From 66bcfa8f6f7261b2a80b1146e39a6e274ce9d03d Mon Sep 17 00:00:00 2001 From: Anat Gilenson Date: Sun, 13 Mar 2022 11:55:47 +0200 Subject: [PATCH 1/3] Fix THreatIntelligneceInformation multiple allOfs and add "x-ms-identifiers" to all arrays --- .../ThreatIntelligence.json | 117 ++++++++---------- 1 file changed, 54 insertions(+), 63 deletions(-) diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-01-01-preview/ThreatIntelligence.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-01-01-preview/ThreatIntelligence.json index bc5cec248571..283dc2a103de 100644 --- a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-01-01-preview/ThreatIntelligence.json +++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-01-01-preview/ThreatIntelligence.json @@ -481,7 +481,7 @@ "name": "ThreatIntelligenceProperties", "required": true, "schema": { - "$ref": "#/definitions/ThreatIntelligenceIndicatorModelForRequestBody" + "$ref": "#/definitions/ThreatIntelligenceIndicatorModel" }, "x-ms-parameter-location": "method" }, @@ -491,7 +491,7 @@ "name": "ThreatIntelligenceReplaceTags", "required": true, "schema": { - "$ref": "#/definitions/ThreatIntelligenceIndicatorModelForRequestBody" + "$ref": "#/definitions/ThreatIntelligenceIndicatorModel" }, "x-ms-parameter-location": "method" }, @@ -538,7 +538,8 @@ "items": { "$ref": "#/definitions/ThreatIntelligenceInformation" }, - "type": "array" + "type": "array", + "x-ms-identifiers": [] } }, "type": "object", @@ -550,12 +551,15 @@ "allOf": [ { "$ref": "../../../common/2.0/types.json#/definitions/ResourceWithEtag" - }, - { - "$ref": "#/definitions/ThreatIntelligenceResourceKind" } ], "description": "Threat intelligence information object.", + "properties": { + "kind": { + "$ref": "#/definitions/ThreatIntelligenceResourceInnerKind", + "description": "The kind of the entity." + } + }, "discriminator": "kind", "type": "object", "required": [ @@ -579,41 +583,6 @@ "type": "object", "x-ms-discriminator-value": "indicator" }, - "ThreatIntelligenceIndicatorModelForRequestBody": { - "allOf": [ - { - "$ref": "#/definitions/ThreatIntelligenceResourceKind" - } - ], - "description": "Threat intelligence indicator entity used in request body.", - "properties": { - "etag": { - "description": "Etag of the azure resource", - "type": "string" - }, - "properties": { - "$ref": "#/definitions/ThreatIntelligenceIndicatorProperties", - "description": "Threat Intelligence Entity properties", - "x-ms-client-flatten": true - } - }, - "type": "object", - "x-ms-discriminator-value": "indicator" - }, - "ThreatIntelligenceResourceKind": { - "description": "Describes an entity with kind.", - "properties": { - "kind": { - "$ref": "#/definitions/ThreatIntelligenceResourceInnerKind", - "description": "The kind of the entity." - } - }, - "discriminator": "kind", - "required": [ - "kind" - ], - "type": "object" - }, "ThreatIntelligenceResourceInnerKind": { "description": "The kind of the threat intelligence entity", "enum": [ @@ -645,7 +614,8 @@ "description": "tag", "type": "string" }, - "type": "array" + "type": "array", + "x-ms-identifiers": [] }, "lastUpdatedTimeUtc": { "description": "Last updated time in UTC", @@ -669,7 +639,8 @@ "description": "Indicator type of a threat intelligence entity", "type": "string" }, - "type": "array" + "type": "array", + "x-ms-identifiers": [] }, "pattern": { "description": "Pattern of a threat intelligence entity", @@ -689,7 +660,8 @@ "description": "Kill chain phase", "$ref": "#/definitions/ThreatIntelligenceKillChainPhase" }, - "type": "array" + "type": "array", + "x-ms-identifiers": [] }, "parsedPattern": { "description": "Parsed patterns", @@ -697,7 +669,8 @@ "description": "Parsed pattern", "$ref": "#/definitions/ThreatIntelligenceParsedPattern" }, - "type": "array" + "type": "array", + "x-ms-identifiers": [] }, "externalId": { "description": "External ID of threat intelligence entity", @@ -721,7 +694,8 @@ "description": "external_reference", "$ref": "#/definitions/ThreatIntelligenceExternalReference" }, - "type": "array" + "type": "array", + "x-ms-identifiers": [] }, "granularMarkings": { "description": "Granular Markings", @@ -729,7 +703,8 @@ "description": "Granular marking", "$ref": "#/definitions/ThreatIntelligenceGranularMarkingModel" }, - "type": "array" + "type": "array", + "x-ms-identifiers": [] }, "labels": { "description": "Labels of threat intelligence entity", @@ -737,7 +712,8 @@ "description": "label", "type": "string" }, - "type": "array" + "type": "array", + "x-ms-identifiers": [] }, "revoked": { "description": "Is threat intelligence entity revoked", @@ -754,7 +730,8 @@ "description": "Threat intelligence entity object marking reference", "type": "string" }, - "type": "array" + "type": "array", + "x-ms-identifiers": [] }, "language": { "description": "Language of threat intelligence entity", @@ -766,7 +743,8 @@ "description": "Threat type", "type": "string" }, - "type": "array" + "type": "array", + "x-ms-identifiers": [] }, "validFrom": { "description": "Valid from", @@ -819,7 +797,8 @@ "description": "Pattern type key", "$ref": "#/definitions/ThreatIntelligenceParsedPatternTypeValue" }, - "type": "array" + "type": "array", + "x-ms-identifiers": [] } }, "type": "object" @@ -856,7 +835,8 @@ "description": "granular marking model selector", "type": "string" }, - "type": "array" + "type": "array", + "x-ms-identifiers": [] } }, "type": "object" @@ -926,7 +906,8 @@ "description": "Sort By", "$ref": "#/definitions/ThreatIntelligenceSortingCriteria" }, - "type": "array" + "type": "array", + "x-ms-identifiers": [] }, "sources": { "description": "Sources of threat intelligence indicators", @@ -934,7 +915,8 @@ "description": "Source", "type": "string" }, - "type": "array" + "type": "array", + "x-ms-identifiers": [] }, "patternTypes": { "description": "Pattern types", @@ -942,7 +924,8 @@ "description": "Pattern type", "type": "string" }, - "type": "array" + "type": "array", + "x-ms-identifiers": [] }, "threatTypes": { "description": "Threat types of threat intelligence indicators", @@ -950,7 +933,8 @@ "description": "Threat type of a threat intelligence indicator", "type": "string" }, - "type": "array" + "type": "array", + "x-ms-identifiers": [] }, "ids": { "description": "Ids of threat intelligence indicators", @@ -958,7 +942,8 @@ "description": "Id of a threat intelligence indicator", "type": "string" }, - "type": "array" + "type": "array", + "x-ms-identifiers": [] }, "keywords": { "description": "Keywords for searching threat intelligence indicators", @@ -966,7 +951,8 @@ "description": "keyword for searching threat intelligence indicators", "type": "string" }, - "type": "array" + "type": "array", + "x-ms-identifiers": [] }, "skipToken": { "description": "Skip token.", @@ -1022,7 +1008,8 @@ "description": "parameter", "type": "string" }, - "type": "array" + "type": "array", + "x-ms-identifiers": [] } }, "type": "object" @@ -1035,7 +1022,8 @@ "items": { "$ref": "#/definitions/ThreatIntelligenceMetrics" }, - "type": "array" + "type": "array", + "x-ms-identifiers": [] } }, "required": [ @@ -1066,7 +1054,8 @@ "description": "parameter", "$ref": "#/definitions/ThreatIntelligenceMetricEntity" }, - "type": "array" + "type": "array", + "x-ms-identifiers": [] }, "patternTypeMetrics": { "description": "Pattern type metrics", @@ -1074,7 +1063,8 @@ "description": "parameter", "$ref": "#/definitions/ThreatIntelligenceMetricEntity" }, - "type": "array" + "type": "array", + "x-ms-identifiers": [] }, "sourceMetrics": { "description": "Source metrics", @@ -1082,7 +1072,8 @@ "description": "parameter", "$ref": "#/definitions/ThreatIntelligenceMetricEntity" }, - "type": "array" + "type": "array", + "x-ms-identifiers": [] } }, "type": "object" From 3efbfd6557907edf59f7c1f1013adccbac61c490 Mon Sep 17 00:00:00 2001 From: Anat Gilenson Date: Sun, 13 Mar 2022 12:01:53 +0200 Subject: [PATCH 2/3] Add "x-ms-identifiers" in EntityTypes --- .../common/EntityTypes.json | 57 ++++++++++++------- 1 file changed, 38 insertions(+), 19 deletions(-) diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-01-01-preview/common/EntityTypes.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-01-01-preview/common/EntityTypes.json index 7fcd646f7300..2acef5da5739 100644 --- a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-01-01-preview/common/EntityTypes.json +++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-01-01-preview/common/EntityTypes.json @@ -224,7 +224,8 @@ "type": "string" }, "readOnly": true, - "type": "array" + "type": "array", + "x-ms-identifiers": [] } }, "type": "object" @@ -560,7 +561,8 @@ "items": { "$ref": "#/definitions/ExpansionResultAggregation" }, - "type": "array" + "type": "array", + "x-ms-identifiers": [] } }, "type": "object" @@ -602,7 +604,8 @@ "type": "string" }, "readOnly": true, - "type": "array" + "type": "array", + "x-ms-identifiers": [] }, "fileName": { "description": "The file name without path (some alerts might not include path).", @@ -842,7 +845,8 @@ "items": { "$ref": "../../../../common/2.0/types.json#/definitions/Label" }, - "type": "array" + "type": "array", + "x-ms-identifiers": [] }, "notes": { "description": "The notes of the bookmark", @@ -985,7 +989,8 @@ "$ref": "ThreatIntelligenceTypes.json#/definitions/ThreatIntelligence" }, "readOnly": true, - "type": "array" + "type": "array", + "x-ms-identifiers": [] }, "protocols": { "description": "A list of protocols of the IoTDevice entity.", @@ -993,7 +998,8 @@ "type": "string" }, "readOnly": true, - "type": "array" + "type": "array", + "x-ms-identifiers": [] } }, "type": "object" @@ -1038,7 +1044,8 @@ "$ref": "ThreatIntelligenceTypes.json#/definitions/ThreatIntelligence" }, "readOnly": true, - "type": "array" + "type": "array", + "x-ms-identifiers": [] } }, "type": "object" @@ -1169,7 +1176,8 @@ "type": "string" }, "readOnly": true, - "type": "array" + "type": "array", + "x-ms-identifiers": [] }, "countByDeliveryStatus": { "description": "Count of mail messages by DeliveryStatus string representation", @@ -1193,7 +1201,8 @@ "type": "string" }, "readOnly": true, - "type": "array" + "type": "array", + "x-ms-identifiers": [] }, "query": { "description": "The query that was used to identify the messages of the mail cluster", @@ -1283,7 +1292,8 @@ "type": "string" }, "readOnly": true, - "type": "array" + "type": "array", + "x-ms-identifiers": [] }, "recipient": { "description": "The recipient of this mail message. Note that in case of multiple recipients the mail message is forked and each copy has one recipient", @@ -1297,7 +1307,8 @@ "type": "string" }, "readOnly": true, - "type": "array" + "type": "array", + "x-ms-identifiers": [] }, "threats": { "description": "The threats of this mail message", @@ -1306,7 +1317,8 @@ "type": "string" }, "readOnly": true, - "type": "array" + "type": "array", + "x-ms-identifiers": [] }, "p1Sender": { "description": "The p1 sender's email address", @@ -1377,7 +1389,8 @@ "type": "string" }, "readOnly": true, - "type": "array" + "type": "array", + "x-ms-identifiers": [] }, "bodyFingerprintBin1": { "description": "The bodyFingerprintBin1", @@ -1570,7 +1583,8 @@ "type": "string" }, "readOnly": true, - "type": "array" + "type": "array", + "x-ms-identifiers": [] }, "malwareName": { "description": "The malware name by the vendor, e.g. Win32/Toga!rfn", @@ -1584,7 +1598,8 @@ "type": "string" }, "readOnly": true, - "type": "array" + "type": "array", + "x-ms-identifiers": [] } }, "type": "object" @@ -1964,7 +1979,8 @@ "type": "object" }, "readOnly": true, - "type": "array" + "type": "array", + "x-ms-identifiers": [] }, "confidenceScore": { "description": "The confidence score of the alert.", @@ -2131,7 +2147,8 @@ "type": "string" }, "readOnly": true, - "type": "array" + "type": "array", + "x-ms-identifiers": [] }, "severity": { "$ref": "AlertTypes.json#/definitions/AlertSeverityEnum", @@ -2193,7 +2210,8 @@ "$ref": "AlertTypes.json#/definitions/AttackTactic" }, "readOnly": true, - "type": "array" + "type": "array", + "x-ms-identifiers": [] }, "timeGenerated": { "description": "The time the alert was generated.", @@ -2217,7 +2235,8 @@ "type": "object" }, "readOnly": true, - "type": "array" + "type": "array", + "x-ms-identifiers": [] } }, "type": "object" From b08c47a0db9f4c8fcf1751c208002776d0faeb81 Mon Sep 17 00:00:00 2001 From: Anat Gilenson Date: Sun, 13 Mar 2022 12:18:27 +0200 Subject: [PATCH 3/3] Fix double 'allOf' in latest stable --- .../stable/2021-10-01/ThreatIntelligence.json | 48 ++++--------------- 1 file changed, 8 insertions(+), 40 deletions(-) diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-10-01/ThreatIntelligence.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-10-01/ThreatIntelligence.json index e0e0d0455dfe..14eebd50959e 100644 --- a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-10-01/ThreatIntelligence.json +++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2021-10-01/ThreatIntelligence.json @@ -471,12 +471,15 @@ "allOf": [ { "$ref": "../../../common/2.0/types.json#/definitions/ResourceWithEtag" - }, - { - "$ref": "#/definitions/ThreatIntelligenceResourceKind" } ], "description": "Threat intelligence information object.", + "properties": { + "kind": { + "$ref": "#/definitions/ThreatIntelligenceResourceInnerKind", + "description": "The kind of the entity." + } + }, "discriminator": "kind", "type": "object", "required": [ @@ -522,41 +525,6 @@ "type": "object", "x-ms-discriminator-value": "indicator" }, - "ThreatIntelligenceIndicatorModelForRequestBody": { - "allOf": [ - { - "$ref": "#/definitions/ThreatIntelligenceResourceKind" - } - ], - "description": "Threat intelligence indicator entity used in request body.", - "properties": { - "etag": { - "description": "Etag of the azure resource", - "type": "string" - }, - "properties": { - "$ref": "#/definitions/ThreatIntelligenceIndicatorProperties", - "description": "Threat Intelligence Entity properties", - "x-ms-client-flatten": true - } - }, - "type": "object", - "x-ms-discriminator-value": "indicator" - }, - "ThreatIntelligenceResourceKind": { - "description": "Describes an entity with kind.", - "properties": { - "kind": { - "$ref": "#/definitions/ThreatIntelligenceResourceInnerKind", - "description": "The kind of the entity." - } - }, - "discriminator": "kind", - "required": [ - "kind" - ], - "type": "object" - }, "ThreatIntelligenceResourceInnerKind": { "description": "The kind of the threat intelligence entity", "enum": [ @@ -1083,7 +1051,7 @@ "name": "ThreatIntelligenceProperties", "required": true, "schema": { - "$ref": "#/definitions/ThreatIntelligenceIndicatorModelForRequestBody" + "$ref": "#/definitions/ThreatIntelligenceIndicatorModel" }, "x-ms-parameter-location": "method" }, @@ -1093,7 +1061,7 @@ "name": "ThreatIntelligenceReplaceTags", "required": true, "schema": { - "$ref": "#/definitions/ThreatIntelligenceIndicatorModelForRequestBody" + "$ref": "#/definitions/ThreatIntelligenceIndicatorModel" }, "x-ms-parameter-location": "method" },