------------------------------------------------------------------------
+
+from .alert_rule import AlertRule
+
+
+class MicrosoftSecurityIncidentCreationAlertRule(AlertRule):
+    """Represents MicrosoftSecurityIncidentCreation rule.
+
+    Variables are only populated by the server, and will be ignored when
+    sending a request.
+
+    All required parameters must be populated in order to send to Azure.
+
+    :param etag: Etag of the azure resource
+    :type etag: str
+    :param kind: Required. Constant filled by server.
+    :type kind: str
+    :param display_names_filter: the alerts' displayNames on which the cases
+     will be generated
+    :type display_names_filter: list[str]
+    :param product_filter: Required. The alerts' productName on which the
+     cases will be generated. Possible values include: 'Microsoft Cloud App
+     Security', 'Azure Security Center', 'Azure Advanced Threat Protection',
+     'Azure Active Directory Identity Protection'
+    :type product_filter: str or
+     ~azure.mgmt.securityinsight.models.MicrosoftSecurityProductName
+    :param severities_filter: the alerts' severities on which the cases will
+     be generated
+    :type severities_filter: list[str or
+     ~azure.mgmt.securityinsight.models.AlertSeverity]
+    :param alert_rule_template_name: The Name of the alert rule template used
+     to create this rule.
+    :type alert_rule_template_name: str
+    :param description: The description of the alert rule.
+    :type description: str
+    :param display_name: Required. The display name for alerts created by this
+     alert rule.
+    :type display_name: str
+    :param enabled: Required. Determines whether this alert rule is enabled or
+     disabled.
+    :type enabled: bool
+    :ivar last_modified_utc: The last time that this alert has been modified.
+    :vartype last_modified_utc: datetime
+    :param tactics: The tactics of the alert rule
+    :type tactics: list[str or
+     ~azure.mgmt.securityinsight.models.AttackTactic]
+    """
+
+    _validation = {
+        'kind': {'required': True},
+        'product_filter': {'required': True},
+        'display_name': {'required': True},
+        'enabled': {'required': True},
+        'last_modified_utc': {'readonly': True},
+    }
+
+    _attribute_map = {
+        'etag': {'key': 'etag', 'type': 'str'},
+        'kind': {'key': 'kind', 'type': 'str'},
+        'display_names_filter': {'key': 'properties.displayNamesFilter', 'type': '[str]'},
+        'product_filter': {'key': 'properties.productFilter', 'type': 'str'},
+        'severities_filter': {'key': 'properties.severitiesFilter', 'type': '[str]'},
+        'alert_rule_template_name': {'key': 'properties.alertRuleTemplateName', 'type': 'str'},
+        'description': {'key': 'properties.description', 'type': 'str'},
+        'display_name': {'key': 'properties.displayName', 'type': 'str'},
+        'enabled': {'key': 'properties.enabled', 'type': 'bool'},
+        'last_modified_utc': {'key': 'properties.lastModifiedUtc', 'type': 'iso-8601'},
+        'tactics': {'key': 'properties.tactics', 'type': '[str]'},
+    }
+
+    def __init__(self, **kwargs):
+        super(MicrosoftSecurityIncidentCreationAlertRule, self).__init__(**kwargs)
+        self.display_names_filter = kwargs.get('display_names_filter', None)
+        self.product_filter = kwargs.get('product_filter', None)
+        self.severities_filter = kwargs.get('severities_filter', None)
+        self.alert_rule_template_name = kwargs.get('alert_rule_template_name', None)
+        self.description = kwargs.get('description', None)
+        self.display_name = kwargs.get('display_name', None)
+        self.enabled = kwargs.get('enabled', None)
+        self.last_modified_utc = None
+        self.tactics = kwargs.get('tactics', None)
+        self.kind = 'MicrosoftSecurityIncidentCreation'
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/microsoft_security_incident_creation_alert_rule_common_properties.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/microsoft_security_incident_creation_alert_rule_common_properties.py
new file mode 100644
index 000000000000..94a855df7b8e
--- /dev/null
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/microsoft_security_incident_creation_alert_rule_common_properties.py
@@ -0,0 +1,49 @@
+# coding=utf-8
+# --------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See License.txt in the project root for
+# license information.
+#
+# Code generated by Microsoft (R) AutoRest Code Generator.
+# Changes may cause incorrect behavior and will be lost if the code is
+# regenerated.
+# --------------------------------------------------------------------------
+
+from msrest.serialization import Model
+
+
+class MicrosoftSecurityIncidentCreationAlertRuleCommonProperties(Model):
+    """MicrosoftSecurityIncidentCreation rule common property bag.
+
+    All required parameters must be populated in order to send to Azure.
+
+    :param display_names_filter: the alerts' displayNames on which the cases
+     will be generated
+    :type display_names_filter: list[str]
+    :param product_filter: Required. The alerts' productName on which the
+     cases will be generated. Possible values include: 'Microsoft Cloud App
+     Security', 'Azure Security Center', 'Azure Advanced Threat Protection',
+     'Azure Active Directory Identity Protection'
+    :type product_filter: str or
+     ~azure.mgmt.securityinsight.models.MicrosoftSecurityProductName
+    :param severities_filter: the alerts' severities on which the cases will
+     be generated
+    :type severities_filter: list[str or
+     ~azure.mgmt.securityinsight.models.AlertSeverity]
+    """
+
+    _validation = {
+        'product_filter': {'required': True},
+    }
+
+    _attribute_map = {
+        'display_names_filter': {'key': 'displayNamesFilter', 'type': '[str]'},
+        'product_filter': {'key': 'productFilter', 'type': 'str'},
+        'severities_filter': {'key': 'severitiesFilter', 'type': '[str]'},
+    }
+
+    def __init__(self, **kwargs):
+        super(MicrosoftSecurityIncidentCreationAlertRuleCommonProperties, self).__init__(**kwargs)
+        self.display_names_filter = kwargs.get('display_names_filter', None)
+        self.product_filter = kwargs.get('product_filter', None)
+        self.severities_filter = kwargs.get('severities_filter', None)
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/microsoft_security_incident_creation_alert_rule_common_properties_py3.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/microsoft_security_incident_creation_alert_rule_common_properties_py3.py
new file mode 100644
index 000000000000..bb573418c9fe
--- /dev/null
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/microsoft_security_incident_creation_alert_rule_common_properties_py3.py
@@ -0,0 +1,49 @@
+# coding=utf-8
+# --------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See License.txt in the project root for
+# license information.
+#
+# Code generated by Microsoft (R) AutoRest Code Generator.
+# Changes may cause incorrect behavior and will be lost if the code is
+# regenerated.
+# --------------------------------------------------------------------------
+
+from msrest.serialization import Model
+
+
+class MicrosoftSecurityIncidentCreationAlertRuleCommonProperties(Model):
+    """MicrosoftSecurityIncidentCreation rule common property bag.
+
+    All required parameters must be populated in order to send to Azure.
+
+    :param display_names_filter: the alerts' displayNames on which the cases
+     will be generated
+    :type display_names_filter: list[str]
+    :param product_filter: Required. The alerts' productName on which the
+     cases will be generated. Possible values include: 'Microsoft Cloud App
+     Security', 'Azure Security Center', 'Azure Advanced Threat Protection',
+     'Azure Active Directory Identity Protection'
+    :type product_filter: str or
+     ~azure.mgmt.securityinsight.models.MicrosoftSecurityProductName
+    :param severities_filter: the alerts' severities on which the cases will
+     be generated
+    :type severities_filter: list[str or
+     ~azure.mgmt.securityinsight.models.AlertSeverity]
+    """
+
+    _validation = {
+        'product_filter': {'required': True},
+    }
+
+    _attribute_map = {
+        'display_names_filter': {'key': 'displayNamesFilter', 'type': '[str]'},
+        'product_filter': {'key': 'productFilter', 'type': 'str'},
+        'severities_filter': {'key': 'severitiesFilter', 'type': '[str]'},
+    }
+
+    def __init__(self, *, product_filter, display_names_filter=None, severities_filter=None, **kwargs) -> None:
+        super(MicrosoftSecurityIncidentCreationAlertRuleCommonProperties, self).__init__(**kwargs)
+        self.display_names_filter = display_names_filter
+        self.product_filter = product_filter
+        self.severities_filter = severities_filter
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/microsoft_security_incident_creation_alert_rule_py3.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/microsoft_security_incident_creation_alert_rule_py3.py
new file mode 100644
index 000000000000..cf7a4c7f46c1
--- /dev/null
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/microsoft_security_incident_creation_alert_rule_py3.py
@@ -0,0 +1,91 @@
+# coding=utf-8
+# --------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See License.txt in the project root for
+# license information.
+#
+# Code generated by Microsoft (R) AutoRest Code Generator.
+# Changes may cause incorrect behavior and will be lost if the code is
+# regenerated.
+# --------------------------------------------------------------------------
+
+from .alert_rule_py3 import AlertRule
+
+
+class MicrosoftSecurityIncidentCreationAlertRule(AlertRule):
+    """Represents MicrosoftSecurityIncidentCreation rule.
+
+    Variables are only populated by the server, and will be ignored when
+    sending a request.
+
+    All required parameters must be populated in order to send to Azure.
+
+    :param etag: Etag of the azure resource
+    :type etag: str
+    :param kind: Required. Constant filled by server.
+    :type kind: str
+    :param display_names_filter: the alerts' displayNames on which the cases
+     will be generated
+    :type display_names_filter: list[str]
+    :param product_filter: Required. The alerts' productName on which the
+     cases will be generated. Possible values include: 'Microsoft Cloud App
+     Security', 'Azure Security Center', 'Azure Advanced Threat Protection',
+     'Azure Active Directory Identity Protection'
+    :type product_filter: str or
+     ~azure.mgmt.securityinsight.models.MicrosoftSecurityProductName
+    :param severities_filter: the alerts' severities on which the cases will
+     be generated
+    :type severities_filter: list[str or
+     ~azure.mgmt.securityinsight.models.AlertSeverity]
+    :param alert_rule_template_name: The Name of the alert rule template used
+     to create this rule.
+    :type alert_rule_template_name: str
+    :param description: The description of the alert rule.
+    :type description: str
+    :param display_name: Required. The display name for alerts created by this
+     alert rule.
+    :type display_name: str
+    :param enabled: Required. Determines whether this alert rule is enabled or
+     disabled.
+    :type enabled: bool
+    :ivar last_modified_utc: The last time that this alert has been modified.
+    :vartype last_modified_utc: datetime
+    :param tactics: The tactics of the alert rule
+    :type tactics: list[str or
+     ~azure.mgmt.securityinsight.models.AttackTactic]
+    """
+
+    _validation = {
+        'kind': {'required': True},
+        'product_filter': {'required': True},
+        'display_name': {'required': True},
+        'enabled': {'required': True},
+        'last_modified_utc': {'readonly': True},
+    }
+
+    _attribute_map = {
+        'etag': {'key': 'etag', 'type': 'str'},
+        'kind': {'key': 'kind', 'type': 'str'},
+        'display_names_filter': {'key': 'properties.displayNamesFilter', 'type': '[str]'},
+        'product_filter': {'key': 'properties.productFilter', 'type': 'str'},
+        'severities_filter': {'key': 'properties.severitiesFilter', 'type': '[str]'},
+        'alert_rule_template_name': {'key': 'properties.alertRuleTemplateName', 'type': 'str'},
+        'description': {'key': 'properties.description', 'type': 'str'},
+        'display_name': {'key': 'properties.displayName', 'type': 'str'},
+        'enabled': {'key': 'properties.enabled', 'type': 'bool'},
+        'last_modified_utc': {'key': 'properties.lastModifiedUtc', 'type': 'iso-8601'},
+        'tactics': {'key': 'properties.tactics', 'type': '[str]'},
+    }
+
+    def __init__(self, *, product_filter, display_name: str, enabled: bool, etag: str=None, display_names_filter=None, severities_filter=None, alert_rule_template_name: str=None, description: str=None, tactics=None, **kwargs) -> None:
+        super(MicrosoftSecurityIncidentCreationAlertRule, self).__init__(etag=etag, **kwargs)
+        self.display_names_filter = display_names_filter
+        self.product_filter = product_filter
+        self.severities_filter = severities_filter
+        self.alert_rule_template_name = alert_rule_template_name
+        self.description = description
+        self.display_name = display_name
+        self.enabled = enabled
+        self.last_modified_utc = None
+        self.tactics = tactics
+        self.kind = 'MicrosoftSecurityIncidentCreation'
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/filter_alert_rule_template.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/microsoft_security_incident_creation_alert_rule_template.py
similarity index 69%
rename from sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/filter_alert_rule_template.py
rename to sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/microsoft_security_incident_creation_alert_rule_template.py
index efa5fdd900d5..54ab62b4a465 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/filter_alert_rule_template.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/microsoft_security_incident_creation_alert_rule_template.py
@@ -12,8 +12,8 @@
 from .alert_rule_template import AlertRuleTemplate
 
 
-class FilterAlertRuleTemplate(AlertRuleTemplate):
-    """Represents filter alert rule template.
+class MicrosoftSecurityIncidentCreationAlertRuleTemplate(AlertRuleTemplate):
+    """Represents MicrosoftSecurityIncidentCreation rule template.
 
     Variables are only populated by the server, and will be ignored when
     sending a request.
@@ -26,8 +26,6 @@ class FilterAlertRuleTemplate(AlertRuleTemplate):
     :vartype name: str
     :ivar type: Azure resource type
     :vartype type: str
-    :param etag: Etag of the alert rule.
-    :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
     :param alert_rules_created_by_template_count: Required. the number of
@@ -35,7 +33,7 @@ class FilterAlertRuleTemplate(AlertRuleTemplate):
     :type alert_rules_created_by_template_count: int
     :ivar created_date_utc: Required. The time that this alert rule template
      has been added.
-    :vartype created_date_utc: str
+    :vartype created_date_utc: datetime
     :param description: Required. The description of the alert rule template.
     :type description: str
     :param display_name: Required. The display name for alert rule template.
@@ -50,16 +48,19 @@ class FilterAlertRuleTemplate(AlertRuleTemplate):
     :param tactics: The tactics of the alert rule template
     :type tactics: list[str or
      ~azure.mgmt.securityinsight.models.AttackTactic]
-    :param filter_product: Required. The filter product name for this template
-     rule.
-    :type filter_product: str
-    :param filter_severities: the alert’s severities on which the cases will
+    :param display_names_filter: the alerts' displayNames on which the cases
+     will be generated
+    :type display_names_filter: list[str]
+    :param product_filter: Required. The alerts' productName on which the
+     cases will be generated. Possible values include: 'Microsoft Cloud App
+     Security', 'Azure Security Center', 'Azure Advanced Threat Protection',
+     'Azure Active Directory Identity Protection'
+    :type product_filter: str or
+     ~azure.mgmt.securityinsight.models.MicrosoftSecurityProductName
+    :param severities_filter: the alerts' severities on which the cases will
      be generated
-    :type filter_severities: list[str or
+    :type severities_filter: list[str or
      ~azure.mgmt.securityinsight.models.AlertSeverity]
-    :param filter_titles: the alert’s titles on which the cases will be
-     generated
-    :type filter_titles: list[str]
     """
 
     _validation = {
@@ -72,29 +73,28 @@ class FilterAlertRuleTemplate(AlertRuleTemplate):
         'description': {'required': True},
         'display_name': {'required': True},
         'status': {'required': True},
-        'filter_product': {'required': True},
+        'product_filter': {'required': True},
     }
 
     _attribute_map = {
         'id': {'key': 'id', 'type': 'str'},
         'name': {'key': 'name', 'type': 'str'},
         'type': {'key': 'type', 'type': 'str'},
-        'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
         'alert_rules_created_by_template_count': {'key': 'properties.alertRulesCreatedByTemplateCount', 'type': 'int'},
-        'created_date_utc': {'key': 'properties.createdDateUTC', 'type': 'str'},
+        'created_date_utc': {'key': 'properties.createdDateUTC', 'type': 'iso-8601'},
         'description': {'key': 'properties.description', 'type': 'str'},
         'display_name': {'key': 'properties.displayName', 'type': 'str'},
         'required_data_connectors': {'key': 'properties.requiredDataConnectors', 'type': '[DataConnectorStatus]'},
-        'status': {'key': 'properties.status', 'type': 'TemplateStatus'},
-        'tactics': {'key': 'properties.tactics', 'type': '[AttackTactic]'},
-        'filter_product': {'key': 'properties.filterProduct', 'type': 'str'},
-        'filter_severities': {'key': 'properties.filterSeverities', 'type': '[AlertSeverity]'},
-        'filter_titles': {'key': 'properties.filterTitles', 'type': '[str]'},
+        'status': {'key': 'properties.status', 'type': 'str'},
+        'tactics': {'key': 'properties.tactics', 'type': '[str]'},
+        'display_names_filter': {'key': 'properties.displayNamesFilter', 'type': '[str]'},
+        'product_filter': {'key': 'properties.productFilter', 'type': 'str'},
+        'severities_filter': {'key': 'properties.severitiesFilter', 'type': '[str]'},
     }
 
     def __init__(self, **kwargs):
-        super(FilterAlertRuleTemplate, self).__init__(**kwargs)
+        super(MicrosoftSecurityIncidentCreationAlertRuleTemplate, self).__init__(**kwargs)
         self.alert_rules_created_by_template_count = kwargs.get('alert_rules_created_by_template_count', None)
         self.created_date_utc = None
         self.description = kwargs.get('description', None)
@@ -102,7 +102,7 @@ def __init__(self, **kwargs):
         self.required_data_connectors = kwargs.get('required_data_connectors', None)
         self.status = kwargs.get('status', None)
         self.tactics = kwargs.get('tactics', None)
-        self.filter_product = kwargs.get('filter_product', None)
-        self.filter_severities = kwargs.get('filter_severities', None)
-        self.filter_titles = kwargs.get('filter_titles', None)
-        self.kind = 'Filter'
+        self.display_names_filter = kwargs.get('display_names_filter', None)
+        self.product_filter = kwargs.get('product_filter', None)
+        self.severities_filter = kwargs.get('severities_filter', None)
+        self.kind = 'MicrosoftSecurityIncidentCreation'
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/filter_alert_rule_template_py3.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/microsoft_security_incident_creation_alert_rule_template_py3.py
similarity index 67%
rename from sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/filter_alert_rule_template_py3.py
rename to sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/microsoft_security_incident_creation_alert_rule_template_py3.py
index 336f635defa8..abb25078f6fc 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/filter_alert_rule_template_py3.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/microsoft_security_incident_creation_alert_rule_template_py3.py
@@ -12,8 +12,8 @@
 from .alert_rule_template_py3 import AlertRuleTemplate
 
 
-class FilterAlertRuleTemplate(AlertRuleTemplate):
-    """Represents filter alert rule template.
+class MicrosoftSecurityIncidentCreationAlertRuleTemplate(AlertRuleTemplate):
+    """Represents MicrosoftSecurityIncidentCreation rule template.
 
     Variables are only populated by the server, and will be ignored when
     sending a request.
@@ -26,8 +26,6 @@ class FilterAlertRuleTemplate(AlertRuleTemplate):
     :vartype name: str
     :ivar type: Azure resource type
     :vartype type: str
-    :param etag: Etag of the alert rule.
-    :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
     :param alert_rules_created_by_template_count: Required. the number of
@@ -35,7 +33,7 @@ class FilterAlertRuleTemplate(AlertRuleTemplate):
     :type alert_rules_created_by_template_count: int
     :ivar created_date_utc: Required. The time that this alert rule template
      has been added.
-    :vartype created_date_utc: str
+    :vartype created_date_utc: datetime
     :param description: Required. The description of the alert rule template.
     :type description: str
     :param display_name: Required. The display name for alert rule template.
@@ -50,16 +48,19 @@ class FilterAlertRuleTemplate(AlertRuleTemplate):
     :param tactics: The tactics of the alert rule template
     :type tactics: list[str or
      ~azure.mgmt.securityinsight.models.AttackTactic]
-    :param filter_product: Required. The filter product name for this template
-     rule.
-    :type filter_product: str
-    :param filter_severities: the alert’s severities on which the cases will
+    :param display_names_filter: the alerts' displayNames on which the cases
+     will be generated
+    :type display_names_filter: list[str]
+    :param product_filter: Required. The alerts' productName on which the
+     cases will be generated. Possible values include: 'Microsoft Cloud App
+     Security', 'Azure Security Center', 'Azure Advanced Threat Protection',
+     'Azure Active Directory Identity Protection'
+    :type product_filter: str or
+     ~azure.mgmt.securityinsight.models.MicrosoftSecurityProductName
+    :param severities_filter: the alerts' severities on which the cases will
      be generated
-    :type filter_severities: list[str or
+    :type severities_filter: list[str or
      ~azure.mgmt.securityinsight.models.AlertSeverity]
-    :param filter_titles: the alert’s titles on which the cases will be
-     generated
-    :type filter_titles: list[str]
     """
 
     _validation = {
@@ -72,29 +73,28 @@ class FilterAlertRuleTemplate(AlertRuleTemplate):
         'description': {'required': True},
         'display_name': {'required': True},
         'status': {'required': True},
-        'filter_product': {'required': True},
+        'product_filter': {'required': True},
     }
 
     _attribute_map = {
         'id': {'key': 'id', 'type': 'str'},
         'name': {'key': 'name', 'type': 'str'},
         'type': {'key': 'type', 'type': 'str'},
-        'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
         'alert_rules_created_by_template_count': {'key': 'properties.alertRulesCreatedByTemplateCount', 'type': 'int'},
-        'created_date_utc': {'key': 'properties.createdDateUTC', 'type': 'str'},
+        'created_date_utc': {'key': 'properties.createdDateUTC', 'type': 'iso-8601'},
         'description': {'key': 'properties.description', 'type': 'str'},
         'display_name': {'key': 'properties.displayName', 'type': 'str'},
         'required_data_connectors': {'key': 'properties.requiredDataConnectors', 'type': '[DataConnectorStatus]'},
-        'status': {'key': 'properties.status', 'type': 'TemplateStatus'},
-        'tactics': {'key': 'properties.tactics', 'type': '[AttackTactic]'},
-        'filter_product': {'key': 'properties.filterProduct', 'type': 'str'},
-        'filter_severities': {'key': 'properties.filterSeverities', 'type': '[AlertSeverity]'},
-        'filter_titles': {'key': 'properties.filterTitles', 'type': '[str]'},
+        'status': {'key': 'properties.status', 'type': 'str'},
+        'tactics': {'key': 'properties.tactics', 'type': '[str]'},
+        'display_names_filter': {'key': 'properties.displayNamesFilter', 'type': '[str]'},
+        'product_filter': {'key': 'properties.productFilter', 'type': 'str'},
+        'severities_filter': {'key': 'properties.severitiesFilter', 'type': '[str]'},
     }
 
-    def __init__(self, *, alert_rules_created_by_template_count: int, description: str, display_name: str, status, filter_product: str, etag: str=None, required_data_connectors=None, tactics=None, filter_severities=None, filter_titles=None, **kwargs) -> None:
-        super(FilterAlertRuleTemplate, self).__init__(etag=etag, **kwargs)
+    def __init__(self, *, alert_rules_created_by_template_count: int, description: str, display_name: str, status, product_filter, required_data_connectors=None, tactics=None, display_names_filter=None, severities_filter=None, **kwargs) -> None:
+        super(MicrosoftSecurityIncidentCreationAlertRuleTemplate, self).__init__(**kwargs)
         self.alert_rules_created_by_template_count = alert_rules_created_by_template_count
         self.created_date_utc = None
         self.description = description
@@ -102,7 +102,7 @@ def __init__(self, *, alert_rules_created_by_template_count: int, description: s
         self.required_data_connectors = required_data_connectors
         self.status = status
         self.tactics = tactics
-        self.filter_product = filter_product
-        self.filter_severities = filter_severities
-        self.filter_titles = filter_titles
-        self.kind = 'Filter'
+        self.display_names_filter = display_names_filter
+        self.product_filter = product_filter
+        self.severities_filter = severities_filter
+        self.kind = 'MicrosoftSecurityIncidentCreation'
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/office_data_connector.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/office_data_connector.py
index 4b949f95eb95..fc74f352150e 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/office_data_connector.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/office_data_connector.py
@@ -15,18 +15,9 @@
 class OfficeDataConnector(DataConnector):
     """Represents office data connector.
 
-    Variables are only populated by the server, and will be ignored when
-    sending a request.
-
     All required parameters must be populated in order to send to Azure.
 
-    :ivar id: Azure resource Id
-    :vartype id: str
-    :ivar name: Azure resource name
-    :vartype name: str
-    :ivar type: Azure resource type
-    :vartype type: str
-    :param etag: Etag of the data connector.
+    :param etag: Etag of the azure resource
     :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
@@ -38,16 +29,10 @@ class OfficeDataConnector(DataConnector):
     """
 
     _validation = {
-        'id': {'readonly': True},
-        'name': {'readonly': True},
-        'type': {'readonly': True},
         'kind': {'required': True},
     }
 
     _attribute_map = {
-        'id': {'key': 'id', 'type': 'str'},
-        'name': {'key': 'name', 'type': 'str'},
-        'type': {'key': 'type', 'type': 'str'},
         'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
         'tenant_id': {'key': 'properties.tenantId', 'type': 'str'},
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/office_data_connector_py3.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/office_data_connector_py3.py
index cfeba238e322..fd20446c8d9e 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/office_data_connector_py3.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/office_data_connector_py3.py
@@ -15,18 +15,9 @@
 class OfficeDataConnector(DataConnector):
     """Represents office data connector.
 
-    Variables are only populated by the server, and will be ignored when
-    sending a request.
-
     All required parameters must be populated in order to send to Azure.
 
-    :ivar id: Azure resource Id
-    :vartype id: str
-    :ivar name: Azure resource name
-    :vartype name: str
-    :ivar type: Azure resource type
-    :vartype type: str
-    :param etag: Etag of the data connector.
+    :param etag: Etag of the azure resource
     :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
@@ -38,16 +29,10 @@ class OfficeDataConnector(DataConnector):
     """
 
     _validation = {
-        'id': {'readonly': True},
-        'name': {'readonly': True},
-        'type': {'readonly': True},
         'kind': {'required': True},
     }
 
     _attribute_map = {
-        'id': {'key': 'id', 'type': 'str'},
-        'name': {'key': 'name', 'type': 'str'},
-        'type': {'key': 'type', 'type': 'str'},
         'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
         'tenant_id': {'key': 'properties.tenantId', 'type': 'str'},
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/resource_with_etag.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/resource_with_etag.py
new file mode 100644
index 000000000000..5b417d2ace84
--- /dev/null
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/resource_with_etag.py
@@ -0,0 +1,46 @@
+# coding=utf-8
+# --------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See License.txt in the project root for
+# license information.
+#
+# Code generated by Microsoft (R) AutoRest Code Generator.
+# Changes may cause incorrect behavior and will be lost if the code is
+# regenerated.
+# --------------------------------------------------------------------------
+
+from .resource import Resource
+
+
+class ResourceWithEtag(Resource):
+    """An azure resource object with an Etag property.
+
+    Variables are only populated by the server, and will be ignored when
+    sending a request.
+
+    :ivar id: Azure resource Id
+    :vartype id: str
+    :ivar name: Azure resource name
+    :vartype name: str
+    :ivar type: Azure resource type
+    :vartype type: str
+    :param etag: Etag of the azure resource
+    :type etag: str
+    """
+
+    _validation = {
+        'id': {'readonly': True},
+        'name': {'readonly': True},
+        'type': {'readonly': True},
+    }
+
+    _attribute_map = {
+        'id': {'key': 'id', 'type': 'str'},
+        'name': {'key': 'name', 'type': 'str'},
+        'type': {'key': 'type', 'type': 'str'},
+        'etag': {'key': 'etag', 'type': 'str'},
+    }
+
+    def __init__(self, **kwargs):
+        super(ResourceWithEtag, self).__init__(**kwargs)
+        self.etag = kwargs.get('etag', None)
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/resource_with_etag_py3.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/resource_with_etag_py3.py
new file mode 100644
index 000000000000..36b6bec523eb
--- /dev/null
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/resource_with_etag_py3.py
@@ -0,0 +1,46 @@
+# coding=utf-8
+# --------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See License.txt in the project root for
+# license information.
+#
+# Code generated by Microsoft (R) AutoRest Code Generator.
+# Changes may cause incorrect behavior and will be lost if the code is
+# regenerated.
+# --------------------------------------------------------------------------
+
+from .resource_py3 import Resource
+
+
+class ResourceWithEtag(Resource):
+    """An azure resource object with an Etag property.
+
+    Variables are only populated by the server, and will be ignored when
+    sending a request.
+
+    :ivar id: Azure resource Id
+    :vartype id: str
+    :ivar name: Azure resource name
+    :vartype name: str
+    :ivar type: Azure resource type
+    :vartype type: str
+    :param etag: Etag of the azure resource
+    :type etag: str
+    """
+
+    _validation = {
+        'id': {'readonly': True},
+        'name': {'readonly': True},
+        'type': {'readonly': True},
+    }
+
+    _attribute_map = {
+        'id': {'key': 'id', 'type': 'str'},
+        'name': {'key': 'name', 'type': 'str'},
+        'type': {'key': 'type', 'type': 'str'},
+        'etag': {'key': 'etag', 'type': 'str'},
+    }
+
+    def __init__(self, *, etag: str=None, **kwargs) -> None:
+        super(ResourceWithEtag, self).__init__(**kwargs)
+        self.etag = etag
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/scheduled_alert_rule.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/scheduled_alert_rule.py
index 593991140e7a..c24230eb45ab 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/scheduled_alert_rule.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/scheduled_alert_rule.py
@@ -20,17 +20,32 @@ class ScheduledAlertRule(AlertRule):
 
     All required parameters must be populated in order to send to Azure.
 
-    :ivar id: Azure resource Id
-    :vartype id: str
-    :ivar name: Azure resource name
-    :vartype name: str
-    :ivar type: Azure resource type
-    :vartype type: str
-    :param etag: Etag of the alert rule.
+    :param etag: Etag of the azure resource
     :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
-    :param description: Required. The description of the alert rule.
+    :param query: The query that creates alerts for this rule.
+    :type query: str
+    :param query_frequency: The frequency (in ISO 8601 duration format) for
+     this alert rule to run.
+    :type query_frequency: timedelta
+    :param query_period: The period (in ISO 8601 duration format) that this
+     alert rule looks at.
+    :type query_period: timedelta
+    :param severity: The severity for alerts created by this alert rule.
+     Possible values include: 'High', 'Medium', 'Low', 'Informational'
+    :type severity: str or ~azure.mgmt.securityinsight.models.AlertSeverity
+    :param trigger_operator: The operation against the threshold that triggers
+     alert rule. Possible values include: 'GreaterThan', 'LessThan', 'Equal',
+     'NotEqual'
+    :type trigger_operator: str or
+     ~azure.mgmt.securityinsight.models.TriggerOperator
+    :param trigger_threshold: The threshold triggers this alert rule.
+    :type trigger_threshold: int
+    :param alert_rule_template_name: The Name of the alert rule template used
+     to create this rule.
+    :type alert_rule_template_name: str
+    :param description: The description of the alert rule.
     :type description: str
     :param display_name: Required. The display name for alerts created by this
      alert rule.
@@ -38,86 +53,62 @@ class ScheduledAlertRule(AlertRule):
     :param enabled: Required. Determines whether this alert rule is enabled or
      disabled.
     :type enabled: bool
-    :ivar last_modified_utc: The last time that this alert has been modified.
-    :vartype last_modified_utc: str
-    :param query: Required. The query that creates alerts for this rule.
-    :type query: str
-    :param query_frequency: Required. The frequency (in ISO 8601 duration
-     format) for this alert rule to run.
-    :type query_frequency: timedelta
-    :param query_period: Required. The period (in ISO 8601 duration format)
-     that this alert rule looks at.
-    :type query_period: timedelta
-    :param severity: Required. The severity for alerts created by this alert
-     rule. Possible values include: 'High', 'Medium', 'Low', 'Informational'
-    :type severity: str or ~azure.mgmt.securityinsight.models.AlertSeverity
+    :ivar last_modified_utc: The last time that this alert rule has been
+     modified.
+    :vartype last_modified_utc: datetime
     :param suppression_duration: Required. The suppression (in ISO 8601
      duration format) to wait since last time this alert rule been triggered.
     :type suppression_duration: timedelta
     :param suppression_enabled: Required. Determines whether the suppression
      for this alert rule is enabled or disabled.
     :type suppression_enabled: bool
-    :param trigger_operator: Required. The operation against the threshold
-     that triggers alert rule. Possible values include: 'GreaterThan',
-     'LessThan', 'Equal', 'NotEqual'
-    :type trigger_operator: str or
-     ~azure.mgmt.securityinsight.models.TriggerOperator
-    :param trigger_threshold: Required. The threshold triggers this alert
-     rule.
-    :type trigger_threshold: int
+    :param tactics: The tactics of the alert rule
+    :type tactics: list[str or
+     ~azure.mgmt.securityinsight.models.AttackTactic]
     """
 
     _validation = {
-        'id': {'readonly': True},
-        'name': {'readonly': True},
-        'type': {'readonly': True},
         'kind': {'required': True},
-        'description': {'required': True},
         'display_name': {'required': True},
         'enabled': {'required': True},
         'last_modified_utc': {'readonly': True},
-        'query': {'required': True},
-        'query_frequency': {'required': True},
-        'query_period': {'required': True},
-        'severity': {'required': True},
         'suppression_duration': {'required': True},
         'suppression_enabled': {'required': True},
-        'trigger_operator': {'required': True},
-        'trigger_threshold': {'required': True},
     }
 
     _attribute_map = {
-        'id': {'key': 'id', 'type': 'str'},
-        'name': {'key': 'name', 'type': 'str'},
-        'type': {'key': 'type', 'type': 'str'},
         'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
-        'description': {'key': 'properties.description', 'type': 'str'},
-        'display_name': {'key': 'properties.displayName', 'type': 'str'},
-        'enabled': {'key': 'properties.enabled', 'type': 'bool'},
-        'last_modified_utc': {'key': 'properties.lastModifiedUtc', 'type': 'str'},
         'query': {'key': 'properties.query', 'type': 'str'},
         'query_frequency': {'key': 'properties.queryFrequency', 'type': 'duration'},
         'query_period': {'key': 'properties.queryPeriod', 'type': 'duration'},
-        'severity': {'key': 'properties.severity', 'type': 'AlertSeverity'},
-        'suppression_duration': {'key': 'properties.suppressionDuration', 'type': 'duration'},
-        'suppression_enabled': {'key': 'properties.suppressionEnabled', 'type': 'bool'},
+        'severity': {'key': 'properties.severity', 'type': 'str'},
         'trigger_operator': {'key': 'properties.triggerOperator', 'type': 'TriggerOperator'},
         'trigger_threshold': {'key': 'properties.triggerThreshold', 'type': 'int'},
+        'alert_rule_template_name': {'key': 'properties.alertRuleTemplateName', 'type': 'str'},
+        'description': {'key': 'properties.description', 'type': 'str'},
+        'display_name': {'key': 'properties.displayName', 'type': 'str'},
+        'enabled': {'key': 'properties.enabled', 'type': 'bool'},
+        'last_modified_utc': {'key': 'properties.lastModifiedUtc', 'type': 'iso-8601'},
+        'suppression_duration': {'key': 'properties.suppressionDuration', 'type': 'duration'},
+        'suppression_enabled': {'key': 'properties.suppressionEnabled', 'type': 'bool'},
+        'tactics': {'key': 'properties.tactics', 'type': '[str]'},
     }
 
     def __init__(self, **kwargs):
         super(ScheduledAlertRule, self).__init__(**kwargs)
-        self.description = kwargs.get('description', None)
-        self.display_name = kwargs.get('display_name', None)
-        self.enabled = kwargs.get('enabled', None)
-        self.last_modified_utc = None
         self.query = kwargs.get('query', None)
         self.query_frequency = kwargs.get('query_frequency', None)
         self.query_period = kwargs.get('query_period', None)
         self.severity = kwargs.get('severity', None)
-        self.suppression_duration = kwargs.get('suppression_duration', None)
-        self.suppression_enabled = kwargs.get('suppression_enabled', None)
         self.trigger_operator = kwargs.get('trigger_operator', None)
         self.trigger_threshold = kwargs.get('trigger_threshold', None)
+        self.alert_rule_template_name = kwargs.get('alert_rule_template_name', None)
+        self.description = kwargs.get('description', None)
+        self.display_name = kwargs.get('display_name', None)
+        self.enabled = kwargs.get('enabled', None)
+        self.last_modified_utc = None
+        self.suppression_duration = kwargs.get('suppression_duration', None)
+        self.suppression_enabled = kwargs.get('suppression_enabled', None)
+        self.tactics = kwargs.get('tactics', None)
         self.kind = 'Scheduled'
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/scheduled_alert_rule_template_properties_model.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/scheduled_alert_rule_common_properties.py
similarity index 91%
rename from sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/scheduled_alert_rule_template_properties_model.py
rename to sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/scheduled_alert_rule_common_properties.py
index a4fb3d14dcae..a294796cfb50 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/scheduled_alert_rule_template_properties_model.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/scheduled_alert_rule_common_properties.py
@@ -12,7 +12,7 @@
 from msrest.serialization import Model
 
 
-class ScheduledAlertRuleTemplatePropertiesModel(Model):
+class ScheduledAlertRuleCommonProperties(Model):
     """Schedule alert rule template property bag.
 
     :param query: The query that creates alerts for this rule.
@@ -39,13 +39,13 @@ class ScheduledAlertRuleTemplatePropertiesModel(Model):
         'query': {'key': 'query', 'type': 'str'},
         'query_frequency': {'key': 'queryFrequency', 'type': 'duration'},
         'query_period': {'key': 'queryPeriod', 'type': 'duration'},
-        'severity': {'key': 'severity', 'type': 'AlertSeverity'},
+        'severity': {'key': 'severity', 'type': 'str'},
         'trigger_operator': {'key': 'triggerOperator', 'type': 'TriggerOperator'},
         'trigger_threshold': {'key': 'triggerThreshold', 'type': 'int'},
     }
 
     def __init__(self, **kwargs):
-        super(ScheduledAlertRuleTemplatePropertiesModel, self).__init__(**kwargs)
+        super(ScheduledAlertRuleCommonProperties, self).__init__(**kwargs)
         self.query = kwargs.get('query', None)
         self.query_frequency = kwargs.get('query_frequency', None)
         self.query_period = kwargs.get('query_period', None)
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/scheduled_alert_rule_template_properties_model_py3.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/scheduled_alert_rule_common_properties_py3.py
similarity index 91%
rename from sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/scheduled_alert_rule_template_properties_model_py3.py
rename to sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/scheduled_alert_rule_common_properties_py3.py
index c3bbc79bdcbb..cc8c35f2f34a 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/scheduled_alert_rule_template_properties_model_py3.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/scheduled_alert_rule_common_properties_py3.py
@@ -12,7 +12,7 @@
 from msrest.serialization import Model
 
 
-class ScheduledAlertRuleTemplatePropertiesModel(Model):
+class ScheduledAlertRuleCommonProperties(Model):
     """Schedule alert rule template property bag.
 
     :param query: The query that creates alerts for this rule.
@@ -39,13 +39,13 @@ class ScheduledAlertRuleTemplatePropertiesModel(Model):
         'query': {'key': 'query', 'type': 'str'},
         'query_frequency': {'key': 'queryFrequency', 'type': 'duration'},
         'query_period': {'key': 'queryPeriod', 'type': 'duration'},
-        'severity': {'key': 'severity', 'type': 'AlertSeverity'},
+        'severity': {'key': 'severity', 'type': 'str'},
         'trigger_operator': {'key': 'triggerOperator', 'type': 'TriggerOperator'},
         'trigger_threshold': {'key': 'triggerThreshold', 'type': 'int'},
     }
 
     def __init__(self, *, query: str=None, query_frequency=None, query_period=None, severity=None, trigger_operator=None, trigger_threshold: int=None, **kwargs) -> None:
-        super(ScheduledAlertRuleTemplatePropertiesModel, self).__init__(**kwargs)
+        super(ScheduledAlertRuleCommonProperties, self).__init__(**kwargs)
         self.query = query
         self.query_frequency = query_frequency
         self.query_period = query_period
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/scheduled_alert_rule_py3.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/scheduled_alert_rule_py3.py
index bd4a525e841a..31e539891990 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/scheduled_alert_rule_py3.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/scheduled_alert_rule_py3.py
@@ -20,17 +20,32 @@ class ScheduledAlertRule(AlertRule):
 
     All required parameters must be populated in order to send to Azure.
 
-    :ivar id: Azure resource Id
-    :vartype id: str
-    :ivar name: Azure resource name
-    :vartype name: str
-    :ivar type: Azure resource type
-    :vartype type: str
-    :param etag: Etag of the alert rule.
+    :param etag: Etag of the azure resource
     :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
-    :param description: Required. The description of the alert rule.
+    :param query: The query that creates alerts for this rule.
+    :type query: str
+    :param query_frequency: The frequency (in ISO 8601 duration format) for
+     this alert rule to run.
+    :type query_frequency: timedelta
+    :param query_period: The period (in ISO 8601 duration format) that this
+     alert rule looks at.
+    :type query_period: timedelta
+    :param severity: The severity for alerts created by this alert rule.
+     Possible values include: 'High', 'Medium', 'Low', 'Informational'
+    :type severity: str or ~azure.mgmt.securityinsight.models.AlertSeverity
+    :param trigger_operator: The operation against the threshold that triggers
+     alert rule. Possible values include: 'GreaterThan', 'LessThan', 'Equal',
+     'NotEqual'
+    :type trigger_operator: str or
+     ~azure.mgmt.securityinsight.models.TriggerOperator
+    :param trigger_threshold: The threshold triggers this alert rule.
+    :type trigger_threshold: int
+    :param alert_rule_template_name: The Name of the alert rule template used
+     to create this rule.
+    :type alert_rule_template_name: str
+    :param description: The description of the alert rule.
     :type description: str
     :param display_name: Required. The display name for alerts created by this
      alert rule.
@@ -38,86 +53,62 @@ class ScheduledAlertRule(AlertRule):
     :param enabled: Required. Determines whether this alert rule is enabled or
      disabled.
     :type enabled: bool
-    :ivar last_modified_utc: The last time that this alert has been modified.
-    :vartype last_modified_utc: str
-    :param query: Required. The query that creates alerts for this rule.
-    :type query: str
-    :param query_frequency: Required. The frequency (in ISO 8601 duration
-     format) for this alert rule to run.
-    :type query_frequency: timedelta
-    :param query_period: Required. The period (in ISO 8601 duration format)
-     that this alert rule looks at.
-    :type query_period: timedelta
-    :param severity: Required. The severity for alerts created by this alert
-     rule. Possible values include: 'High', 'Medium', 'Low', 'Informational'
-    :type severity: str or ~azure.mgmt.securityinsight.models.AlertSeverity
+    :ivar last_modified_utc: The last time that this alert rule has been
+     modified.
+    :vartype last_modified_utc: datetime
     :param suppression_duration: Required. The suppression (in ISO 8601
      duration format) to wait since last time this alert rule been triggered.
     :type suppression_duration: timedelta
     :param suppression_enabled: Required. Determines whether the suppression
      for this alert rule is enabled or disabled.
     :type suppression_enabled: bool
-    :param trigger_operator: Required. The operation against the threshold
-     that triggers alert rule. Possible values include: 'GreaterThan',
-     'LessThan', 'Equal', 'NotEqual'
-    :type trigger_operator: str or
-     ~azure.mgmt.securityinsight.models.TriggerOperator
-    :param trigger_threshold: Required. The threshold triggers this alert
-     rule.
-    :type trigger_threshold: int
+    :param tactics: The tactics of the alert rule
+    :type tactics: list[str or
+     ~azure.mgmt.securityinsight.models.AttackTactic]
     """
 
     _validation = {
-        'id': {'readonly': True},
-        'name': {'readonly': True},
-        'type': {'readonly': True},
         'kind': {'required': True},
-        'description': {'required': True},
         'display_name': {'required': True},
         'enabled': {'required': True},
         'last_modified_utc': {'readonly': True},
-        'query': {'required': True},
-        'query_frequency': {'required': True},
-        'query_period': {'required': True},
-        'severity': {'required': True},
         'suppression_duration': {'required': True},
         'suppression_enabled': {'required': True},
-        'trigger_operator': {'required': True},
-        'trigger_threshold': {'required': True},
     }
 
     _attribute_map = {
-        'id': {'key': 'id', 'type': 'str'},
-        'name': {'key': 'name', 'type': 'str'},
-        'type': {'key': 'type', 'type': 'str'},
         'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
-        'description': {'key': 'properties.description', 'type': 'str'},
-        'display_name': {'key': 'properties.displayName', 'type': 'str'},
-        'enabled': {'key': 'properties.enabled', 'type': 'bool'},
-        'last_modified_utc': {'key': 'properties.lastModifiedUtc', 'type': 'str'},
         'query': {'key': 'properties.query', 'type': 'str'},
         'query_frequency': {'key': 'properties.queryFrequency', 'type': 'duration'},
         'query_period': {'key': 'properties.queryPeriod', 'type': 'duration'},
-        'severity': {'key': 'properties.severity', 'type': 'AlertSeverity'},
-        'suppression_duration': {'key': 'properties.suppressionDuration', 'type': 'duration'},
-        'suppression_enabled': {'key': 'properties.suppressionEnabled', 'type': 'bool'},
+        'severity': {'key': 'properties.severity', 'type': 'str'},
         'trigger_operator': {'key': 'properties.triggerOperator', 'type': 'TriggerOperator'},
         'trigger_threshold': {'key': 'properties.triggerThreshold', 'type': 'int'},
+        'alert_rule_template_name': {'key': 'properties.alertRuleTemplateName', 'type': 'str'},
+        'description': {'key': 'properties.description', 'type': 'str'},
+        'display_name': {'key': 'properties.displayName', 'type': 'str'},
+        'enabled': {'key': 'properties.enabled', 'type': 'bool'},
+        'last_modified_utc': {'key': 'properties.lastModifiedUtc', 'type': 'iso-8601'},
+        'suppression_duration': {'key': 'properties.suppressionDuration', 'type': 'duration'},
+        'suppression_enabled': {'key': 'properties.suppressionEnabled', 'type': 'bool'},
+        'tactics': {'key': 'properties.tactics', 'type': '[str]'},
     }
 
-    def __init__(self, *, description: str, display_name: str, enabled: bool, query: str, query_frequency, query_period, severity, suppression_duration, suppression_enabled: bool, trigger_operator, trigger_threshold: int, etag: str=None, **kwargs) -> None:
+    def __init__(self, *, display_name: str, enabled: bool, suppression_duration, suppression_enabled: bool, etag: str=None, query: str=None, query_frequency=None, query_period=None, severity=None, trigger_operator=None, trigger_threshold: int=None, alert_rule_template_name: str=None, description: str=None, tactics=None, **kwargs) -> None:
         super(ScheduledAlertRule, self).__init__(etag=etag, **kwargs)
-        self.description = description
-        self.display_name = display_name
-        self.enabled = enabled
-        self.last_modified_utc = None
         self.query = query
         self.query_frequency = query_frequency
         self.query_period = query_period
         self.severity = severity
-        self.suppression_duration = suppression_duration
-        self.suppression_enabled = suppression_enabled
         self.trigger_operator = trigger_operator
         self.trigger_threshold = trigger_threshold
+        self.alert_rule_template_name = alert_rule_template_name
+        self.description = description
+        self.display_name = display_name
+        self.enabled = enabled
+        self.last_modified_utc = None
+        self.suppression_duration = suppression_duration
+        self.suppression_enabled = suppression_enabled
+        self.tactics = tactics
         self.kind = 'Scheduled'
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/scheduled_alert_rule_template.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/scheduled_alert_rule_template.py
index 70ae747c907a..a9909549ed53 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/scheduled_alert_rule_template.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/scheduled_alert_rule_template.py
@@ -26,22 +26,20 @@ class ScheduledAlertRuleTemplate(AlertRuleTemplate):
     :vartype name: str
     :ivar type: Azure resource type
     :vartype type: str
-    :param etag: Etag of the alert rule.
-    :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
     :param alert_rules_created_by_template_count: Required. the number of
      alert rules that were created by this template
     :type alert_rules_created_by_template_count: int
-    :ivar created_date_utc: Required. The time that this alert rule template
-     has been added.
-    :vartype created_date_utc: str
+    :ivar created_date_utc: The time that this alert rule template has been
+     added.
+    :vartype created_date_utc: datetime
     :param description: Required. The description of the alert rule template.
     :type description: str
     :param display_name: Required. The display name for alert rule template.
     :type display_name: str
-    :param required_data_connectors: Required. The required data connectors
-     for this template
+    :param required_data_connectors: The required data connectors for this
+     template
     :type required_data_connectors:
      list[~azure.mgmt.securityinsight.models.DataConnectorStatus]
     :param status: Required. The alert rule template status. Possible values
@@ -77,10 +75,9 @@ class ScheduledAlertRuleTemplate(AlertRuleTemplate):
         'type': {'readonly': True},
         'kind': {'required': True},
         'alert_rules_created_by_template_count': {'required': True},
-        'created_date_utc': {'required': True, 'readonly': True},
+        'created_date_utc': {'readonly': True},
         'description': {'required': True},
         'display_name': {'required': True},
-        'required_data_connectors': {'required': True},
         'status': {'required': True},
         'query': {'required': True},
         'query_frequency': {'required': True},
@@ -94,19 +91,18 @@ class ScheduledAlertRuleTemplate(AlertRuleTemplate):
         'id': {'key': 'id', 'type': 'str'},
         'name': {'key': 'name', 'type': 'str'},
         'type': {'key': 'type', 'type': 'str'},
-        'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
         'alert_rules_created_by_template_count': {'key': 'properties.alertRulesCreatedByTemplateCount', 'type': 'int'},
-        'created_date_utc': {'key': 'properties.createdDateUTC', 'type': 'str'},
+        'created_date_utc': {'key': 'properties.createdDateUTC', 'type': 'iso-8601'},
         'description': {'key': 'properties.description', 'type': 'str'},
         'display_name': {'key': 'properties.displayName', 'type': 'str'},
         'required_data_connectors': {'key': 'properties.requiredDataConnectors', 'type': '[DataConnectorStatus]'},
-        'status': {'key': 'properties.status', 'type': 'TemplateStatus'},
-        'tactics': {'key': 'properties.tactics', 'type': '[AttackTactic]'},
+        'status': {'key': 'properties.status', 'type': 'str'},
+        'tactics': {'key': 'properties.tactics', 'type': '[str]'},
         'query': {'key': 'properties.query', 'type': 'str'},
         'query_frequency': {'key': 'properties.queryFrequency', 'type': 'duration'},
         'query_period': {'key': 'properties.queryPeriod', 'type': 'duration'},
-        'severity': {'key': 'properties.severity', 'type': 'AlertSeverity'},
+        'severity': {'key': 'properties.severity', 'type': 'str'},
         'trigger_operator': {'key': 'properties.triggerOperator', 'type': 'TriggerOperator'},
         'trigger_threshold': {'key': 'properties.triggerThreshold', 'type': 'int'},
     }
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/scheduled_alert_rule_template_py3.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/scheduled_alert_rule_template_py3.py
index 80cf1f7061e7..0c157a653bf3 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/scheduled_alert_rule_template_py3.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/scheduled_alert_rule_template_py3.py
@@ -26,22 +26,20 @@ class ScheduledAlertRuleTemplate(AlertRuleTemplate):
     :vartype name: str
     :ivar type: Azure resource type
     :vartype type: str
-    :param etag: Etag of the alert rule.
-    :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
     :param alert_rules_created_by_template_count: Required. the number of
      alert rules that were created by this template
     :type alert_rules_created_by_template_count: int
-    :ivar created_date_utc: Required. The time that this alert rule template
-     has been added.
-    :vartype created_date_utc: str
+    :ivar created_date_utc: The time that this alert rule template has been
+     added.
+    :vartype created_date_utc: datetime
     :param description: Required. The description of the alert rule template.
     :type description: str
     :param display_name: Required. The display name for alert rule template.
     :type display_name: str
-    :param required_data_connectors: Required. The required data connectors
-     for this template
+    :param required_data_connectors: The required data connectors for this
+     template
     :type required_data_connectors:
      list[~azure.mgmt.securityinsight.models.DataConnectorStatus]
     :param status: Required. The alert rule template status. Possible values
@@ -77,10 +75,9 @@ class ScheduledAlertRuleTemplate(AlertRuleTemplate):
         'type': {'readonly': True},
         'kind': {'required': True},
         'alert_rules_created_by_template_count': {'required': True},
-        'created_date_utc': {'required': True, 'readonly': True},
+        'created_date_utc': {'readonly': True},
         'description': {'required': True},
         'display_name': {'required': True},
-        'required_data_connectors': {'required': True},
         'status': {'required': True},
         'query': {'required': True},
         'query_frequency': {'required': True},
@@ -94,25 +91,24 @@ class ScheduledAlertRuleTemplate(AlertRuleTemplate):
         'id': {'key': 'id', 'type': 'str'},
         'name': {'key': 'name', 'type': 'str'},
         'type': {'key': 'type', 'type': 'str'},
-        'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
         'alert_rules_created_by_template_count': {'key': 'properties.alertRulesCreatedByTemplateCount', 'type': 'int'},
-        'created_date_utc': {'key': 'properties.createdDateUTC', 'type': 'str'},
+        'created_date_utc': {'key': 'properties.createdDateUTC', 'type': 'iso-8601'},
         'description': {'key': 'properties.description', 'type': 'str'},
         'display_name': {'key': 'properties.displayName', 'type': 'str'},
         'required_data_connectors': {'key': 'properties.requiredDataConnectors', 'type': '[DataConnectorStatus]'},
-        'status': {'key': 'properties.status', 'type': 'TemplateStatus'},
-        'tactics': {'key': 'properties.tactics', 'type': '[AttackTactic]'},
+        'status': {'key': 'properties.status', 'type': 'str'},
+        'tactics': {'key': 'properties.tactics', 'type': '[str]'},
         'query': {'key': 'properties.query', 'type': 'str'},
         'query_frequency': {'key': 'properties.queryFrequency', 'type': 'duration'},
         'query_period': {'key': 'properties.queryPeriod', 'type': 'duration'},
-        'severity': {'key': 'properties.severity', 'type': 'AlertSeverity'},
+        'severity': {'key': 'properties.severity', 'type': 'str'},
         'trigger_operator': {'key': 'properties.triggerOperator', 'type': 'TriggerOperator'},
         'trigger_threshold': {'key': 'properties.triggerThreshold', 'type': 'int'},
     }
 
-    def __init__(self, *, alert_rules_created_by_template_count: int, description: str, display_name: str, required_data_connectors, status, query: str, query_frequency, query_period, severity, trigger_operator, trigger_threshold: int, etag: str=None, tactics=None, **kwargs) -> None:
-        super(ScheduledAlertRuleTemplate, self).__init__(etag=etag, **kwargs)
+    def __init__(self, *, alert_rules_created_by_template_count: int, description: str, display_name: str, status, query: str, query_frequency, query_period, severity, trigger_operator, trigger_threshold: int, required_data_connectors=None, tactics=None, **kwargs) -> None:
+        super(ScheduledAlertRuleTemplate, self).__init__(**kwargs)
         self.alert_rules_created_by_template_count = alert_rules_created_by_template_count
         self.created_date_utc = None
         self.description = description
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/security_alert.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/security_alert.py
index 08389e3f53a6..95e4924b16f5 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/security_alert.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/security_alert.py
@@ -150,7 +150,7 @@ class SecurityAlert(Entity):
         'product_name': {'key': 'properties.productName', 'type': 'str'},
         'product_version': {'key': 'properties.productVersion', 'type': 'str'},
         'remediation_steps': {'key': 'properties.remediationSteps', 'type': '[str]'},
-        'severity': {'key': 'properties.severity', 'type': 'AlertSeverity'},
+        'severity': {'key': 'properties.severity', 'type': 'str'},
         'start_time_utc': {'key': 'properties.startTimeUtc', 'type': 'iso-8601'},
         'status': {'key': 'properties.status', 'type': 'str'},
         'system_alert_id': {'key': 'properties.systemAlertId', 'type': 'str'},
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/security_alert_py3.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/security_alert_py3.py
index 7dbee6ed09bf..14eb65bbe561 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/security_alert_py3.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/security_alert_py3.py
@@ -150,7 +150,7 @@ class SecurityAlert(Entity):
         'product_name': {'key': 'properties.productName', 'type': 'str'},
         'product_version': {'key': 'properties.productVersion', 'type': 'str'},
         'remediation_steps': {'key': 'properties.remediationSteps', 'type': '[str]'},
-        'severity': {'key': 'properties.severity', 'type': 'AlertSeverity'},
+        'severity': {'key': 'properties.severity', 'type': 'str'},
         'start_time_utc': {'key': 'properties.startTimeUtc', 'type': 'iso-8601'},
         'status': {'key': 'properties.status', 'type': 'str'},
         'system_alert_id': {'key': 'properties.systemAlertId', 'type': 'str'},
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/security_insights_enums.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/security_insights_enums.py
index 2a41713e0e40..1fbe9fafa771 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/security_insights_enums.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/security_insights_enums.py
@@ -20,24 +20,21 @@ class AggregationsKind(str, Enum):
 class AlertRuleKind(str, Enum):
 
     scheduled = "Scheduled"
-    filter = "Filter"
+    microsoft_security_incident_creation = "MicrosoftSecurityIncidentCreation"
     fusion = "Fusion"
 
 
-class TriggerOperator(str, Enum):
+class DataTypeStatus(str, Enum):
 
-    greater_than = "GreaterThan"
-    less_than = "LessThan"
-    equal = "Equal"
-    not_equal = "NotEqual"
+    exist = "Exist"
+    not_exist = "NotExist"
 
 
-class AlertSeverity(str, Enum):
+class TemplateStatus(str, Enum):
 
-    high = "High"  #: High severity
-    medium = "Medium"  #: Medium severity
-    low = "Low"  #: Low severity
-    informational = "Informational"  #: Informational severity
+    installed = "Installed"  #: Alert rule template installed. and can not use more then once
+    available = "Available"  #: Alert rule template is available.
+    not_available = "NotAvailable"  #: Alert rule template is not available
 
 
 class AttackTactic(str, Enum):
@@ -53,19 +50,23 @@ class AttackTactic(str, Enum):
     collection = "Collection"
     exfiltration = "Exfiltration"
     command_and_control = "CommandAndControl"
+    impact = "Impact"
 
 
-class DataTypeStatus(str, Enum):
+class TriggerOperator(str, Enum):
 
-    exist = "Exist"
-    not_exist = "NotExist"
+    greater_than = "GreaterThan"
+    less_than = "LessThan"
+    equal = "Equal"
+    not_equal = "NotEqual"
 
 
-class TemplateStatus(str, Enum):
+class AlertSeverity(str, Enum):
 
-    installed = "Installed"  #: Alert rule template installed. and can not use more then once
-    available = "Available"  #: Alert rule template is available.
-    not_available = "NotAvailable"  #: Alert rule template is not available
+    high = "High"  #: High severity
+    medium = "Medium"  #: Medium severity
+    low = "Low"  #: Low severity
+    informational = "Informational"  #: Informational severity
 
 
 class CloseReason(str, Enum):
@@ -169,6 +170,14 @@ class OSFamily(str, Enum):
     ios = "IOS"  #: Host with IOS operating system.
 
 
+class MicrosoftSecurityProductName(str, Enum):
+
+    microsoft_cloud_app_security = "Microsoft Cloud App Security"
+    azure_security_center = "Azure Security Center"
+    azure_advanced_threat_protection = "Azure Advanced Threat Protection"
+    azure_active_directory_identity_protection = "Azure Active Directory Identity Protection"
+
+
 class ElevationToken(str, Enum):
 
     default = "Default"  #: Default elevation token
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/settings.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/settings.py
index c750e2bc48e4..dae2f113b97f 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/settings.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/settings.py
@@ -18,34 +18,19 @@ class Settings(Model):
     You probably want to use the sub-classes and not this class directly. Known
     sub-classes are: ToggleSettings, UebaSettings
 
-    Variables are only populated by the server, and will be ignored when
-    sending a request.
-
     All required parameters must be populated in order to send to Azure.
 
-    :ivar id: Azure resource Id
-    :vartype id: str
-    :ivar name: Azure resource name
-    :vartype name: str
-    :ivar type: Azure resource type
-    :vartype type: str
-    :param etag: Etag of the alert rule.
+    :param etag: Etag of the azure resource
     :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
     """
 
     _validation = {
-        'id': {'readonly': True},
-        'name': {'readonly': True},
-        'type': {'readonly': True},
         'kind': {'required': True},
     }
 
     _attribute_map = {
-        'id': {'key': 'id', 'type': 'str'},
-        'name': {'key': 'name', 'type': 'str'},
-        'type': {'key': 'type', 'type': 'str'},
         'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
     }
@@ -56,8 +41,5 @@ class Settings(Model):
 
     def __init__(self, **kwargs):
         super(Settings, self).__init__(**kwargs)
-        self.id = None
-        self.name = None
-        self.type = None
         self.etag = kwargs.get('etag', None)
         self.kind = None
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/settings_py3.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/settings_py3.py
index 089c8ed2f9f2..8973d82ff5d8 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/settings_py3.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/settings_py3.py
@@ -18,34 +18,19 @@ class Settings(Model):
     You probably want to use the sub-classes and not this class directly. Known
     sub-classes are: ToggleSettings, UebaSettings
 
-    Variables are only populated by the server, and will be ignored when
-    sending a request.
-
     All required parameters must be populated in order to send to Azure.
 
-    :ivar id: Azure resource Id
-    :vartype id: str
-    :ivar name: Azure resource name
-    :vartype name: str
-    :ivar type: Azure resource type
-    :vartype type: str
-    :param etag: Etag of the alert rule.
+    :param etag: Etag of the azure resource
     :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
     """
 
     _validation = {
-        'id': {'readonly': True},
-        'name': {'readonly': True},
-        'type': {'readonly': True},
         'kind': {'required': True},
     }
 
     _attribute_map = {
-        'id': {'key': 'id', 'type': 'str'},
-        'name': {'key': 'name', 'type': 'str'},
-        'type': {'key': 'type', 'type': 'str'},
         'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
     }
@@ -56,8 +41,5 @@ class Settings(Model):
 
     def __init__(self, *, etag: str=None, **kwargs) -> None:
         super(Settings, self).__init__(**kwargs)
-        self.id = None
-        self.name = None
-        self.type = None
         self.etag = etag
         self.kind = None
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/ti_data_connector.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/ti_data_connector.py
index 2646b72ca05f..e09a23aad36d 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/ti_data_connector.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/ti_data_connector.py
@@ -15,18 +15,9 @@
 class TIDataConnector(DataConnector):
     """Represents threat intelligence data connector.
 
-    Variables are only populated by the server, and will be ignored when
-    sending a request.
-
     All required parameters must be populated in order to send to Azure.
 
-    :ivar id: Azure resource Id
-    :vartype id: str
-    :ivar name: Azure resource name
-    :vartype name: str
-    :ivar type: Azure resource type
-    :vartype type: str
-    :param etag: Etag of the data connector.
+    :param etag: Etag of the azure resource
     :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
@@ -38,16 +29,10 @@ class TIDataConnector(DataConnector):
     """
 
     _validation = {
-        'id': {'readonly': True},
-        'name': {'readonly': True},
-        'type': {'readonly': True},
         'kind': {'required': True},
     }
 
     _attribute_map = {
-        'id': {'key': 'id', 'type': 'str'},
-        'name': {'key': 'name', 'type': 'str'},
-        'type': {'key': 'type', 'type': 'str'},
         'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
         'tenant_id': {'key': 'properties.tenantId', 'type': 'str'},
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/ti_data_connector_py3.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/ti_data_connector_py3.py
index 89c59201d756..762872e152b6 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/ti_data_connector_py3.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/ti_data_connector_py3.py
@@ -15,18 +15,9 @@
 class TIDataConnector(DataConnector):
     """Represents threat intelligence data connector.
 
-    Variables are only populated by the server, and will be ignored when
-    sending a request.
-
     All required parameters must be populated in order to send to Azure.
 
-    :ivar id: Azure resource Id
-    :vartype id: str
-    :ivar name: Azure resource name
-    :vartype name: str
-    :ivar type: Azure resource type
-    :vartype type: str
-    :param etag: Etag of the data connector.
+    :param etag: Etag of the azure resource
     :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
@@ -38,16 +29,10 @@ class TIDataConnector(DataConnector):
     """
 
     _validation = {
-        'id': {'readonly': True},
-        'name': {'readonly': True},
-        'type': {'readonly': True},
         'kind': {'required': True},
     }
 
     _attribute_map = {
-        'id': {'key': 'id', 'type': 'str'},
-        'name': {'key': 'name', 'type': 'str'},
-        'type': {'key': 'type', 'type': 'str'},
         'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
         'tenant_id': {'key': 'properties.tenantId', 'type': 'str'},
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/toggle_settings.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/toggle_settings.py
index 36502e60dbdd..c1aa73d9806d 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/toggle_settings.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/toggle_settings.py
@@ -15,18 +15,9 @@
 class ToggleSettings(Settings):
     """Settings with single toggle.
 
-    Variables are only populated by the server, and will be ignored when
-    sending a request.
-
     All required parameters must be populated in order to send to Azure.
 
-    :ivar id: Azure resource Id
-    :vartype id: str
-    :ivar name: Azure resource name
-    :vartype name: str
-    :ivar type: Azure resource type
-    :vartype type: str
-    :param etag: Etag of the alert rule.
+    :param etag: Etag of the azure resource
     :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
@@ -35,16 +26,10 @@ class ToggleSettings(Settings):
     """
 
     _validation = {
-        'id': {'readonly': True},
-        'name': {'readonly': True},
-        'type': {'readonly': True},
         'kind': {'required': True},
     }
 
     _attribute_map = {
-        'id': {'key': 'id', 'type': 'str'},
-        'name': {'key': 'name', 'type': 'str'},
-        'type': {'key': 'type', 'type': 'str'},
         'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
         'is_enabled': {'key': 'properties.isEnabled', 'type': 'bool'},
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/toggle_settings_py3.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/toggle_settings_py3.py
index 89c03ac3811f..0fa3ac767a2c 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/toggle_settings_py3.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/toggle_settings_py3.py
@@ -15,18 +15,9 @@
 class ToggleSettings(Settings):
     """Settings with single toggle.
 
-    Variables are only populated by the server, and will be ignored when
-    sending a request.
-
     All required parameters must be populated in order to send to Azure.
 
-    :ivar id: Azure resource Id
-    :vartype id: str
-    :ivar name: Azure resource name
-    :vartype name: str
-    :ivar type: Azure resource type
-    :vartype type: str
-    :param etag: Etag of the alert rule.
+    :param etag: Etag of the azure resource
     :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
@@ -35,16 +26,10 @@ class ToggleSettings(Settings):
     """
 
     _validation = {
-        'id': {'readonly': True},
-        'name': {'readonly': True},
-        'type': {'readonly': True},
         'kind': {'required': True},
     }
 
     _attribute_map = {
-        'id': {'key': 'id', 'type': 'str'},
-        'name': {'key': 'name', 'type': 'str'},
-        'type': {'key': 'type', 'type': 'str'},
         'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
         'is_enabled': {'key': 'properties.isEnabled', 'type': 'bool'},
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/ueba_settings.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/ueba_settings.py
index ec00bd0be8c3..621f9d5ba15c 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/ueba_settings.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/ueba_settings.py
@@ -20,13 +20,7 @@ class UebaSettings(Settings):
 
     All required parameters must be populated in order to send to Azure.
 
-    :ivar id: Azure resource Id
-    :vartype id: str
-    :ivar name: Azure resource name
-    :vartype name: str
-    :ivar type: Azure resource type
-    :vartype type: str
-    :param etag: Etag of the alert rule.
+    :param etag: Etag of the azure resource
     :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
@@ -45,18 +39,12 @@ class UebaSettings(Settings):
     """
 
     _validation = {
-        'id': {'readonly': True},
-        'name': {'readonly': True},
-        'type': {'readonly': True},
         'kind': {'required': True},
         'atp_license_status': {'readonly': True},
         'status_in_mcas': {'readonly': True},
     }
 
     _attribute_map = {
-        'id': {'key': 'id', 'type': 'str'},
-        'name': {'key': 'name', 'type': 'str'},
-        'type': {'key': 'type', 'type': 'str'},
         'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
         'atp_license_status': {'key': 'properties.atpLicenseStatus', 'type': 'str'},
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/ueba_settings_py3.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/ueba_settings_py3.py
index fac8652b9ea2..86912996f197 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/ueba_settings_py3.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/ueba_settings_py3.py
@@ -20,13 +20,7 @@ class UebaSettings(Settings):
 
     All required parameters must be populated in order to send to Azure.
 
-    :ivar id: Azure resource Id
-    :vartype id: str
-    :ivar name: Azure resource name
-    :vartype name: str
-    :ivar type: Azure resource type
-    :vartype type: str
-    :param etag: Etag of the alert rule.
+    :param etag: Etag of the azure resource
     :type etag: str
     :param kind: Required. Constant filled by server.
     :type kind: str
@@ -45,18 +39,12 @@ class UebaSettings(Settings):
     """
 
     _validation = {
-        'id': {'readonly': True},
-        'name': {'readonly': True},
-        'type': {'readonly': True},
         'kind': {'required': True},
         'atp_license_status': {'readonly': True},
         'status_in_mcas': {'readonly': True},
     }
 
     _attribute_map = {
-        'id': {'key': 'id', 'type': 'str'},
-        'name': {'key': 'name', 'type': 'str'},
-        'type': {'key': 'type', 'type': 'str'},
         'etag': {'key': 'etag', 'type': 'str'},
         'kind': {'key': 'kind', 'type': 'str'},
         'atp_license_status': {'key': 'properties.atpLicenseStatus', 'type': 'str'},
diff --git a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/operations/alert_rules_operations.py b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/operations/alert_rules_operations.py
index 9f246b8a89f9..b658e128a757 100644
--- a/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/operations/alert_rules_operations.py
+++ b/sdk/azure-mgmt-securityinsight/azure/mgmt/securityinsight/operations/alert_rules_operations.py
@@ -410,7 +410,7 @@ def create_or_update_action(
         :type rule_id: str
         :param action_id: Action ID
         :type action_id: str
-        :param etag: Etag of the action.
+        :param etag: Etag of the azure resource
         :type etag: str
         :param trigger_uri: The uri for the action to trigger.
         :type trigger_uri: str