Skip to content

Commit 3a1da75

Browse files
laithhishamlaithhisham
authored
[Hub Generated] Review request for Microsoft.SecurityInsights to add version preview/2021-10-01-preview (#17837)
* extract MicrosoftSecurityProductName to enum * extract AlertRuleTemplateStatus to enum * define FusionAlertRuleTemplateProperties * add back nested properties * add flatten to mitre and fusion properties objects * change position of required * define MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties * align required + add flatten * fix AlertSeverity ref * align type to avoid breaking change * add type for MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties
1 parent d2d4855 commit 3a1da75

File tree

1 file changed

+111
-68
lines changed
  • specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-10-01-preview

1 file changed

+111
-68
lines changed

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-10-01-preview/AlertRules.json‎

Lines changed: 111 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -705,35 +705,39 @@
705705
"type": "array"
706706
},
707707
"status": {
708-
"description": "The alert rule template status.",
709-
"enum": [
710-
"Installed",
711-
"Available",
712-
"NotAvailable"
713-
],
714-
"type": "string",
715-
"x-ms-enum": {
716-
"modelAsString": true,
717-
"name": "TemplateStatus",
718-
"values": [
719-
{
720-
"description": "Alert rule template installed. and can not use more then once",
721-
"value": "Installed"
722-
},
723-
{
724-
"description": "Alert rule template is available.",
725-
"value": "Available"
726-
},
727-
{
728-
"description": "Alert rule template is not available",
729-
"value": "NotAvailable"
730-
}
731-
]
732-
}
708+
"$ref": "#/definitions/AlertRuleTemplateStatus",
709+
"description": "The alert rule template status."
733710
}
734711
},
735712
"type": "object"
736713
},
714+
"AlertRuleTemplateStatus": {
715+
"description": "The alert rule template status.",
716+
"enum": [
717+
"Installed",
718+
"Available",
719+
"NotAvailable"
720+
],
721+
"type": "string",
722+
"x-ms-enum": {
723+
"modelAsString": true,
724+
"name": "TemplateStatus",
725+
"values": [
726+
{
727+
"description": "Alert rule template installed. and can not use more then once",
728+
"value": "Installed"
729+
},
730+
{
731+
"description": "Alert rule template is available.",
732+
"value": "Available"
733+
},
734+
{
735+
"description": "Alert rule template is not available",
736+
"value": "NotAvailable"
737+
}
738+
]
739+
}
740+
},
737741
"AlertRuleTemplateWithMitreProperties": {
738742
"allOf": [
739743
{
@@ -1164,26 +1168,8 @@
11641168
"description": "Represents Fusion alert rule template.",
11651169
"properties": {
11661170
"properties": {
1167-
"allOf": [
1168-
{
1169-
"$ref": "#/definitions/AlertRuleTemplateWithMitreProperties"
1170-
}
1171-
],
1171+
"$ref": "#/definitions/FusionAlertRuleTemplateProperties",
11721172
"description": "Fusion alert rule template properties",
1173-
"properties": {
1174-
"severity": {
1175-
"$ref": "./common/AlertTypes.json#/definitions/AlertSeverityEnum",
1176-
"description": "The severity for alerts created by this alert rule."
1177-
},
1178-
"sourceSettings": {
1179-
"description": "All supported source signal configurations consumed in fusion detection.",
1180-
"items": {
1181-
"$ref": "#/definitions/FusionTemplateSourceSetting"
1182-
},
1183-
"x-ms-identifiers": [],
1184-
"type": "array"
1185-
}
1186-
},
11871173
"required": [
11881174
"displayName",
11891175
"description",
@@ -1192,13 +1178,36 @@
11921178
"sourceSettings",
11931179
"alertRulesCreatedByTemplateCount"
11941180
],
1195-
"type": "object",
11961181
"x-ms-client-flatten": true
11971182
}
11981183
},
11991184
"type": "object",
12001185
"x-ms-discriminator-value": "Fusion"
12011186
},
1187+
"FusionAlertRuleTemplateProperties": {
1188+
"allOf": [
1189+
{
1190+
"$ref": "#/definitions/AlertRuleTemplateWithMitreProperties"
1191+
}
1192+
],
1193+
"description": "Fusion alert rule template properties",
1194+
"properties": {
1195+
"severity": {
1196+
"$ref": "./common/AlertTypes.json#/definitions/AlertSeverityEnum",
1197+
"description": "The severity for alerts created by this alert rule."
1198+
},
1199+
"sourceSettings": {
1200+
"description": "All supported source signal configurations consumed in fusion detection.",
1201+
"items": {
1202+
"$ref": "#/definitions/FusionTemplateSourceSetting"
1203+
},
1204+
"x-ms-identifiers": [],
1205+
"type": "array"
1206+
}
1207+
},
1208+
"type": "object",
1209+
"x-ms-client-flatten": true
1210+
},
12021211
"FusionTemplateSourceSetting": {
12031212
"description": "Represents a source signal consumed in Fusion detection.",
12041213
"properties": {
@@ -1407,21 +1416,8 @@
14071416
"type": "array"
14081417
},
14091418
"productFilter": {
1410-
"description": "The alerts' productName on which the cases will be generated",
1411-
"enum": [
1412-
"Microsoft Cloud App Security",
1413-
"Azure Security Center",
1414-
"Azure Advanced Threat Protection",
1415-
"Azure Active Directory Identity Protection",
1416-
"Azure Security Center for IoT",
1417-
"Office 365 Advanced Threat Protection",
1418-
"Microsoft Defender Advanced Threat Protection"
1419-
],
1420-
"type": "string",
1421-
"x-ms-enum": {
1422-
"modelAsString": true,
1423-
"name": "MicrosoftSecurityProductName"
1424-
}
1419+
"$ref": "#/definitions/MicrosoftSecurityProductName",
1420+
"description": "The alerts' productName on which the cases will be generated"
14251421
},
14261422
"severitiesFilter": {
14271423
"description": "the alerts' severities on which the cases will be generated",
@@ -1436,6 +1432,23 @@
14361432
],
14371433
"type": "object"
14381434
},
1435+
"MicrosoftSecurityProductName": {
1436+
"description": "The alerts' productName on which the cases will be generated",
1437+
"enum": [
1438+
"Microsoft Cloud App Security",
1439+
"Azure Security Center",
1440+
"Azure Advanced Threat Protection",
1441+
"Azure Active Directory Identity Protection",
1442+
"Azure Security Center for IoT",
1443+
"Office 365 Advanced Threat Protection",
1444+
"Microsoft Defender Advanced Threat Protection"
1445+
],
1446+
"type": "string",
1447+
"x-ms-enum": {
1448+
"modelAsString": true,
1449+
"name": "MicrosoftSecurityProductName"
1450+
}
1451+
},
14391452
"MicrosoftSecurityIncidentCreationAlertRuleProperties": {
14401453
"allOf": [
14411454
{
@@ -1483,14 +1496,7 @@
14831496
"description": "Represents MicrosoftSecurityIncidentCreation rule template.",
14841497
"properties": {
14851498
"properties": {
1486-
"allOf": [
1487-
{
1488-
"$ref": "#/definitions/AlertRuleTemplatePropertiesBase"
1489-
},
1490-
{
1491-
"$ref": "#/definitions/MicrosoftSecurityIncidentCreationAlertRuleCommonProperties"
1492-
}
1493-
],
1499+
"$ref": "#/definitions/MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties",
14941500
"description": "MicrosoftSecurityIncidentCreation rule template properties",
14951501
"required": [
14961502
"displayName",
@@ -1506,6 +1512,43 @@
15061512
"type": "object",
15071513
"x-ms-discriminator-value": "MicrosoftSecurityIncidentCreation"
15081514
},
1515+
"MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties": {
1516+
"allOf": [
1517+
{
1518+
"$ref": "#/definitions/AlertRuleTemplatePropertiesBase"
1519+
}
1520+
],
1521+
"description": "MicrosoftSecurityIncidentCreation rule template properties",
1522+
"properties": {
1523+
"displayNamesFilter": {
1524+
"description": "the alerts' displayNames on which the cases will be generated",
1525+
"items": {
1526+
"type": "string"
1527+
},
1528+
"type": "array"
1529+
},
1530+
"displayNamesExcludeFilter": {
1531+
"description": "the alerts' displayNames on which the cases will not be generated",
1532+
"items": {
1533+
"type": "string"
1534+
},
1535+
"type": "array"
1536+
},
1537+
"productFilter": {
1538+
"$ref": "#/definitions/MicrosoftSecurityProductName",
1539+
"description": "The alerts' productName on which the cases will be generated"
1540+
},
1541+
"severitiesFilter": {
1542+
"description": "the alerts' severities on which the cases will be generated",
1543+
"items": {
1544+
"$ref": "./common/AlertTypes.json#/definitions/AlertSeverityEnum"
1545+
},
1546+
"type": "array"
1547+
}
1548+
},
1549+
"type": "object",
1550+
"x-ms-client-flatten": true
1551+
},
15091552
"QueryBasedAlertRuleProperties": {
15101553
"description": "Query based alert rule base property bag.",
15111554
"properties": {

0 commit comments

Comments
 (0)