-
Notifications
You must be signed in to change notification settings - Fork 5.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Hub Generated] Review request for Microsoft.SecurityInsights to add version preview/2019-01-01-preview #11795
Merged
PhoenixHe-NV
merged 5 commits into
Azure:master
from
hassanchawiche:hc-dev-securityinsights-Microsoft.SecurityInsights-2019-01-01-preview
Jan 7, 2021
Merged
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit
Hold shift + click to select a range
66d86df
Added Watchlist-Item endpoint to Add/Update/Delete Watchlist Item res…
hassanchawiche 7378078
Adjustments as per ARM Review
hassanchawiche 8d447b3
Adjustments as per ARM Review
hassanchawiche 72ca405
Fixed Avecado issues and enhaced Watchlist examples
hassanchawiche 1853de8
Updated Watchlist Item definition
hassanchawiche File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -3727,7 +3727,7 @@ | |
"tags": [ | ||
"Watchlists" | ||
], | ||
"description": "Creates a watchlist and its watchlist items (bulk creation, e.g. through text/csv content type). To create a Watchlist and its Items, we should call this endpoint twice : the first call will create am empty Watchlist, and the second one will create its Items.", | ||
"description": "Creates a watchlist and its watchlist items (bulk creation, e.g. through text/csv content type). To create a Watchlist and its Items, we should call this endpoint twice : the first call will create an empty Watchlist, and the second one will create its Items.", | ||
"operationId": "Watchlists_Create", | ||
"parameters": [ | ||
{ | ||
|
@@ -3774,6 +3774,115 @@ | |
} | ||
} | ||
}, | ||
"/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/watchlists/{watchlistAlias}/watchlistItem/{watchlistItemId}": { | ||
"delete": { | ||
"x-ms-examples": { | ||
"Delete a watchlist Item.": { | ||
"$ref": "./examples/watchlists/DeleteWatchlistItem.json" | ||
} | ||
}, | ||
"tags": [ | ||
"WatchlistItem" | ||
], | ||
"description": "Delete a watchlist item.", | ||
"operationId": "WatchlistItem_Delete", | ||
"parameters": [ | ||
{ | ||
"$ref": "#/parameters/ApiVersion" | ||
}, | ||
{ | ||
"$ref": "#/parameters/SubscriptionId" | ||
}, | ||
{ | ||
"$ref": "#/parameters/ResourceGroupName" | ||
}, | ||
{ | ||
"$ref": "#/parameters/OperationalInsightsResourceProvider" | ||
}, | ||
{ | ||
"$ref": "#/parameters/WorkspaceName" | ||
}, | ||
{ | ||
"$ref": "#/parameters/WatchlistAlias" | ||
}, | ||
{ | ||
"$ref": "#/parameters/WatchlistItemId" | ||
} | ||
], | ||
"responses": { | ||
"200": { | ||
"description": "OK" | ||
}, | ||
"204": { | ||
"description": "No Content" | ||
}, | ||
"default": { | ||
"description": "Error response describing why the operation failed.", | ||
"schema": { | ||
"$ref": "#/definitions/CloudError" | ||
} | ||
} | ||
} | ||
}, | ||
"put": { | ||
"x-ms-examples": { | ||
"Creates or updates a watchlist item.": { | ||
"$ref": "./examples/watchlists/CreateWatchlistItem.json" | ||
} | ||
}, | ||
"tags": [ | ||
"WatchlistItem" | ||
], | ||
"description": "Creates or updates a watchlist item.", | ||
"operationId": "WatchlistItem_CreateOrUpdate", | ||
"parameters": [ | ||
{ | ||
"$ref": "#/parameters/ApiVersion" | ||
}, | ||
{ | ||
"$ref": "#/parameters/SubscriptionId" | ||
}, | ||
{ | ||
"$ref": "#/parameters/ResourceGroupName" | ||
}, | ||
{ | ||
"$ref": "#/parameters/OperationalInsightsResourceProvider" | ||
}, | ||
{ | ||
"$ref": "#/parameters/WorkspaceName" | ||
}, | ||
{ | ||
"$ref": "#/parameters/WatchlistAlias" | ||
}, | ||
{ | ||
"$ref": "#/parameters/WatchlistItemId" | ||
}, | ||
{ | ||
"$ref": "#/parameters/WatchlistItem" | ||
} | ||
], | ||
"responses": { | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Is the PUT a long running operation here? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. No, it's not |
||
"200": { | ||
"description": "OK", | ||
"schema": { | ||
"$ref": "#/definitions/WatchlistItem" | ||
} | ||
}, | ||
"201": { | ||
"description": "Created", | ||
"schema": { | ||
"$ref": "#/definitions/WatchlistItem" | ||
} | ||
}, | ||
"default": { | ||
"description": "Error response describing why the operation failed.", | ||
"schema": { | ||
"$ref": "#/definitions/CloudError" | ||
} | ||
} | ||
} | ||
} | ||
}, | ||
"/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/threatIntelligence/main/createIndicator": { | ||
"post": { | ||
"x-ms-examples": { | ||
|
@@ -10061,6 +10170,79 @@ | |
], | ||
"type": "object" | ||
}, | ||
"WatchlistItem": { | ||
"allOf": [ | ||
{ | ||
"$ref": "#/definitions/ResourceWithEtag" | ||
} | ||
], | ||
"description": "Represents a Watchlist item in Azure Security Insights.", | ||
"properties": { | ||
"properties": { | ||
"$ref": "#/definitions/WatchlistItemProperties", | ||
"description": "Watchlist Item properties", | ||
"x-ms-client-flatten": true | ||
} | ||
}, | ||
"type": "object" | ||
}, | ||
"WatchlistItemProperties": { | ||
"description": "Describes watchlist item properties", | ||
"properties": { | ||
"watchlistItemType": { | ||
"description": "The type of the watchlist item", | ||
"type": "string" | ||
}, | ||
"watchlistItemId": { | ||
"description": "The id (a Guid) of the watchlist item", | ||
"type": "string" | ||
}, | ||
"watchlistId": { | ||
"description": "The id (a Guid) of the watchlist to which this item belongs to", | ||
"type": "string" | ||
}, | ||
"tenantId": { | ||
"description": "The tenantId to which the watchlist item belongs to", | ||
"type": "string" | ||
}, | ||
"isDeleted": { | ||
"description": "A flag that indicates if the watchlist item is deleted or not", | ||
"type": "boolean" | ||
}, | ||
"created": { | ||
"description": "The time the watchlist item was created", | ||
"format": "date-time", | ||
"type": "string" | ||
}, | ||
"updated": { | ||
"description": "The last time the watchlist item was updated", | ||
"format": "date-time", | ||
"type": "string" | ||
}, | ||
"createdBy": { | ||
"$ref": "#/definitions/UserInfo", | ||
"description": "Describes a user that created the watchlist item", | ||
"type": "object" | ||
}, | ||
"updatedBy": { | ||
"$ref": "#/definitions/UserInfo", | ||
"description": "Describes a user that updated the watchlist item", | ||
"type": "object" | ||
}, | ||
"watchlistItem": { | ||
"description": "key-value pairs for a watchlist item", | ||
"type": "object" | ||
}, | ||
"entityMapping": { | ||
"description": "key-value pairs for a watchlist item entity mapping", | ||
"type": "object" | ||
} | ||
}, | ||
"required": [ | ||
"watchlistItem" | ||
], | ||
"type": "object" | ||
}, | ||
"ThreatIntelligenceInformationList": { | ||
"description": "List of all the threat intelligence information objects.", | ||
"properties": { | ||
|
@@ -10907,6 +11089,24 @@ | |
}, | ||
"x-ms-parameter-location": "method" | ||
}, | ||
"WatchlistItem": { | ||
"description": "The watchlist item", | ||
"in": "body", | ||
"name": "watchlistItem", | ||
"required": true, | ||
"schema": { | ||
"$ref": "#/definitions/WatchlistItem" | ||
}, | ||
"x-ms-parameter-location": "method" | ||
}, | ||
"WatchlistItemId": { | ||
"description": "Watchlist Item Id (GUID)", | ||
"in": "path", | ||
"name": "watchlistItemId", | ||
"required": true, | ||
"type": "string", | ||
"x-ms-parameter-location": "method" | ||
}, | ||
"ThreatIntelligenceName": { | ||
"description": "Threat intelligence indicator name field.", | ||
"in": "path", | ||
|
91 changes: 91 additions & 0 deletions
91
....SecurityInsights/preview/2019-01-01-preview/examples/watchlists/CreateWatchlistItem.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,91 @@ | ||
{ | ||
"parameters": { | ||
"api-version": "2019-01-01-preview", | ||
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0", | ||
"resourceGroupName": "myRg", | ||
"workspaceName": "myWorkspace", | ||
"operationalInsightsResourceProvider": "Microsoft.OperationalInsights", | ||
"watchlistAlias": "highValueAsset", | ||
"watchlistItemId": "82ba292c-dc97-4dfc-969d-d4dd9e666842", | ||
"watchlistItem": { | ||
"properties": { | ||
"watchlistItem": { | ||
"Gateway subnet": "10.0.255.224/27", | ||
"Web Tier": "10.0.1.0/24", | ||
"Business tier": "10.0.2.0/24", | ||
"Data tier": "10.0.2.0/24", | ||
"Private DMZ in": "10.0.0.0/27", | ||
"Public DMZ out": "10.0.0.96/27" | ||
} | ||
} | ||
} | ||
}, | ||
"responses": { | ||
"200": { | ||
"body": { | ||
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/WatchlistItem/", | ||
"type": "Microsoft.SecurityInsights/WatchlistItem", | ||
"properties": { | ||
"watchlistItemType": "watchlist-item", | ||
"watchlistItemId": "82ba292c-dc97-4dfc-969d-d4dd9e666842", | ||
"tenantId": "4008512e-1d30-48b2-9ee2-d3612ed9d3ea", | ||
"watchlistId": "dc04e26a-19a9-4ad2-9b2b-6e3b050f48bb", | ||
"isDeleted": false, | ||
"created": "2020-11-15T04:58:56.0748363+00:00", | ||
"updated": "2020-11-16T16:05:20+00:00", | ||
"createdBy": { | ||
"objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70", | ||
"email": "john@contoso.com", | ||
"name": "john doe" | ||
}, | ||
"updatedBy": { | ||
"objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70", | ||
"email": "john@contoso.com", | ||
"name": "john doe" | ||
}, | ||
"watchlistItem": { | ||
"Gateway subnet": "10.0.255.224/27", | ||
"Web Tier": "10.0.1.0/24", | ||
"Business tier": "10.0.2.0/24", | ||
"Data tier": "10.0.2.0/24", | ||
"Private DMZ in": "10.0.0.0/27", | ||
"Public DMZ out": "10.0.0.96/27" | ||
} | ||
} | ||
} | ||
}, | ||
"201": { | ||
"body": { | ||
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/WatchlistItem/", | ||
"type": "Microsoft.SecurityInsights/WatchlistItem", | ||
"properties": { | ||
"watchlistItemType": "watchlist-item", | ||
"watchlistItemId": "82ba292c-dc97-4dfc-969d-d4dd9e666842", | ||
"tenantId": "4008512e-1d30-48b2-9ee2-d3612ed9d3ea", | ||
"watchlistId": "dc04e26a-19a9-4ad2-9b2b-6e3b050f48bb", | ||
"isDeleted": false, | ||
"created": "2020-11-15T04:58:56.0748363+00:00", | ||
"updated": "2020-11-16T16:05:20+00:00", | ||
"createdBy": { | ||
"objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70", | ||
"email": "john@contoso.com", | ||
"name": "john doe" | ||
}, | ||
"updatedBy": { | ||
"objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70", | ||
"email": "john@contoso.com", | ||
"name": "john doe" | ||
}, | ||
"watchlistItem": { | ||
"Gateway subnet": "10.0.255.224/27", | ||
"Web Tier": "10.0.1.0/24", | ||
"Business tier": "10.0.2.0/24", | ||
"Data tier": "10.0.2.0/24", | ||
"Private DMZ in": "10.0.0.0/27", | ||
"Public DMZ out": "10.0.0.96/27" | ||
} | ||
} | ||
} | ||
} | ||
} | ||
} |
15 changes: 15 additions & 0 deletions
15
....SecurityInsights/preview/2019-01-01-preview/examples/watchlists/DeleteWatchlistItem.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,15 @@ | ||
{ | ||
"parameters": { | ||
"api-version": "2019-01-01-preview", | ||
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0", | ||
"resourceGroupName": "myRg", | ||
"workspaceName": "myWorkspace", | ||
"operationalInsightsResourceProvider": "Microsoft.OperationalInsights", | ||
"watchlistAlias": "highValueAsset", | ||
"watchlistItemId": "4008512e-1d30-48b2-9ee2-d3612ed9d3ea" | ||
}, | ||
"responses": { | ||
"200": {}, | ||
"204": {} | ||
} | ||
} |
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Resource type names in ARM are plural by convention. Also watchlistItems is kind of redundant since it's nested under a watchlists resource type. Can you rename to
watchlistItems
or justitems
?Also, you are missing the API to list all watchlistItems in a watchlist.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Changed to
WatchlistItems
.Getting all WatchlistItems endpoint will be added in future change.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@majastrz : could you pls review my pr ?