From 05d9e5bedf5ec21f48076403a34e4b77f6c82e04 Mon Sep 17 00:00:00 2001
From: SDKAuto <sdkautomation@microsoft.com>
Date: Tue, 22 Mar 2022 18:08:07 +0000
Subject: [PATCH] CodeGen from PR 18330 in Azure/azure-rest-api-specs Merge
 48885bd8f8d05cc66363772d3a50f2afcabb8e10 into
 c104edf0f93bef19cc9d156053c2cf1358e22934

---
 .../Microsoft.SecurityInsights.json           | 34 ++++++++++++++++---
 1 file changed, 30 insertions(+), 4 deletions(-)

diff --git a/schemas/2022-01-01-preview/Microsoft.SecurityInsights.json b/schemas/2022-01-01-preview/Microsoft.SecurityInsights.json
index 9ba21ba317..a8508f131d 100644
--- a/schemas/2022-01-01-preview/Microsoft.SecurityInsights.json
+++ b/schemas/2022-01-01-preview/Microsoft.SecurityInsights.json
@@ -7017,8 +7017,19 @@
           "description": "User information that made some action"
         },
         "entityMapping": {
-          "type": "object",
-          "properties": {},
+          "oneOf": [
+            {
+              "type": "object",
+              "additionalProperties": {
+                "type": "object",
+                "properties": {}
+              },
+              "properties": {}
+            },
+            {
+              "$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
+            }
+          ],
           "description": "key-value pairs for a watchlist item entity mapping"
         },
         "isDeleted": {
@@ -7033,8 +7044,19 @@
           "description": "A flag that indicates if the watchlist item is deleted or not"
         },
         "itemsKeyValue": {
-          "type": "object",
-          "properties": {},
+          "oneOf": [
+            {
+              "type": "object",
+              "additionalProperties": {
+                "type": "object",
+                "properties": {}
+              },
+              "properties": {}
+            },
+            {
+              "$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
+            }
+          ],
           "description": "key-value pairs for a watchlist item"
         },
         "tenantId": {
@@ -7155,6 +7177,10 @@
           "type": "string",
           "description": "The raw content that represents to watchlist items to create. In case of csv/tsv content type, it's the content of the file that will parsed by the endpoint"
         },
+        "sasUri": {
+          "type": "string",
+          "description": "The Shared Access Signature (SAS) URI under which the large csv watchlist file is located and from which the watchlist and its items will be created"
+        },
         "source": {
           "type": "string",
           "description": "The filename of the watchlist, called 'source'"