Skip to content

Commit 48bdeb7

Browse files
roherzberoherzbe
authored
New Incidents stable version (Azure#14000)
* New stable version * revert ApiVersion change * add operation * Add operations to README * Add missing definition * Fix ApiVersion * Change ApiVersion * Add update & delete incident comments * extracting to common file * Revert "extracting to common file" * Add new API calls * add parameters * new parameters * fix conflict * fix conflict 2 * Add integer format * fix readme * fix Duplicate Schema * fix ApiVersion * ApiVersionParameter * resolve conflict * fix APIVersion * Add Incident Relations * Add missing parameters * fix typo * Add API version to common * modelAsString * revert last 2 changes * Text changes in some descriptions
1 parent f4a4bad commit 48bdeb7

19 files changed

+4683
-4
lines changed

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-04-01/Incidents.json‎

Lines changed: 3866 additions & 0 deletions
Large diffs are not rendered by default.

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-04-01/examples/incidents/CreateIncident.json‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
{
2+
"parameters": {
3+
"api-version": "2021-04-01",
4+
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
5+
"resourceGroupName": "myRg",
6+
"workspaceName": "myWorkspace",
7+
"incidentId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
8+
"incident": {
9+
"etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
10+
"properties": {
11+
"lastActivityTimeUtc": "2019-01-01T13:05:30Z",
12+
"firstActivityTimeUtc": "2019-01-01T13:00:30Z",
13+
"description": "This is a demo incident",
14+
"title": "My incident",
15+
"owner": {
16+
"objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70"
17+
},
18+
"severity": "High",
19+
"classification": "FalsePositive",
20+
"classificationComment": "Not a malicious activity",
21+
"classificationReason": "IncorrectAlertLogic",
22+
"status": "Closed"
23+
}
24+
}
25+
},
26+
"responses": {
27+
"200": {
28+
"body": {
29+
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
30+
"name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
31+
"type": "Microsoft.SecurityInsights/incidents",
32+
"etag": "\"0300bf09-0000-0000-0000-5c37296e0001\"",
33+
"properties": {
34+
"lastModifiedTimeUtc": "2019-01-01T13:15:30Z",
35+
"createdTimeUtc": "2019-01-01T13:15:30Z",
36+
"lastActivityTimeUtc": "2019-01-01T13:05:30Z",
37+
"firstActivityTimeUtc": "2019-01-01T13:00:30Z",
38+
"description": "This is a demo incident",
39+
"title": "My incident",
40+
"owner": {
41+
"objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
42+
"email": "[email protected]",
43+
"userPrincipalName": "[email protected]",
44+
"assignedTo": "john doe"
45+
},
46+
"severity": "High",
47+
"classification": "FalsePositive",
48+
"classificationComment": "Not a malicious activity",
49+
"classificationReason": "IncorrectAlertLogic",
50+
"status": "Closed",
51+
"incidentUrl": "https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
52+
"incidentNumber": 3177,
53+
"labels": [],
54+
"relatedAnalyticRuleIds": [],
55+
"additionalData": {
56+
"alertsCount": 0,
57+
"bookmarksCount": 0,
58+
"commentsCount": 3,
59+
"alertProductNames": [],
60+
"tactics": []
61+
}
62+
}
63+
}
64+
},
65+
"201": {
66+
"body": {
67+
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
68+
"name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
69+
"type": "Microsoft.SecurityInsights/incidents",
70+
"etag": "\"0300bf09-0000-0000-0000-5c37296e0001\"",
71+
"properties": {
72+
"lastModifiedTimeUtc": "2019-01-01T13:15:30Z",
73+
"createdTimeUtc": "2019-01-01T13:15:30Z",
74+
"lastActivityTimeUtc": "2019-01-01T13:05:30Z",
75+
"firstActivityTimeUtc": "2019-01-01T13:00:30Z",
76+
"description": "This is a demo incident",
77+
"title": "My incident",
78+
"owner": {
79+
"objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
80+
"email": "[email protected]",
81+
"userPrincipalName": "[email protected]",
82+
"assignedTo": "john doe"
83+
},
84+
"severity": "High",
85+
"classification": "FalsePositive",
86+
"classificationComment": "Not a malicious activity",
87+
"classificationReason": "IncorrectAlertLogic",
88+
"status": "Closed",
89+
"incidentUrl": "https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
90+
"incidentNumber": 3177,
91+
"labels": [],
92+
"relatedAnalyticRuleIds": [],
93+
"additionalData": {
94+
"alertsCount": 0,
95+
"bookmarksCount": 0,
96+
"commentsCount": 3,
97+
"alertProductNames": [],
98+
"tactics": []
99+
}
100+
}
101+
}
102+
}
103+
}
104+
}

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-04-01/examples/incidents/DeleteIncident.json‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{
2+
"parameters": {
3+
"api-version": "2021-04-01",
4+
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
5+
"resourceGroupName": "myRg",
6+
"workspaceName": "myWorkspace",
7+
"incidentId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5"
8+
},
9+
"responses": {
10+
"200": {},
11+
"204": {}
12+
}
13+
}

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-04-01/examples/incidents/GetAllIncidentAlerts.json‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{
2+
"parameters": {
3+
"api-version": "2021-04-01",
4+
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
5+
"resourceGroupName": "myRg",
6+
"workspaceName": "myWorkspace",
7+
"incidentId": "afbd324f-6c48-459c-8710-8d1e1cd03812"
8+
},
9+
"responses": {
10+
"200": {
11+
"body": {
12+
"value": [
13+
{
14+
"id": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/myRG/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/Entities/baa8a239-6fde-4ab7-a093-d09f7b75c58c",
15+
"name": "baa8a239-6fde-4ab7-a093-d09f7b75c58c",
16+
"type": "Microsoft.SecurityInsights/Entities",
17+
"kind": "SecurityAlert",
18+
"properties": {
19+
"systemAlertId": "baa8a239-6fde-4ab7-a093-d09f7b75c58c",
20+
"tactics": [],
21+
"alertDisplayName": "myAlert",
22+
"confidenceLevel": "Unknown",
23+
"severity": "Low",
24+
"vendorName": "Microsoft",
25+
"productName": "Azure Security Center",
26+
"alertType": "myAlert",
27+
"processingEndTime": "2020-07-20T18:21:53.6158361Z",
28+
"status": "New",
29+
"endTimeUtc": "2020-07-20T18:21:53.6158361Z",
30+
"startTimeUtc": "2020-07-20T18:21:53.6158361Z",
31+
"timeGenerated": "2020-07-20T18:21:53.6158361Z",
32+
"resourceIdentifiers": [
33+
{
34+
"type": "LogAnalytics",
35+
"workspaceId": "c8c99641-985d-4e4e-8e91-fb3466cd0e5b",
36+
"subscriptionId": "bd794837-4d29-4647-9105-6339bfdb4e6a",
37+
"resourceGroup": "myRG"
38+
}
39+
],
40+
"additionalData": {
41+
"AlertMessageEnqueueTime": "2020-07-20T18:21:57.304Z"
42+
},
43+
"friendlyName": "myAlert"
44+
}
45+
}
46+
]
47+
}
48+
}
49+
}
50+
}

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-04-01/examples/incidents/GetAllIncidentBookmarks.json‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
{
2+
"parameters": {
3+
"api-version": "2021-04-01",
4+
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
5+
"resourceGroupName": "myRg",
6+
"workspaceName": "myWorkspace",
7+
"incidentId": "afbd324f-6c48-459c-8710-8d1e1cd03812"
8+
},
9+
"responses": {
10+
"200": {
11+
"body": {
12+
"value": [
13+
{
14+
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/bookmarks/afbd324f-6c48-459c-8710-8d1e1cd03812",
15+
"name": "afbd324f-6c48-459c-8710-8d1e1cd03812",
16+
"type": "Microsoft.SecurityInsights/Entities",
17+
"kind": "Bookmark",
18+
"properties": {
19+
"displayName": "SecurityEvent - 868f40f4698d",
20+
"created": "2020-06-17T15:34:01.4265524+00:00",
21+
"updated": "2020-06-17T15:34:01.4265524+00:00",
22+
"createdBy": {
23+
"objectId": "b03ca914-5eb6-45e5-9417-fe0797c372fd",
24+
"email": "[email protected]",
25+
"name": "user"
26+
},
27+
"updatedBy": {
28+
"objectId": "b03ca914-5eb6-45e5-9417-fe0797c372fd",
29+
"email": "[email protected]",
30+
"name": "user"
31+
},
32+
"eventTime": "2020-06-17T15:34:01.4265524+00:00",
33+
"labels": [],
34+
"query": "SecurityEvent\r\n| take 1\n",
35+
"queryResult": "{\"TimeGenerated\":\"2020-05-24T01:24:25.67Z\",\"Account\":\"\\\\ADMINISTRATOR\",\"AccountType\":\"User\",\"Computer\":\"SecurityEvents\",\"EventSourceName\":\"Microsoft-Windows-Security-Auditing\",\"Channel\":\"Security\",\"Task\":12544,\"Level\":\"16\",\"EventID\":4625,\"Activity\":\"4625 - An account failed to log on.\",\"AuthenticationPackageName\":\"NTLM\",\"FailureReason\":\"%%2313\",\"IpAddress\":\"176.113.115.73\",\"IpPort\":\"0\",\"LmPackageName\":\"-\",\"LogonProcessName\":\"NtLmSsp \",\"LogonType\":3,\"LogonTypeName\":\"3 - Network\",\"Process\":\"-\",\"ProcessId\":\"0x0\",\"__entityMapping\":{\"\\\\ADMINISTRATOR\":\"Account\",\"SecurityEvents\":\"Host\"}}",
36+
"additionalData": {
37+
"ETag": "\"3b00acab-0000-0d00-0000-5f15e4ed0000\"",
38+
"EntityId": "afbd324f-6c48-459c-8710-8d1e1cd03812"
39+
},
40+
"friendlyName": "SecurityEvent - 868f40f4698d"
41+
}
42+
},
43+
{
44+
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/bookmarks/bbbd324f-6c48-459c-8710-8d1e1cd03812",
45+
"name": "bbbd324f-6c48-459c-8710-8d1e1cd03812",
46+
"type": "Microsoft.SecurityInsights/Entities",
47+
"kind": "Bookmark",
48+
"properties": {
49+
"displayName": "SecurityEvent - 868f40f4698d",
50+
"created": "2020-06-17T15:34:01.4265524+00:00",
51+
"updated": "2020-06-17T15:34:01.4265524+00:00",
52+
"createdBy": {
53+
"objectId": "303ca914-5eb6-45e5-9417-fe0797c372fd",
54+
"email": "[email protected]",
55+
"name": "user"
56+
},
57+
"updatedBy": {
58+
"objectId": "b03ca914-5eb6-45e5-9417-fe0797c372fd",
59+
"email": "[email protected]",
60+
"name": "user"
61+
},
62+
"eventTime": "2020-06-17T15:34:01.4265524+00:00",
63+
"labels": [],
64+
"query": "SecurityEvent\r\n| take 1\n",
65+
"queryResult": "{\"TimeGenerated\":\"2020-05-24T01:24:25.67Z\",\"Account\":\"\\\\ADMINISTRATOR\",\"AccountType\":\"User\",\"Computer\":\"SecurityEvents\",\"EventSourceName\":\"Microsoft-Windows-Security-Auditing\",\"Channel\":\"Security\",\"Task\":12544,\"Level\":\"16\",\"EventID\":4625,\"Activity\":\"4625 - An account failed to log on.\",\"AuthenticationPackageName\":\"NTLM\",\"FailureReason\":\"%%2313\",\"IpAddress\":\"176.113.115.73\",\"IpPort\":\"0\",\"LmPackageName\":\"-\",\"LogonProcessName\":\"NtLmSsp \",\"LogonType\":3,\"LogonTypeName\":\"3 - Network\",\"Process\":\"-\",\"ProcessId\":\"0x0\",\"__entityMapping\":{\"\\\\ADMINISTRATOR\":\"Account\",\"SecurityEvents\":\"Host\"}}",
66+
"additionalData": {
67+
"ETag": "\"3b00acab-0000-0d00-0000-5f15e4ed0000\"",
68+
"EntityId": "afbd324f-6c48-459c-8710-8d1e1cd03812"
69+
},
70+
"friendlyName": "SecurityEvent - 868f40f4698d"
71+
}
72+
}
73+
]
74+
}
75+
}
76+
}
77+
}

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-04-01/examples/incidents/GetAllIncidentEntities.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"parameters": {
3+
"api-version": "2021-04-01",
4+
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
5+
"resourceGroupName": "myRg",
6+
"workspaceName": "myWorkspace",
7+
"incidentId": "afbd324f-6c48-459c-8710-8d1e1cd03812"
8+
},
9+
"responses": {
10+
"200": {
11+
"body": {
12+
"entities": [
13+
{
14+
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/Entities/e1d3d618-e11f-478b-98e3-bb381539a8e1",
15+
"name": "e1d3d618-e11f-478b-98e3-bb381539a8e1",
16+
"type": "Microsoft.SecurityInsights/Entities",
17+
"kind": "Account",
18+
"properties": {
19+
"friendlyName": "administrator",
20+
"accountName": "administrator",
21+
"ntDomain": "domain"
22+
}
23+
}
24+
],
25+
"metaData": [
26+
{
27+
"entityKind": "Account",
28+
"count": 1
29+
}
30+
]
31+
}
32+
}
33+
}
34+
}

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-04-01/examples/incidents/GetIncidentById.json‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
{
2+
"parameters": {
3+
"api-version": "2021-04-01",
4+
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
5+
"resourceGroupName": "myRg",
6+
"workspaceName": "myWorkspace",
7+
"incidentId": "73e01a99-5cd7-4139-a149-9f2736ff2ab5"
8+
},
9+
"responses": {
10+
"200": {
11+
"body": {
12+
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
13+
"name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
14+
"type": "Microsoft.SecurityInsights/incidents",
15+
"etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
16+
"properties": {
17+
"lastModifiedTimeUtc": "2019-01-01T13:15:30Z",
18+
"createdTimeUtc": "2019-01-01T13:15:30Z",
19+
"lastActivityTimeUtc": "2019-01-01T13:05:30Z",
20+
"firstActivityTimeUtc": "2019-01-01T13:00:30Z",
21+
"description": "This is a demo incident",
22+
"title": "My incident",
23+
"owner": {
24+
"objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
25+
"email": "[email protected]",
26+
"userPrincipalName": "[email protected]",
27+
"assignedTo": "john doe"
28+
},
29+
"severity": "High",
30+
"classification": "FalsePositive",
31+
"classificationComment": "Not a malicious activity",
32+
"classificationReason": "InaccurateData",
33+
"status": "Closed",
34+
"incidentUrl": "https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
35+
"incidentNumber": 3177,
36+
"labels": [],
37+
"relatedAnalyticRuleIds": [
38+
"/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/fab3d2d4-747f-46a7-8ef0-9c0be8112bf7"
39+
],
40+
"additionalData": {
41+
"alertsCount": 0,
42+
"bookmarksCount": 0,
43+
"commentsCount": 3,
44+
"alertProductNames": [],
45+
"tactics": [
46+
"InitialAccess",
47+
"Persistence"
48+
]
49+
}
50+
}
51+
}
52+
}
53+
}
54+
}

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-04-01/examples/incidents/GetIncidents.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"parameters": {
3+
"api-version": "2021-04-01",
4+
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
5+
"resourceGroupName": "myRg",
6+
"workspaceName": "myWorkspace",
7+
"$orderby": "properties/createdTimeUtc desc",
8+
"$top": 1
9+
},
10+
"responses": {
11+
"200": {
12+
"body": {
13+
"value": [
14+
{
15+
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
16+
"name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
17+
"type": "Microsoft.SecurityInsights/incidents",
18+
"etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
19+
"properties": {
20+
"lastModifiedTimeUtc": "2019-01-01T13:15:30Z",
21+
"createdTimeUtc": "2019-01-01T13:15:30Z",
22+
"lastActivityTimeUtc": "2019-01-01T13:05:30Z",
23+
"firstActivityTimeUtc": "2019-01-01T13:00:30Z",
24+
"description": "This is a demo incident",
25+
"title": "My incident",
26+
"owner": {
27+
"objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
28+
"email": "[email protected]",
29+
"userPrincipalName": "[email protected]",
30+
"assignedTo": "john doe"
31+
},
32+
"severity": "High",
33+
"classification": "FalsePositive",
34+
"classificationComment": "Not a malicious activity",
35+
"classificationReason": "IncorrectAlertLogic",
36+
"status": "Closed",
37+
"incidentUrl": "https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
38+
"incidentNumber": 3177,
39+
"labels": [],
40+
"relatedAnalyticRuleIds": [
41+
"/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/fab3d2d4-747f-46a7-8ef0-9c0be8112bf7",
42+
"/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/8deb8303-e94d-46ff-96e0-5fd94b33df1a"
43+
],
44+
"additionalData": {
45+
"alertsCount": 0,
46+
"bookmarksCount": 0,
47+
"commentsCount": 3,
48+
"alertProductNames": [],
49+
"tactics": [
50+
"Persistence"
51+
]
52+
}
53+
}
54+
}
55+
]
56+
}
57+
}
58+
}
59+
}

0 commit comments

Comments
 (0)