{
  "swagger": "2.0",
  "info": {
    "title": "Security Insights",
    "description": "API spec for Microsoft.SecurityInsights (Azure Security Insights) resource provider",
    "version": "2020-01-01"
  },
  "host": "management.azure.com",
  "schemes": [
    "https"
  ],
  "consumes": [
    "application/json"
  ],
  "produces": [
    "application/json"
  ],
  "security": [
    {
      "azure_auth": [
        "user_impersonation"
      ]
    }
  ],
  "securityDefinitions": {
    "azure_auth": {
      "type": "oauth2",
      "authorizationUrl": "https://login.microsoftonline.com/common/oauth2/authorize",
      "flow": "implicit",
      "description": "Azure Active Directory OAuth2 Flow",
      "scopes": {
        "user_impersonation": "impersonate your user account"
      }
    }
  },
  "paths": {
    "/providers/Microsoft.SecurityInsights/operations": {
      "get": {
        "operationId": "Operations_List",
        "description": "Lists all operations available Azure Security Insights Resource Provider.",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK. Successfully retrieved operations list.",
            "schema": {
              "$ref": "#/definitions/OperationsList"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules": {
      "get": {
        "x-ms-examples": {
          "Get all alert rules.": {
            "$ref": "./examples/alertRules/GetAllAlertRules.json"
          }
        },
        "tags": [
          "Alert Rules"
        ],
        "description": "Gets all alert rules.",
        "operationId": "AlertRules_List",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          }
        ],
        "responses": {
          "200": {
            "description": "OK, Operation successfully completed",
            "schema": {
              "$ref": "#/definitions/AlertRulesList"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules/{ruleId}": {
      "get": {
        "x-ms-examples": {
          "Get a Scheduled alert rule.": {
            "$ref": "./examples/alertRules/GetScheduledAlertRule.json"
          },
          "Get a Fusion alert rule.": {
            "$ref": "./examples/alertRules/GetFusionAlertRule.json"
          },
          "Get a MicrosoftSecurityIncidentCreation rule.": {
            "$ref": "./examples/alertRules/GetMicrosoftSecurityIncidentCreationAlertRule.json"
          }
        },
        "tags": [
          "Alert Rules"
        ],
        "description": "Gets the alert rule.",
        "operationId": "AlertRules_Get",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/RuleId"
          }
        ],
        "responses": {
          "200": {
            "description": "OK, Operation successfully completed",
            "schema": {
              "$ref": "#/definitions/AlertRule"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        }
      },
      "put": {
        "x-ms-examples": {
          "Creates or updates a Scheduled alert rule.": {
            "$ref": "./examples/alertRules/CreateScheduledAlertRule.json"
          },
          "Creates or updates a Fusion alert rule.": {
            "$ref": "./examples/alertRules/CreateFusionAlertRule.json"
          },
          "Creates or updates a MicrosoftSecurityIncidentCreation rule.": {
            "$ref": "./examples/alertRules/CreateMicrosoftSecurityIncidentCreationAlertRule.json"
          }
        },
        "tags": [
          "Alert Rules"
        ],
        "description": "Creates or updates the alert rule.",
        "operationId": "AlertRules_CreateOrUpdate",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/RuleId"
          },
          {
            "$ref": "#/parameters/AlertRule"
          }
        ],
        "responses": {
          "200": {
            "description": "OK, Operation successfully completed",
            "schema": {
              "$ref": "#/definitions/AlertRule"
            }
          },
          "201": {
            "description": "Created",
            "schema": {
              "$ref": "#/definitions/AlertRule"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        }
      },
      "delete": {
        "x-ms-examples": {
          "Delete an alert rule.": {
            "$ref": "./examples/alertRules/DeleteAlertRule.json"
          }
        },
        "tags": [
          "Alert Rules"
        ],
        "description": "Delete the alert rule.",
        "operationId": "AlertRules_Delete",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/RuleId"
          }
        ],
        "responses": {
          "200": {
            "description": "OK, Operation successfully completed"
          },
          "204": {
            "description": "No Content"
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules/{ruleId}/actions": {
      "get": {
        "x-ms-examples": {
          "Get all actions of alert rule.": {
            "$ref": "./examples/actions/GetAllActionsByAlertRule.json"
          }
        },
        "tags": [
          "Actions"
        ],
        "description": "Gets all actions of alert rule.",
        "operationId": "Actions_ListByAlertRule",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/RuleId"
          }
        ],
        "responses": {
          "200": {
            "description": "OK, Operation successfully completed",
            "schema": {
              "$ref": "#/definitions/ActionsList"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules/{ruleId}/actions/{actionId}": {
      "get": {
        "x-ms-examples": {
          "Get an action of alert rule.": {
            "$ref": "./examples/actions/GetActionOfAlertRuleById.json"
          }
        },
        "tags": [
          "Actions"
        ],
        "description": "Gets the action of alert rule.",
        "operationId": "Actions_Get",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/RuleId"
          },
          {
            "$ref": "#/parameters/ActionId"
          }
        ],
        "responses": {
          "200": {
            "description": "OK, Operation successfully completed",
            "schema": {
              "$ref": "#/definitions/ActionResponse"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        }
      },
      "put": {
        "x-ms-examples": {
          "Creates or updates an action of alert rule.": {
            "$ref": "./examples/actions/CreateActionOfAlertRule.json"
          }
        },
        "tags": [
          "Actions"
        ],
        "description": "Creates or updates the action of alert rule.",
        "operationId": "Actions_CreateOrUpdate",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/RuleId"
          },
          {
            "$ref": "#/parameters/ActionId"
          },
          {
            "$ref": "#/parameters/Action"
          }
        ],
        "responses": {
          "200": {
            "description": "OK, Operation successfully completed",
            "schema": {
              "$ref": "#/definitions/ActionResponse"
            }
          },
          "201": {
            "description": "Created",
            "schema": {
              "$ref": "#/definitions/ActionResponse"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        }
      },
      "delete": {
        "x-ms-examples": {
          "Delete an action of alert rule.": {
            "$ref": "./examples/actions/DeleteActionOfAlertRule.json"
          }
        },
        "tags": [
          "Actions"
        ],
        "description": "Delete the action of alert rule.",
        "operationId": "Actions_Delete",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/RuleId"
          },
          {
            "$ref": "#/parameters/ActionId"
          }
        ],
        "responses": {
          "200": {
            "description": "OK, Operation successfully completed"
          },
          "204": {
            "description": "No Content"
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRuleTemplates": {
      "get": {
        "x-ms-examples": {
          "Get all alert rule templates.": {
            "$ref": "./examples/alertRuleTemplates/GetAlertRuleTemplates.json"
          }
        },
        "tags": [
          "Alert Rule Templates"
        ],
        "description": "Gets all alert rule templates.",
        "operationId": "AlertRuleTemplates_List",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          }
        ],
        "responses": {
          "200": {
            "description": "OK, Operation successfully completed",
            "schema": {
              "$ref": "#/definitions/AlertRuleTemplatesList"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRuleTemplates/{alertRuleTemplateId}": {
      "get": {
        "x-ms-examples": {
          "Get alert rule template by Id.": {
            "$ref": "./examples/alertRuleTemplates/GetAlertRuleTemplateById.json"
          }
        },
        "tags": [
          "Alert Rule Templates"
        ],
        "description": "Gets the alert rule template.",
        "operationId": "AlertRuleTemplates_Get",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/AlertRuleTemplateId"
          }
        ],
        "responses": {
          "200": {
            "description": "OK, Operation successfully completed",
            "schema": {
              "$ref": "#/definitions/AlertRuleTemplate"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/bookmarks": {
      "get": {
        "x-ms-examples": {
          "Get all bookmarks.": {
            "$ref": "./examples/bookmarks/GetBookmarks.json"
          }
        },
        "tags": [
          "Bookmarks"
        ],
        "description": "Gets all bookmarks.",
        "operationId": "Bookmarks_List",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          }
        ],
        "responses": {
          "200": {
            "description": "OK, Operation successfully completed",
            "schema": {
              "$ref": "#/definitions/BookmarkList"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/bookmarks/{bookmarkId}": {
      "get": {
        "x-ms-examples": {
          "Get a bookmark.": {
            "$ref": "./examples/bookmarks/GetBookmarkById.json"
          }
        },
        "tags": [
          "Bookmarks"
        ],
        "description": "Gets a bookmark.",
        "operationId": "Bookmarks_Get",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/BookmarkId"
          }
        ],
        "responses": {
          "200": {
            "description": "OK, Operation successfully completed",
            "schema": {
              "$ref": "#/definitions/Bookmark"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        }
      },
      "put": {
        "x-ms-examples": {
          "Creates or updates a bookmark.": {
            "$ref": "./examples/bookmarks/CreateBookmark.json"
          }
        },
        "tags": [
          "Bookmarks"
        ],
        "description": "Creates or updates the bookmark.",
        "operationId": "Bookmarks_CreateOrUpdate",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/BookmarkId"
          },
          {
            "$ref": "#/parameters/Bookmark"
          }
        ],
        "responses": {
          "200": {
            "description": "OK, Operation successfully completed",
            "schema": {
              "$ref": "#/definitions/Bookmark"
            }
          },
          "201": {
            "description": "Created",
            "schema": {
              "$ref": "#/definitions/Bookmark"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        }
      },
      "delete": {
        "x-ms-examples": {
          "Delete a bookmark.": {
            "$ref": "./examples/bookmarks/DeleteBookmark.json"
          }
        },
        "tags": [
          "Bookmarks"
        ],
        "description": "Delete the bookmark.",
        "operationId": "Bookmarks_Delete",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/BookmarkId"
          }
        ],
        "responses": {
          "200": {
            "description": "OK, Operation successfully completed"
          },
          "204": {
            "description": "No Content"
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors": {
      "get": {
        "x-ms-examples": {
          "Get all data connectors.": {
            "$ref": "./examples/dataConnectors/GetDataConnectors.json"
          }
        },
        "tags": [
          "Data Connectors"
        ],
        "description": "Gets all data connectors.",
        "operationId": "DataConnectors_List",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          }
        ],
        "responses": {
          "200": {
            "description": "OK, Operation successfully completed",
            "schema": {
              "$ref": "#/definitions/DataConnectorList"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors/{dataConnectorId}": {
      "get": {
        "x-ms-examples": {
          "Get an Office365 data connector.": {
            "$ref": "./examples/dataConnectors/GetOfficeDataConnetorById.json"
          },
          "Get a TI data connector.": {
            "$ref": "./examples/dataConnectors/GetThreatIntelligenceById.json"
          },
          "Get a MCAS data connector.": {
            "$ref": "./examples/dataConnectors/GetMicrosoftCloudAppSecurityById.json"
          },
          "Get a ASC data connector.": {
            "$ref": "./examples/dataConnectors/GetAzureSecurityCenterById.json"
          },
          "Get an AAD data connector.": {
            "$ref": "./examples/dataConnectors/GetAzureActiveDirectoryById.json"
          },
          "Get an AwsCloudTrail data connector.": {
            "$ref": "./examples/dataConnectors/GetAmazonWebServicesCloudTrailById.json"
          },
          "Get an AATP data connector.": {
            "$ref": "./examples/dataConnectors/GetAzureAdvancedThreatProtectionById.json"
          },
          "Get a MDATP data connector": {
            "$ref": "./examples/dataConnectors/GetMicrosoftDefenderAdvancedThreatProtectionById.json"
          }
        },
        "tags": [
          "Data Connectors"
        ],
        "description": "Gets a data connector.",
        "operationId": "DataConnectors_Get",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/DataConnectorId"
          }
        ],
        "responses": {
          "200": {
            "description": "OK, Operation successfully completed",
            "schema": {
              "$ref": "#/definitions/DataConnector"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        }
      },
      "put": {
        "x-ms-examples": {
          "Creates or updates an Office365 data connector.": {
            "$ref": "./examples/dataConnectors/CreateOfficeDataConnetor.json"
          }
        },
        "tags": [
          "Data Connectors"
        ],
        "description": "Creates or updates the data connector.",
        "operationId": "DataConnectors_CreateOrUpdate",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/DataConnectorId"
          },
          {
            "$ref": "#/parameters/DataConnector"
          }
        ],
        "responses": {
          "200": {
            "description": "OK, Operation successfully completed",
            "schema": {
              "$ref": "#/definitions/DataConnector"
            }
          },
          "201": {
            "description": "Created",
            "schema": {
              "$ref": "#/definitions/DataConnector"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        }
      },
      "delete": {
        "x-ms-examples": {
          "Delete an Office365 data connector.": {
            "$ref": "./examples/dataConnectors/DeleteOfficeDataConnetor.json"
          }
        },
        "tags": [
          "Data Connectors"
        ],
        "description": "Delete the data connector.",
        "operationId": "DataConnectors_Delete",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/DataConnectorId"
          }
        ],
        "responses": {
          "200": {
            "description": "OK, Operation successfully completed"
          },
          "204": {
            "description": "No Content"
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents": {
      "get": {
        "x-ms-examples": {
          "Get all incidents.": {
            "$ref": "./examples/incidents/GetIncidents.json"
          }
        },
        "tags": [
          "Incidents"
        ],
        "description": "Gets all incidents.",
        "operationId": "Incidents_List",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/ODataFilter"
          },
          {
            "$ref": "#/parameters/ODataOrderBy"
          },
          {
            "$ref": "#/parameters/ODataTop"
          },
          {
            "$ref": "#/parameters/ODataSkipToken"
          }
        ],
        "responses": {
          "200": {
            "description": "OK, Operation successfully completed",
            "schema": {
              "$ref": "#/definitions/IncidentList"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}": {
      "get": {
        "x-ms-examples": {
          "Get an incident.": {
            "$ref": "./examples/incidents/GetIncidentById.json"
          }
        },
        "tags": [
          "Incidents"
        ],
        "description": "Gets an incident.",
        "operationId": "Incidents_Get",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/IncidentId"
          }
        ],
        "responses": {
          "200": {
            "description": "OK, Operation successfully completed",
            "schema": {
              "$ref": "#/definitions/Incident"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        }
      },
      "put": {
        "x-ms-examples": {
          "Creates or updates an incident.": {
            "$ref": "./examples/incidents/CreateIncident.json"
          }
        },
        "tags": [
          "Incidents"
        ],
        "description": "Creates or updates the incident.",
        "operationId": "Incidents_CreateOrUpdate",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/IncidentId"
          },
          {
            "$ref": "#/parameters/Incident"
          }
        ],
        "responses": {
          "200": {
            "description": "OK, Operation successfully completed",
            "schema": {
              "$ref": "#/definitions/Incident"
            }
          },
          "201": {
            "description": "Created",
            "schema": {
              "$ref": "#/definitions/Incident"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        }
      },
      "delete": {
        "x-ms-examples": {
          "Delete an incident.": {
            "$ref": "./examples/incidents/DeleteIncident.json"
          }
        },
        "tags": [
          "Incidents"
        ],
        "description": "Delete the incident.",
        "operationId": "Incidents_Delete",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/IncidentId"
          }
        ],
        "responses": {
          "200": {
            "description": "OK, Operation successfully completed"
          },
          "204": {
            "description": "No Content"
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/comments": {
      "get": {
        "x-ms-examples": {
          "Get all incident comments.": {
            "$ref": "./examples/incidents/comments/GetAllIncidentComments.json"
          }
        },
        "tags": [
          "IncidentComments"
        ],
        "description": "Gets all incident comments.",
        "operationId": "IncidentComments_ListByIncident",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/IncidentId"
          },
          {
            "$ref": "#/parameters/ODataFilter"
          },
          {
            "$ref": "#/parameters/ODataOrderBy"
          },
          {
            "$ref": "#/parameters/ODataTop"
          },
          {
            "$ref": "#/parameters/ODataSkipToken"
          }
        ],
        "responses": {
          "200": {
            "description": "OK, Operation successfully completed",
            "schema": {
              "$ref": "#/definitions/IncidentCommentList"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        },
        "x-ms-odata": "#/definitions/IncidentComment",
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/comments/{incidentCommentId}": {
      "get": {
        "x-ms-examples": {
          "Get an incident comment.": {
            "$ref": "./examples/incidents/comments/GetIncidentCommentById.json"
          }
        },
        "tags": [
          "IncidentComments"
        ],
        "description": "Gets an incident comment.",
        "operationId": "IncidentComments_Get",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/IncidentId"
          },
          {
            "$ref": "#/parameters/IncidentCommentId"
          }
        ],
        "responses": {
          "200": {
            "description": "OK, Operation successfully completed",
            "schema": {
              "$ref": "#/definitions/IncidentComment"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        }
      },
      "put": {
        "x-ms-examples": {
          "Creates an incident comment.": {
            "$ref": "./examples/incidents/comments/CreateIncidentComment.json"
          }
        },
        "tags": [
          "IncidentComments"
        ],
        "description": "Creates the incident comment.",
        "operationId": "IncidentComments_CreateComment",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersion"
          },
          {
            "$ref": "#/parameters/SubscriptionId"
          },
          {
            "$ref": "#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/IncidentId"
          },
          {
            "$ref": "#/parameters/IncidentCommentId"
          },
          {
            "$ref": "#/parameters/IncidentComment"
          }
        ],
        "responses": {
          "201": {
            "description": "Created",
            "schema": {
              "$ref": "#/definitions/IncidentComment"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/CloudError"
            }
          }
        }
      }
    }
  },
  "definitions": {
    "AADDataConnector": {
      "allOf": [
        {
          "$ref": "#/definitions/DataConnector"
        }
      ],
      "description": "Represents AAD (Azure Active Directory) data connector.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/AADDataConnectorProperties",
          "description": "AAD (Azure Active Directory) data connector properties.",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "AzureActiveDirectory"
    },
    "AADDataConnectorProperties": {
      "description": "AAD (Azure Active Directory) data connector properties.",
      "properties": {
        "tenantId": {
          "description": "The tenant id to connect to, and get the data from.",
          "type": "string"
        },
        "dataTypes": {
          "$ref": "#/definitions/AlertsDataTypeOfDataConnector",
          "description": "The available data types for the connector."
        }
      },
      "type": "object"
    },
    "AATPDataConnector": {
      "allOf": [
        {
          "$ref": "#/definitions/DataConnector"
        }
      ],
      "description": "Represents AATP (Azure Advanced Threat Protection) data connector.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/AATPDataConnectorProperties",
          "description": "AATP (Azure Advanced Threat Protection) data connector properties.",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "AzureAdvancedThreatProtection"
    },
    "AATPDataConnectorProperties": {
      "description": "AATP (Azure Advanced Threat Protection) data connector properties.",
      "properties": {
        "tenantId": {
          "description": "The tenant id to connect to, and get the data from.",
          "type": "string"
        },
        "dataTypes": {
          "$ref": "#/definitions/AlertsDataTypeOfDataConnector",
          "description": "The available data types for the connector."
        }
      },
      "type": "object"
    },
    "ASCDataConnector": {
      "allOf": [
        {
          "$ref": "#/definitions/DataConnector"
        }
      ],
      "description": "Represents ASC (Azure Security Center) data connector.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/ASCDataConnectorProperties",
          "description": "ASC (Azure Security Center) data connector properties.",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "AzureSecurityCenter"
    },
    "ASCDataConnectorProperties": {
      "allOf": [
        {
          "$ref": "#/definitions/DataConnectorWithAlertsProperties"
        }
      ],
      "description": "ASC (Azure Security Center) data connector properties.",
      "properties": {
        "subscriptionId": {
          "description": "The subscription id to connect to, and get the data from.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "ActionRequest": {
      "allOf": [
        {
          "$ref": "#/definitions/ResourceWithEtag"
        }
      ],
      "description": "Action for alert rule.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/ActionRequestProperties",
          "description": "Action properties for put request",
          "x-ms-client-flatten": true
        }
      },
      "type": "object"
    },
    "ActionPropertiesBase": {
      "description": "Action property bag base.",
      "properties": {
        "logicAppResourceId": {
          "description": "Logic App Resource Id, /subscriptions/{my-subscription}/resourceGroups/{my-resource-group}/providers/Microsoft.Logic/workflows/{my-workflow-id}.",
          "type": "string"
        }
      },
      "required": [
        "logicAppResourceId"
      ],
      "type": "object"
    },
    "ActionRequestProperties": {
      "allOf": [
        {
          "$ref": "#/definitions/ActionPropertiesBase"
        }
      ],
      "description": "Action property bag.",
      "properties": {
        "triggerUri": {
          "description": "Logic App Callback URL for this specific workflow.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "ActionResponse": {
      "allOf": [
        {
          "$ref": "#/definitions/Resource"
        }
      ],
      "description": "Action for alert rule.",
      "properties": {
        "etag": {
          "description": "Etag of the action.",
          "type": "string"
        },
        "properties": {
          "$ref": "#/definitions/ActionResponseProperties",
          "description": "Action properties for get request",
          "x-ms-client-flatten": true
        }
      },
      "type": "object"
    },
    "ActionResponseProperties": {
      "allOf": [
        {
          "$ref": "#/definitions/ActionPropertiesBase"
        }
      ],
      "description": "Action property bag.",
      "properties": {
        "workflowId": {
          "description": "The name of the logic app's workflow.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "ActionsList": {
      "description": "List all the actions.",
      "properties": {
        "nextLink": {
          "description": "URL to fetch the next set of actions.",
          "readOnly": true,
          "type": "string"
        },
        "value": {
          "description": "Array of actions.",
          "items": {
            "$ref": "#/definitions/ActionResponse"
          },
          "type": "array"
        }
      },
      "required": [
        "value"
      ]
    },
    "AlertRule": {
      "allOf": [
        {
          "$ref": "#/definitions/ResourceWithEtag"
        }
      ],
      "description": "Alert rule.",
      "discriminator": "kind",
      "required": [
        "kind"
      ],
      "properties": {
        "kind": {
          "$ref": "#/definitions/AlertRuleKind",
          "description": "The alert rule kind"
        }
      },
      "type": "object"
    },
    "AlertRuleKind": {
      "description": "The kind of the alert rule",
      "enum": [
        "Scheduled",
        "MicrosoftSecurityIncidentCreation",
        "Fusion"
      ],
      "type": "string",
      "x-ms-enum": {
        "modelAsString": true,
        "name": "AlertRuleKind",
        "values": [
          {
            "value": "Scheduled"
          },
          {
            "value": "MicrosoftSecurityIncidentCreation"
          },
          {
            "value": "Fusion"
          }
        ]
      }
    },
    "AlertRuleTemplateStatus": {
      "description": "The alert rule template status.",
      "enum": [
        "Installed",
        "Available",
        "NotAvailable"
      ],
      "type": "string",
      "x-ms-enum": {
        "modelAsString": true,
        "name": "TemplateStatus",
        "values": [
          {
            "description": "Alert rule template installed. and can not use more then once",
            "value": "Installed"
          },
          {
            "description": "Alert rule template is available.",
            "value": "Available"
          },
          {
            "description": "Alert rule template is not available",
            "value": "NotAvailable"
          }
        ]
      }
    },
    "AlertRuleTemplate": {
      "allOf": [
        {
          "$ref": "#/definitions/Resource"
        }
      ],
      "description": "Alert rule template.",
      "discriminator": "kind",
      "required": [
        "kind"
      ],
      "properties": {
        "kind": {
          "$ref": "#/definitions/AlertRuleKind",
          "description": "The alert rule kind",
          "type": "string"
        }
      },
      "type": "object"
    },
    "AlertRuleTemplateDataSource": {
      "description": "alert rule template data sources",
      "properties": {
        "connectorId": {
          "description": "The connector id that provides the following data types",
          "type": "string"
        },
        "dataTypes": {
          "description": "The data types used by the alert rule template",
          "items": {
            "type": "string"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "AlertRuleTemplatesList": {
      "description": "List all the alert rule templates.",
      "properties": {
        "nextLink": {
          "description": "URL to fetch the next set of alert rule templates.",
          "readOnly": true,
          "type": "string"
        },
        "value": {
          "description": "Array of alert rule templates.",
          "items": {
            "$ref": "#/definitions/AlertRuleTemplate"
          },
          "type": "array"
        }
      },
      "required": [
        "value"
      ]
    },
    "AlertRuleTriggerOperator": {
      "description": "The operation against the threshold that triggers alert rule.",
      "enum": [
        "GreaterThan",
        "LessThan",
        "Equal",
        "NotEqual"
      ],
      "type": "string",
      "x-ms-enum": {
        "modelAsString": false,
        "name": "TriggerOperator"
      }
    },
    "AlertRulesList": {
      "description": "List all the alert rules.",
      "properties": {
        "nextLink": {
          "description": "URL to fetch the next set of alert rules.",
          "readOnly": true,
          "type": "string"
        },
        "value": {
          "description": "Array of alert rules.",
          "items": {
            "$ref": "#/definitions/AlertRule"
          },
          "type": "array"
        }
      },
      "required": [
        "value"
      ]
    },
    "AlertSeverity": {
      "description": "The severity of the alert",
      "enum": [
        "High",
        "Medium",
        "Low",
        "Informational"
      ],
      "type": "string",
      "x-ms-enum": {
        "modelAsString": true,
        "name": "AlertSeverity",
        "values": [
          {
            "description": "High severity",
            "value": "High"
          },
          {
            "description": "Medium severity",
            "value": "Medium"
          },
          {
            "description": "Low severity",
            "value": "Low"
          },
          {
            "description": "Informational severity",
            "value": "Informational"
          }
        ]
      }
    },
    "MicrosoftSecurityProductName": {
      "description": "The alerts' productName on which the cases will be generated",
      "enum": [
        "Microsoft Cloud App Security",
        "Azure Security Center",
        "Azure Advanced Threat Protection",
        "Azure Active Directory Identity Protection",
        "Azure Security Center for IoT"
      ],
      "type": "string",
      "x-ms-enum": {
        "modelAsString": true,
        "name": "MicrosoftSecurityProductName"
      }
    },
    "AlertsDataTypeOfDataConnector": {
      "description": "Alerts data type for data connectors.",
      "properties": {
        "alerts": {
          "$ref": "#/definitions/DataConnectorDataTypeCommon",
          "description": "Alerts data type connection.",
          "type": "object"
        }
      },
      "type": "object"
    },
    "AttackTactic": {
      "description": "The severity for alerts created by this alert rule.",
      "enum": [
        "InitialAccess",
        "Execution",
        "Persistence",
        "PrivilegeEscalation",
        "DefenseEvasion",
        "CredentialAccess",
        "Discovery",
        "LateralMovement",
        "Collection",
        "Exfiltration",
        "CommandAndControl",
        "Impact"
      ],
      "type": "string",
      "x-ms-enum": {
        "modelAsString": true,
        "name": "AttackTactic"
      }
    },
    "AwsCloudTrailDataConnector": {
      "allOf": [
        {
          "$ref": "#/definitions/DataConnector"
        }
      ],
      "description": "Represents Amazon Web Services CloudTrail data connector.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/AwsCloudTrailDataConnectorProperties",
          "description": "Amazon Web Services CloudTrail data connector properties.",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "AmazonWebServicesCloudTrail"
    },
    "AwsCloudTrailDataConnectorDataTypes": {
      "description": "The available data types for Amazon Web Services CloudTrail data connector.",
      "properties": {
        "logs": {
          "allOf": [
            {
              "$ref": "#/definitions/DataConnectorDataTypeCommon"
            }
          ],
          "description": "Logs data type.",
          "type": "object"
        }
      },
      "type": "object"
    },
    "AwsCloudTrailDataConnectorProperties": {
      "description": "Amazon Web Services CloudTrail data connector properties.",
      "properties": {
        "awsRoleArn": {
          "description": "The Aws Role Arn (with CloudTrailReadOnly policy) that is used to access the Aws account.",
          "type": "string"
        },
        "dataTypes": {
          "$ref": "#/definitions/AwsCloudTrailDataConnectorDataTypes",
          "description": "The available data types for the connector."
        }
      },
      "type": "object"
    },
    "Bookmark": {
      "allOf": [
        {
          "$ref": "#/definitions/ResourceWithEtag"
        }
      ],
      "description": "Represents a bookmark in Azure Security Insights.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/BookmarkProperties",
          "description": "Bookmark properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object"
    },
    "BookmarkList": {
      "description": "List all the bookmarks.",
      "properties": {
        "nextLink": {
          "description": "URL to fetch the next set of cases.",
          "readOnly": true,
          "type": "string"
        },
        "value": {
          "description": "Array of bookmarks.",
          "items": {
            "$ref": "#/definitions/Bookmark"
          },
          "type": "array"
        }
      },
      "required": [
        "value"
      ]
    },
    "BookmarkProperties": {
      "description": "Describes bookmark properties",
      "properties": {
        "created": {
          "description": "The time the bookmark was created",
          "format": "date-time",
          "type": "string"
        },
        "createdBy": {
          "$ref": "#/definitions/UserInfo",
          "description": "Describes a user that created the bookmark",
          "type": "object"
        },
        "displayName": {
          "description": "The display name of the bookmark",
          "type": "string"
        },
        "labels": {
          "description": "List of labels relevant to this bookmark",
          "items": {
            "$ref": "#/definitions/Label"
          },
          "type": "array"
        },
        "notes": {
          "description": "The notes of the bookmark",
          "type": "string"
        },
        "query": {
          "description": "The query of the bookmark.",
          "type": "string"
        },
        "queryResult": {
          "description": "The query result of the bookmark.",
          "type": "string"
        },
        "updated": {
          "description": "The last time the bookmark was updated",
          "format": "date-time",
          "type": "string"
        },
        "updatedBy": {
          "$ref": "#/definitions/UserInfo",
          "description": "Describes a user that updated the bookmark",
          "type": "object"
        },
        "incidentInfo": {
          "$ref": "#/definitions/IncidentInfo",
          "description": "Describes an incident that relates to bookmark",
          "type": "object"
        }
      },
      "required": [
        "displayName",
        "query"
      ],
      "type": "object"
    },
    "ClientInfo": {
      "description": "Information on the client (user or application) that made some action",
      "properties": {
        "email": {
          "description": "The email of the client.",
          "type": "string"
        },
        "name": {
          "description": "The name of the client.",
          "type": "string"
        },
        "objectId": {
          "description": "The object id of the client.",
          "format": "uuid",
          "type": "string"
        },
        "userPrincipalName": {
          "description": "The user principal name of the client.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "CloudError": {
      "x-ms-external": true,
      "properties": {
        "error": {
          "$ref": "../../../../../common-types/resource-management/v1/types.json#/definitions/ErrorResponse",
          "description": "The error object of the CloudError response"
        }
      },
      "description": "An error response for a resource management request."
    },
    "DataConnector": {
      "allOf": [
        {
          "$ref": "#/definitions/ResourceWithEtag"
        }
      ],
      "description": "Data connector.",
      "discriminator": "kind",
      "required": [
        "kind"
      ],
      "properties": {
        "kind": {
          "$ref": "#/definitions/DataConnectorKind",
          "description": "The data connector kind"
        }
      },
      "type": "object"
    },
    "DataConnectorDataTypeCommon": {
      "description": "Common field for data type in data connectors.",
      "properties": {
        "state": {
          "description": "Describe whether this data type connection is enabled or not.",
          "enum": [
            "Enabled",
            "Disabled"
          ],
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "DataTypeState"
          }
        }
      },
      "type": "object"
    },
    "DataConnectorKind": {
      "description": "The kind of the data connector",
      "enum": [
        "AzureActiveDirectory",
        "AzureSecurityCenter",
        "MicrosoftCloudAppSecurity",
        "ThreatIntelligence",
        "Office365",
        "AmazonWebServicesCloudTrail",
        "AzureAdvancedThreatProtection",
        "MicrosoftDefenderAdvancedThreatProtection"
      ],
      "type": "string",
      "x-ms-enum": {
        "modelAsString": true,
        "name": "DataConnectorKind",
        "values": [
          {
            "value": "AzureActiveDirectory"
          },
          {
            "value": "AzureSecurityCenter"
          },
          {
            "value": "MicrosoftCloudAppSecurity"
          },
          {
            "value": "ThreatIntelligence"
          },
          {
            "value": "Office365"
          },
          {
            "value": "AmazonWebServicesCloudTrail"
          },
          {
            "value": "AzureAdvancedThreatProtection"
          },
          {
            "value": "MicrosoftDefenderAdvancedThreatProtection"
          }
        ]
      }
    },
    "DataConnectorList": {
      "description": "List all the data connectors.",
      "properties": {
        "nextLink": {
          "description": "URL to fetch the next set of data connectors.",
          "readOnly": true,
          "type": "string"
        },
        "value": {
          "description": "Array of data connectors.",
          "items": {
            "$ref": "#/definitions/DataConnector"
          },
          "type": "array"
        }
      },
      "required": [
        "value"
      ]
    },
    "DataConnectorTenantId": {
      "description": "Properties data connector on tenant level.",
      "properties": {
        "tenantId": {
          "description": "The tenant id to connect to, and get the data from.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "DataConnectorWithAlertsProperties": {
      "description": "Data connector properties.",
      "properties": {
        "dataTypes": {
          "$ref": "#/definitions/AlertsDataTypeOfDataConnector",
          "description": "The available data types for the connector."
        }
      },
      "type": "object"
    },
    "FusionAlertRule": {
      "allOf": [
        {
          "$ref": "#/definitions/AlertRule"
        }
      ],
      "description": "Represents Fusion alert rule.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/FusionAlertRuleProperties",
          "description": "Fusion alert rule properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "Fusion"
    },
    "FusionAlertRuleProperties": {
      "description": "Fusion alert rule base property bag.",
      "properties": {
        "alertRuleTemplateName": {
          "description": "The Name of the alert rule template used to create this rule.",
          "type": "string"
        },
        "description": {
          "description": "The description of the alert rule.",
          "readOnly": true,
          "type": "string"
        },
        "displayName": {
          "description": "The display name for alerts created by this alert rule.",
          "readOnly": true,
          "type": "string"
        },
        "enabled": {
          "description": "Determines whether this alert rule is enabled or disabled.",
          "type": "boolean"
        },
        "lastModifiedUtc": {
          "description": "The last time that this alert has been modified.",
          "format": "date-time",
          "readOnly": true,
          "type": "string"
        },
        "severity": {
          "$ref": "#/definitions/AlertSeverity",
          "description": "The severity for alerts created by this alert rule.",
          "readOnly": true
        },
        "tactics": {
          "description": "The tactics of the alert rule",
          "items": {
            "$ref": "#/definitions/AttackTactic"
          },
          "readOnly": true,
          "type": "array"
        }
      },
      "required": [
        "alertRuleTemplateName",
        "enabled"
      ],
      "type": "object"
    },
    "FusionAlertRuleTemplate": {
      "allOf": [
        {
          "$ref": "#/definitions/AlertRuleTemplate"
        }
      ],
      "description": "Represents Fusion alert rule template.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/FusionAlertRuleTemplateProperties",
          "description": "Fusion alert rule template properties",
          "required": [
            "displayName",
            "description",
            "status",
            "severity",
            "alertRulesCreatedByTemplateCount"
          ],
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "Fusion"
    },
    "FusionAlertRuleTemplateProperties": {
      "description": "Represents Fusion alert rule template properties",
      "properties": {
        "alertRulesCreatedByTemplateCount": {
          "description": "the number of alert rules that were created by this template",
          "format": "int32",
          "type": "integer"
        },
        "createdDateUTC": {
          "description": "The time that this alert rule template has been added.",
          "format": "date-time",
          "readOnly": true,
          "type": "string"
        },
        "description": {
          "description": "The description of the alert rule template.",
          "type": "string"
        },
        "displayName": {
          "description": "The display name for alert rule template.",
          "type": "string"
        },
        "requiredDataConnectors": {
          "description": "The required data connectors for this template",
          "items": {
            "$ref": "#/definitions/AlertRuleTemplateDataSource"
          },
          "type": "array"
        },
        "status": {
          "$ref": "#/definitions/AlertRuleTemplateStatus",
          "description": "The alert rule template status.",
          "type": "string"
        },
        "severity": {
          "$ref": "#/definitions/AlertSeverity",
          "description": "The severity for alerts created by this alert rule."
        },
        "tactics": {
          "description": "The tactics of the alert rule template",
          "items": {
            "$ref": "#/definitions/AttackTactic"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "Incident": {
      "allOf": [
        {
          "$ref": "#/definitions/ResourceWithEtag"
        }
      ],
      "description": "Represents an incident in Azure Security Insights.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/IncidentProperties",
          "description": "Incident properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object"
    },
    "IncidentAdditionalData": {
      "description": "Incident additional data property bag.",
      "properties": {
        "alertsCount": {
          "description": "The number of alerts in the incident",
          "format": "int32",
          "readOnly": true,
          "type": "integer"
        },
        "bookmarksCount": {
          "description": "The number of bookmarks in the incident",
          "format": "int32",
          "readOnly": true,
          "type": "integer"
        },
        "commentsCount": {
          "description": "The number of comments in the incident",
          "format": "int32",
          "readOnly": true,
          "type": "integer"
        },
        "alertProductNames": {
          "description": "List of product names of alerts in the incident",
          "items": {
            "description": "Alert product name",
            "type": "string"
          },
          "readOnly": true,
          "type": "array"
        },
        "tactics": {
          "description": "The tactics associated with incident",
          "items": {
            "$ref": "#/definitions/AttackTactic"
          },
          "readOnly": true,
          "type": "array"
        }
      },
      "type": "object"
    },
    "IncidentComment": {
      "allOf": [
        {
          "$ref": "#/definitions/Resource"
        }
      ],
      "description": "Represents an incident comment",
      "properties": {
        "properties": {
          "$ref": "#/definitions/IncidentCommentProperties",
          "description": "Incident comment properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object"
    },
    "IncidentCommentList": {
      "description": "List of incident comments.",
      "properties": {
        "nextLink": {
          "description": "URL to fetch the next set of comments.",
          "readOnly": true,
          "type": "string"
        },
        "value": {
          "description": "Array of comments.",
          "items": {
            "$ref": "#/definitions/IncidentComment"
          },
          "type": "array"
        }
      },
      "required": [
        "value"
      ]
    },
    "IncidentCommentProperties": {
      "description": "Incident comment property bag.",
      "properties": {
        "createdTimeUtc": {
          "description": "The time the comment was created",
          "format": "date-time",
          "readOnly": true,
          "type": "string"
        },
        "message": {
          "description": "The comment message",
          "type": "string"
        },
        "author": {
          "$ref": "#/definitions/ClientInfo",
          "description": "Describes the client that created the comment",
          "readOnly": true,
          "type": "object"
        }
      },
      "required": [
        "message"
      ],
      "type": "object"
    },
    "IncidentLabel": {
      "description": "Represents an incident label",
      "properties": {
        "labelName": {
          "description": "The name of the label",
          "type": "string"
        },
        "labelType": {
          "description": "The type of the label",
          "enum": [
            "User",
            "System"
          ],
          "type": "string",
          "readOnly": true,
          "x-ms-enum": {
            "modelAsString": true,
            "name": "IncidentLabelType",
            "values": [
              {
                "description": "Label manually created by a user",
                "value": "User"
              },
              {
                "description": "Label automatically created by the system",
                "value": "System"
              }
            ]
          }
        }
      },
      "required": [
        "labelName"
      ],
      "type": "object"
    },
    "IncidentList": {
      "description": "List all the incidents.",
      "properties": {
        "nextLink": {
          "description": "URL to fetch the next set of incidents.",
          "readOnly": true,
          "type": "string"
        },
        "value": {
          "description": "Array of incidents.",
          "items": {
            "$ref": "#/definitions/Incident"
          },
          "type": "array"
        }
      },
      "required": [
        "value"
      ]
    },
    "IncidentOwnerInfo": {
      "description": "Information on the user an incident is assigned to",
      "properties": {
        "email": {
          "description": "The email of the user the incident is assigned to.",
          "type": "string"
        },
        "assignedTo": {
          "description": "The name of the user the incident is assigned to.",
          "type": "string"
        },
        "objectId": {
          "description": "The object id of the user the incident is assigned to.",
          "format": "uuid",
          "type": "string"
        },
        "userPrincipalName": {
          "description": "The user principal name of the user the incident is assigned to.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "IncidentProperties": {
      "description": "Describes incident properties",
      "properties": {
        "additionalData": {
          "$ref": "#/definitions/IncidentAdditionalData",
          "description": "Additional data on the incident",
          "readOnly": true,
          "type": "object"
        },
        "classification": {
          "description": "The reason the incident was closed",
          "enum": [
            "Undetermined",
            "TruePositive",
            "BenignPositive",
            "FalsePositive"
          ],
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "IncidentClassification",
            "values": [
              {
                "description": "Incident classification was undetermined",
                "value": "Undetermined"
              },
              {
                "description": "Incident was true positive",
                "value": "TruePositive"
              },
              {
                "description": "Incident was benign positive",
                "value": "BenignPositive"
              },
              {
                "description": "Incident was false positive",
                "value": "FalsePositive"
              }
            ]
          }
        },
        "classificationComment": {
          "description": "Describes the reason the incident was closed",
          "type": "string"
        },
        "classificationReason": {
          "description": "The classification reason the incident was closed with",
          "enum": [
            "SuspiciousActivity",
            "SuspiciousButExpected",
            "IncorrectAlertLogic",
            "InaccurateData"
          ],
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "IncidentClassificationReason",
            "values": [
              {
                "description": "Classification reason was suspicious activity",
                "value": "SuspiciousActivity"
              },
              {
                "description": "Classification reason was suspicious but expected",
                "value": "SuspiciousButExpected"
              },
              {
                "description": "Classification reason was incorrect alert logic",
                "value": "IncorrectAlertLogic"
              },
              {
                "description": "Classification reason was inaccurate data",
                "value": "InaccurateData"
              }
            ]
          }
        },
        "createdTimeUtc": {
          "description": "The time the incident was created",
          "format": "date-time",
          "readOnly": true,
          "type": "string"
        },
        "description": {
          "description": "The description of the incident",
          "type": "string"
        },
        "firstActivityTimeUtc": {
          "description": "The time of the first activity in the incident",
          "format": "date-time",
          "type": "string"
        },
        "incidentUrl": {
          "description": "The deep-link url to the incident in Azure portal",
          "readOnly": true,
          "type": "string"
        },
        "incidentNumber": {
          "description": "A sequential number",
          "format": "int32",
          "readOnly": true,
          "type": "integer"
        },
        "labels": {
          "description": "List of labels relevant to this incident",
          "items": {
            "$ref": "#/definitions/IncidentLabel"
          },
          "type": "array"
        },
        "lastActivityTimeUtc": {
          "description": "The time of the last activity in the incident",
          "format": "date-time",
          "type": "string"
        },
        "lastModifiedTimeUtc": {
          "description": "The last time the incident was updated",
          "format": "date-time",
          "readOnly": true,
          "type": "string"
        },
        "owner": {
          "$ref": "#/definitions/IncidentOwnerInfo",
          "description": "Describes a user that the incident is assigned to",
          "type": "object"
        },
        "relatedAnalyticRuleIds": {
          "description": "List of resource ids of Analytic rules related to the incident",
          "items": {
            "description": "Related Analytic rule resource id",
            "type": "string"
          },
          "readOnly": true,
          "type": "array"
        },
        "severity": {
          "description": "The severity of the incident",
          "enum": [
            "High",
            "Medium",
            "Low",
            "Informational"
          ],
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "IncidentSeverity",
            "values": [
              {
                "description": "High severity",
                "value": "High"
              },
              {
                "description": "Medium severity",
                "value": "Medium"
              },
              {
                "description": "Low severity",
                "value": "Low"
              },
              {
                "description": "Informational severity",
                "value": "Informational"
              }
            ]
          }
        },
        "status": {
          "description": "The status of the incident",
          "enum": [
            "New",
            "Active",
            "Closed"
          ],
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "IncidentStatus",
            "values": [
              {
                "description": "An active incident which isn't being handled currently",
                "value": "New"
              },
              {
                "description": "An active incident which is being handled",
                "value": "Active"
              },
              {
                "description": "A non-active incident",
                "value": "Closed"
              }
            ]
          }
        },
        "title": {
          "description": "The title of the incident",
          "type": "string"
        }
      },
      "required": [
        "title",
        "severity",
        "status"
      ],
      "type": "object"
    },
    "Label": {
      "description": "Label that will be used to tag and filter on.",
      "type": "string"
    },
    "MCASDataConnector": {
      "allOf": [
        {
          "$ref": "#/definitions/DataConnector"
        }
      ],
      "description": "Represents MCAS (Microsoft Cloud App Security) data connector.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/MCASDataConnectorProperties",
          "description": "MCAS (Microsoft Cloud App Security) data connector properties.",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "MicrosoftCloudAppSecurity"
    },
    "MCASDataConnectorDataTypes": {
      "allOf": [
        {
          "$ref": "#/definitions/AlertsDataTypeOfDataConnector"
        }
      ],
      "description": "The available data types for MCAS (Microsoft Cloud App Security) data connector.",
      "properties": {
        "alerts": {
          "$ref": "#/definitions/DataConnectorDataTypeCommon",
          "description": "Alerts data type connection."
        },
        "discoveryLogs": {
          "$ref": "#/definitions/DataConnectorDataTypeCommon",
          "description": "Discovery log data type connection."
        }
      },
      "type": "object"
    },
    "MCASDataConnectorProperties": {
      "description": "MCAS (Microsoft Cloud App Security) data connector properties.",
      "properties": {
        "tenantId": {
          "description": "The tenant id to connect to, and get the data from.",
          "type": "string"
        },
        "dataTypes": {
          "$ref": "#/definitions/MCASDataConnectorDataTypes",
          "description": "The available data types for the connector."
        }
      },
      "type": "object"
    },
    "MDATPDataConnector": {
      "allOf": [
        {
          "$ref": "#/definitions/DataConnector"
        }
      ],
      "description": "Represents MDATP (Microsoft Defender Advanced Threat Protection) data connector.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/MDATPDataConnectorProperties",
          "description": "MDATP (Microsoft Defender Advanced Threat Protection) data connector properties.",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "MicrosoftDefenderAdvancedThreatProtection"
    },
    "MDATPDataConnectorProperties": {
      "description": "MDATP (Microsoft Defender Advanced Threat Protection) data connector properties.",
      "properties": {
        "tenantId": {
          "description": "The tenant id to connect to, and get the data from.",
          "type": "string"
        },
        "dataTypes": {
          "$ref": "#/definitions/AlertsDataTypeOfDataConnector",
          "description": "The available data types for the connector."
        }
      },
      "type": "object"
    },
    "MicrosoftSecurityIncidentCreationAlertRule": {
      "allOf": [
        {
          "$ref": "#/definitions/AlertRule"
        }
      ],
      "description": "Represents MicrosoftSecurityIncidentCreation rule.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/MicrosoftSecurityIncidentCreationAlertRuleProperties",
          "description": "MicrosoftSecurityIncidentCreation rule properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "MicrosoftSecurityIncidentCreation"
    },
    "MicrosoftSecurityIncidentCreationAlertRuleCommonProperties": {
      "description": "MicrosoftSecurityIncidentCreation rule common property bag.",
      "properties": {
        "displayNamesFilter": {
          "description": "the alerts' displayNames on which the cases will be generated",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "displayNamesExcludeFilter": {
          "description": "the alerts' displayNames on which the cases will not be generated",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "productFilter": {
          "$ref": "#/definitions/MicrosoftSecurityProductName",
          "description": "The alerts' productName on which the cases will be generated"
        },
        "severitiesFilter": {
          "description": "the alerts' severities on which the cases will be generated",
          "items": {
            "$ref": "#/definitions/AlertSeverity"
          },
          "type": "array"
        }
      },
      "required": [
        "productFilter"
      ],
      "type": "object"
    },
    "MicrosoftSecurityIncidentCreationAlertRuleProperties": {
      "allOf": [
        {
          "$ref": "#/definitions/MicrosoftSecurityIncidentCreationAlertRuleCommonProperties"
        }
      ],
      "description": "MicrosoftSecurityIncidentCreation rule property bag.",
      "properties": {
        "alertRuleTemplateName": {
          "description": "The Name of the alert rule template used to create this rule.",
          "type": "string"
        },
        "description": {
          "description": "The description of the alert rule.",
          "type": "string"
        },
        "displayName": {
          "description": "The display name for alerts created by this alert rule.",
          "type": "string"
        },
        "enabled": {
          "description": "Determines whether this alert rule is enabled or disabled.",
          "type": "boolean"
        },
        "lastModifiedUtc": {
          "description": "The last time that this alert has been modified.",
          "format": "date-time",
          "readOnly": true,
          "type": "string"
        }
      },
      "required": [
        "displayName",
        "enabled",
        "productFilter"
      ],
      "type": "object"
    },
    "MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties": {
      "description": "MicrosoftSecurityIncidentCreation rule template properties",
      "properties": {
        "alertRulesCreatedByTemplateCount": {
          "description": "the number of alert rules that were created by this template",
          "format": "int32",
          "type": "integer"
        },
        "createdDateUTC": {
          "description": "The time that this alert rule template has been added.",
          "format": "date-time",
          "readOnly": true,
          "type": "string"
        },
        "description": {
          "description": "The description of the alert rule template.",
          "type": "string"
        },
        "displayName": {
          "description": "The display name for alert rule template.",
          "type": "string"
        },
        "requiredDataConnectors": {
          "description": "The required data connectors for this template",
          "items": {
            "$ref": "#/definitions/AlertRuleTemplateDataSource"
          },
          "type": "array"
        },
        "status": {
          "$ref": "#/definitions/AlertRuleTemplateStatus",
          "description": "The alert rule template status.",
          "type": "string"
        },
        "displayNamesFilter": {
          "description": "the alerts' displayNames on which the cases will be generated",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "displayNamesExcludeFilter": {
          "description": "the alerts' displayNames on which the cases will not be generated",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "productFilter": {
          "$ref": "#/definitions/MicrosoftSecurityProductName",
          "description": "The alerts' productName on which the cases will be generated"
        },
        "severitiesFilter": {
          "description": "the alerts' severities on which the cases will be generated",
          "items": {
            "$ref": "#/definitions/AlertSeverity"
          },
          "type": "array"
        }
      },
      "required": [
        "productFilter"
      ],
      "type": "object"
    },
    "MicrosoftSecurityIncidentCreationAlertRuleTemplate": {
      "allOf": [
        {
          "$ref": "#/definitions/AlertRuleTemplate"
        }
      ],
      "description": "Represents MicrosoftSecurityIncidentCreation rule template.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties",
          "description": "MicrosoftSecurityIncidentCreation rule template properties",
          "required": [
            "displayName",
            "description",
            "createdDateUTC",
            "status",
            "alertRulesCreatedByTemplateCount",
            "productFilter"
          ],
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "MicrosoftSecurityIncidentCreation"
    },
    "OfficeConsent": {
      "allOf": [
        {
          "$ref": "#/definitions/Resource"
        }
      ],
      "description": "Consent for Office365 tenant that already made.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/OfficeConsentProperties",
          "description": "Office consent properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object"
    },
    "OfficeConsentList": {
      "description": "List of all the office365 consents.",
      "properties": {
        "nextLink": {
          "description": "URL to fetch the next set of office consents.",
          "readOnly": true,
          "type": "string"
        },
        "value": {
          "description": "Array of the consents.",
          "items": {
            "$ref": "#/definitions/OfficeConsent"
          },
          "type": "array"
        }
      },
      "required": [
        "value"
      ]
    },
    "OfficeConsentProperties": {
      "description": "Consent property bag.",
      "properties": {
        "tenantId": {
          "description": "The tenantId of the Office365 with the consent.",
          "type": "string"
        },
        "tenantName": {
          "description": "The tenant name of the Office365 with the consent.",
          "readOnly": true,
          "type": "string"
        }
      },
      "type": "object"
    },
    "OfficeDataConnector": {
      "allOf": [
        {
          "$ref": "#/definitions/DataConnector"
        }
      ],
      "description": "Represents office data connector.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/OfficeDataConnectorProperties",
          "description": "Office data connector properties.",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "Office365"
    },
    "OfficeDataConnectorDataTypes": {
      "description": "The available data types for office data connector.",
      "properties": {
        "exchange": {
          "allOf": [
            {
              "$ref": "#/definitions/DataConnectorDataTypeCommon"
            }
          ],
          "description": "Exchange data type connection.",
          "type": "object"
        },
        "sharePoint": {
          "allOf": [
            {
              "$ref": "#/definitions/DataConnectorDataTypeCommon"
            }
          ],
          "description": "SharePoint data type connection.",
          "type": "object"
        },
        "teams": {
          "allOf": [
            {
              "$ref": "#/definitions/DataConnectorDataTypeCommon"
            }
          ],
          "description": "Teams data type connection.",
          "type": "object"
        }
      },
      "type": "object"
    },
    "OfficeDataConnectorProperties": {
      "description": "Office data connector properties.",
      "properties": {
        "tenantId": {
          "description": "The tenant id to connect to, and get the data from.",
          "type": "string"
        },
        "dataTypes": {
          "$ref": "#/definitions/OfficeDataConnectorDataTypes",
          "description": "The available data types for the connector."
        }
      },
      "type": "object"
    },
    "Operation": {
      "description": "Operation provided by provider",
      "properties": {
        "display": {
          "description": "Properties of the operation",
          "properties": {
            "description": {
              "description": "Description of the operation",
              "type": "string"
            },
            "operation": {
              "description": "Operation name",
              "type": "string"
            },
            "provider": {
              "description": "Provider name",
              "type": "string"
            },
            "resource": {
              "description": "Resource name",
              "type": "string"
            }
          },
          "type": "object"
        },
        "name": {
          "description": "Name of the operation",
          "type": "string"
        }
      }
    },
    "OperationsList": {
      "description": "Lists the operations available in the SecurityInsights RP.",
      "properties": {
        "nextLink": {
          "description": "URL to fetch the next set of operations.",
          "type": "string"
        },
        "value": {
          "description": "Array of operations",
          "items": {
            "$ref": "#/definitions/Operation"
          },
          "type": "array"
        }
      },
      "required": [
        "value"
      ]
    },
    "Resource": {
      "description": "An azure resource object",
      "properties": {
        "id": {
          "description": "Azure resource Id",
          "readOnly": true,
          "type": "string"
        },
        "name": {
          "description": "Azure resource name",
          "readOnly": true,
          "type": "string"
        },
        "type": {
          "description": "Azure resource type",
          "readOnly": true,
          "type": "string"
        }
      },
      "x-ms-azure-resource": true
    },
    "ResourceWithEtag": {
      "description": "An azure resource object with an Etag property",
      "properties": {
        "id": {
          "description": "Azure resource Id",
          "readOnly": true,
          "type": "string"
        },
        "name": {
          "description": "Azure resource name",
          "readOnly": true,
          "type": "string"
        },
        "type": {
          "description": "Azure resource type",
          "readOnly": true,
          "type": "string"
        },
        "etag": {
          "description": "Etag of the azure resource",
          "type": "string"
        }
      },
      "x-ms-azure-resource": true
    },
    "ScheduledAlertRule": {
      "allOf": [
        {
          "$ref": "#/definitions/AlertRule"
        }
      ],
      "description": "Represents scheduled alert rule.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/ScheduledAlertRuleProperties",
          "description": "Scheduled alert rule properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "Scheduled"
    },
    "ScheduledAlertRuleCommonProperties": {
      "description": "Schedule alert rule template property bag.",
      "properties": {
        "query": {
          "description": "The query that creates alerts for this rule.",
          "type": "string"
        },
        "queryFrequency": {
          "description": "The frequency (in ISO 8601 duration format) for this alert rule to run.",
          "format": "duration",
          "type": "string"
        },
        "queryPeriod": {
          "description": "The period (in ISO 8601 duration format) that this alert rule looks at.",
          "format": "duration",
          "type": "string"
        },
        "severity": {
          "$ref": "#/definitions/AlertSeverity",
          "description": "The severity for alerts created by this alert rule."
        },
        "triggerOperator": {
          "$ref": "#/definitions/AlertRuleTriggerOperator",
          "description": "The operation against the threshold that triggers alert rule."
        },
        "triggerThreshold": {
          "description": "The threshold triggers this alert rule.",
          "format": "int32",
          "type": "integer"
        }
      },
      "type": "object"
    },
    "ScheduledAlertRuleProperties": {
      "allOf": [
        {
          "$ref": "#/definitions/ScheduledAlertRuleCommonProperties"
        }
      ],
      "description": "Scheduled alert rule base property bag.",
      "properties": {
        "alertRuleTemplateName": {
          "description": "The Name of the alert rule template used to create this rule.",
          "type": "string"
        },
        "description": {
          "description": "The description of the alert rule.",
          "type": "string"
        },
        "displayName": {
          "description": "The display name for alerts created by this alert rule.",
          "type": "string"
        },
        "enabled": {
          "description": "Determines whether this alert rule is enabled or disabled.",
          "type": "boolean"
        },
        "lastModifiedUtc": {
          "description": "The last time that this alert rule has been modified.",
          "format": "date-time",
          "readOnly": true,
          "type": "string"
        },
        "suppressionDuration": {
          "description": "The suppression (in ISO 8601 duration format) to wait since last time this alert rule been triggered.",
          "format": "duration",
          "type": "string"
        },
        "suppressionEnabled": {
          "description": "Determines whether the suppression for this alert rule is enabled or disabled.",
          "type": "boolean"
        },
        "tactics": {
          "description": "The tactics of the alert rule",
          "items": {
            "$ref": "#/definitions/AttackTactic"
          },
          "type": "array"
        }
      },
      "required": [
        "displayName",
        "enabled",
        "severity",
        "query",
        "queryFrequency",
        "queryPeriod",
        "triggerOperator",
        "triggerThreshold",
        "suppressionEnabled",
        "suppressionDuration"
      ],
      "type": "object"
    },
    "ScheduledAlertRuleTemplateProperties": {
      "description": "Scheduled alert rule template properties",
      "properties": {
        "alertRulesCreatedByTemplateCount": {
          "description": "the number of alert rules that were created by this template",
          "format": "int32",
          "type": "integer"
        },
        "createdDateUTC": {
          "description": "The time that this alert rule template has been added.",
          "format": "date-time",
          "readOnly": true,
          "type": "string"
        },
        "description": {
          "description": "The description of the alert rule template.",
          "type": "string"
        },
        "displayName": {
          "description": "The display name for alert rule template.",
          "type": "string"
        },
        "requiredDataConnectors": {
          "description": "The required data connectors for this template",
          "items": {
            "$ref": "#/definitions/AlertRuleTemplateDataSource"
          },
          "type": "array"
        },
        "status": {
          "$ref": "#/definitions/AlertRuleTemplateStatus",
          "description": "The alert rule template status.",
          "type": "string"
        },
        "query": {
          "description": "The query that creates alerts for this rule.",
          "type": "string"
        },
        "queryFrequency": {
          "description": "The frequency (in ISO 8601 duration format) for this alert rule to run.",
          "format": "duration",
          "type": "string"
        },
        "queryPeriod": {
          "description": "The period (in ISO 8601 duration format) that this alert rule looks at.",
          "format": "duration",
          "type": "string"
        },
        "severity": {
          "$ref": "#/definitions/AlertSeverity",
          "description": "The severity for alerts created by this alert rule."
        },
        "triggerOperator": {
          "$ref": "#/definitions/AlertRuleTriggerOperator",
          "description": "The operation against the threshold that triggers alert rule."
        },
        "triggerThreshold": {
          "description": "The threshold triggers this alert rule.",
          "format": "int32",
          "type": "integer"
        },
        "tactics": {
          "description": "The tactics of the alert rule template",
          "items": {
            "$ref": "#/definitions/AttackTactic"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "ScheduledAlertRuleTemplate": {
      "allOf": [
        {
          "$ref": "#/definitions/AlertRuleTemplate"
        }
      ],
      "description": "Represents scheduled alert rule template.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/ScheduledAlertRuleTemplateProperties",
          "description": "Scheduled alert rule template properties",
          "required": [
            "displayName",
            "description",
            "status",
            "alertRulesCreatedByTemplateCount",
            "severity",
            "query",
            "queryFrequency",
            "queryPeriod",
            "triggerOperator",
            "triggerThreshold"
          ],
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "Scheduled"
    },
    "Settings": {
      "allOf": [
        {
          "$ref": "#/definitions/ResourceWithEtag"
        }
      ],
      "description": "The Settings.",
      "discriminator": "kind",
      "required": [
        "kind"
      ],
      "properties": {
        "kind": {
          "$ref": "#/definitions/SettingsKind",
          "description": "The data connector kind"
        }
      },
      "type": "object"
    },
    "SettingsKind": {
      "description": "The kind of the setting",
      "enum": [
        "UebaSettings",
        "ToggleSettings"
      ],
      "type": "string",
      "x-ms-enum": {
        "modelAsString": true,
        "name": "SettingKind"
      }
    },
    "TIDataConnector": {
      "allOf": [
        {
          "$ref": "#/definitions/DataConnector"
        }
      ],
      "description": "Represents threat intelligence data connector.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/TIDataConnectorProperties",
          "description": "TI (Threat Intelligence) data connector properties.",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "ThreatIntelligence"
    },
    "TIDataConnectorDataTypes": {
      "description": "The available data types for TI (Threat Intelligence) data connector.",
      "properties": {
        "indicators": {
          "allOf": [
            {
              "$ref": "#/definitions/DataConnectorDataTypeCommon"
            }
          ],
          "description": "Data type for indicators connection.",
          "type": "object"
        }
      },
      "type": "object"
    },
    "TIDataConnectorProperties": {
      "description": "TI (Threat Intelligence) data connector properties.",
      "properties": {
        "tenantId": {
          "description": "The tenant id to connect to, and get the data from.",
          "type": "string"
        },
        "dataTypes": {
          "$ref": "#/definitions/TIDataConnectorDataTypes",
          "description": "The available data types for the connector."
        }
      },
      "type": "object"
    },
    "ThreatIntelligence": {
      "description": "ThreatIntelligence property bag.",
      "properties": {
        "confidence": {
          "description": "Confidence (must be between 0 and 1)",
          "format": "double",
          "readOnly": true,
          "type": "number"
        },
        "providerName": {
          "description": "Name of the provider from whom this Threat Intelligence information was received",
          "readOnly": true,
          "type": "string"
        },
        "reportLink": {
          "description": "Report link",
          "readOnly": true,
          "type": "string"
        },
        "threatDescription": {
          "description": "Threat description (free text)",
          "readOnly": true,
          "type": "string"
        },
        "threatName": {
          "description": "Threat name (e.g. \"Jedobot malware\")",
          "readOnly": true,
          "type": "string"
        },
        "threatType": {
          "description": "Threat type (e.g. \"Botnet\")",
          "readOnly": true,
          "type": "string"
        }
      },
      "type": "object"
    },
    "ToggleSettings": {
      "allOf": [
        {
          "$ref": "#/definitions/Settings"
        }
      ],
      "description": "Settings with single toggle.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/ToggleSettingsProperties",
          "description": "toggle properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "ToggleSettings"
    },
    "ToggleSettingsProperties": {
      "description": "toggle property bag.",
      "properties": {
        "isEnabled": {
          "description": "Determines whether the setting is enable or disabled.",
          "type": "boolean"
        }
      },
      "type": "object"
    },
    "UebaSettings": {
      "allOf": [
        {
          "$ref": "#/definitions/Settings"
        }
      ],
      "description": "Represents settings for User and Entity Behavior Analytics enablement.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/UebaSettingsProperties",
          "description": "User and Entity Behavior Analytics settings properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object",
      "x-ms-discriminator-value": "UebaSettings"
    },
    "UebaSettingsProperties": {
      "description": "User and Entity Behavior Analytics settings property bag.",
      "properties": {
        "atpLicenseStatus": {
          "description": "Determines whether the tenant has ATP (Advanced Threat Protection) license.",
          "enum": [
            "Enabled",
            "Disabled"
          ],
          "readOnly": true,
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "LicenseStatus"
          }
        },
        "isEnabled": {
          "description": "Determines whether User and Entity Behavior Analytics is enabled for this workspace.",
          "type": "boolean"
        },
        "statusInMcas": {
          "description": "Determines whether User and Entity Behavior Analytics is enabled from MCAS (Microsoft Cloud App Security).",
          "enum": [
            "Enabled",
            "Disabled"
          ],
          "readOnly": true,
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "StatusInMcas"
          }
        }
      },
      "type": "object"
    },
    "UserInfo": {
      "description": "User information that made some action",
      "properties": {
        "email": {
          "description": "The email of the user.",
          "readOnly": true,
          "type": "string"
        },
        "name": {
          "description": "The name of the user.",
          "readOnly": true,
          "type": "string"
        },
        "objectId": {
          "description": "The object id of the user.",
          "format": "uuid",
          "type": "string",
          "x-nullable": true
        }
      },
      "required": [
        "objectId"
      ],
      "type": "object"
    },
    "IncidentInfo": {
      "description": "Describes related incident information for the bookmark",
      "properties": {
        "incidentId": {
          "description": "Incident Id",
          "type": "string"
        },
        "severity": {
          "description": "The severity of the incident",
          "enum": [
            "Critical",
            "High",
            "Medium",
            "Low",
            "Informational"
          ],
          "type": "string",
          "x-ms-enum": {
            "modelAsString": true,
            "name": "CaseSeverity",
            "values": [
              {
                "description": "Critical severity",
                "value": "Critical"
              },
              {
                "description": "High severity",
                "value": "High"
              },
              {
                "description": "Medium severity",
                "value": "Medium"
              },
              {
                "description": "Low severity",
                "value": "Low"
              },
              {
                "description": "Informational severity",
                "value": "Informational"
              }
            ]
          }
        },
        "title": {
          "description": "The title of the incident",
          "type": "string"
        },
        "relationName": {
          "description": "Relation Name",
          "type": "string"
        }
      },
      "required": [
        "incidentId",
        "severity",
        "title",
        "relationName"
      ],
      "type": "object"
    }
  },
  "parameters": {
    "Action": {
      "description": "The action",
      "in": "body",
      "name": "action",
      "required": true,
      "schema": {
        "$ref": "#/definitions/ActionRequest"
      },
      "x-ms-parameter-location": "method"
    },
    "ActionId": {
      "description": "Action ID",
      "in": "path",
      "name": "actionId",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "AggregationsName": {
      "description": "The aggregation name. Supports - Cases",
      "in": "path",
      "name": "aggregationsName",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "AlertRule": {
      "description": "The alert rule",
      "in": "body",
      "name": "alertRule",
      "required": true,
      "schema": {
        "$ref": "#/definitions/AlertRule"
      },
      "x-ms-parameter-location": "method"
    },
    "AlertRuleTemplateId": {
      "description": "Alert rule template ID",
      "in": "path",
      "name": "alertRuleTemplateId",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "ApiVersion": {
      "description": "API version for the operation",
      "enum": [
        "2020-01-01"
      ],
      "in": "query",
      "name": "api-version",
      "required": true,
      "type": "string"
    },
    "Bookmark": {
      "description": "The bookmark",
      "in": "body",
      "name": "bookmark",
      "required": true,
      "schema": {
        "$ref": "#/definitions/Bookmark"
      },
      "x-ms-parameter-location": "method"
    },
    "BookmarkId": {
      "description": "Bookmark ID",
      "in": "path",
      "name": "bookmarkId",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "ConsentId": {
      "description": "consent ID",
      "in": "path",
      "name": "consentId",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "DataConnector": {
      "description": "The data connector",
      "in": "body",
      "name": "dataConnector",
      "required": true,
      "schema": {
        "$ref": "#/definitions/DataConnector"
      },
      "x-ms-parameter-location": "method"
    },
    "DataConnectorId": {
      "description": "Connector ID",
      "in": "path",
      "name": "dataConnectorId",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "EntityId": {
      "description": "entity ID",
      "in": "path",
      "name": "entityId",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "EntityQueryId": {
      "description": "entity query ID",
      "in": "path",
      "name": "entityQueryId",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "Incident": {
      "description": "The incident",
      "in": "body",
      "name": "incident",
      "required": true,
      "schema": {
        "$ref": "#/definitions/Incident"
      },
      "x-ms-parameter-location": "method"
    },
    "IncidentComment": {
      "description": "The incident comment",
      "in": "body",
      "name": "incidentComment",
      "required": true,
      "schema": {
        "$ref": "#/definitions/IncidentComment"
      },
      "x-ms-parameter-location": "method"
    },
    "IncidentCommentId": {
      "description": "Incident comment ID",
      "in": "path",
      "name": "incidentCommentId",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "IncidentId": {
      "description": "Incident ID",
      "in": "path",
      "name": "incidentId",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "ODataFilter": {
      "description": "Filters the results, based on a Boolean condition. Optional.",
      "in": "query",
      "name": "$filter",
      "required": false,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "ODataOrderBy": {
      "description": "Sorts the results. Optional.",
      "in": "query",
      "name": "$orderby",
      "required": false,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "ODataSkipToken": {
      "description": "Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional.",
      "in": "query",
      "name": "$skipToken",
      "required": false,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "ODataTop": {
      "description": "Returns only the first n results. Optional.",
      "format": "int32",
      "in": "query",
      "name": "$top",
      "required": false,
      "type": "integer",
      "x-ms-parameter-location": "method"
    },
    "ResourceGroupName": {
      "description": "The name of the resource group within the user's subscription. The name is case insensitive.",
      "in": "path",
      "maxLength": 90,
      "minLength": 1,
      "name": "resourceGroupName",
      "pattern": "^[-\\w\\._\\(\\)]+$",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "RuleId": {
      "description": "Alert rule ID",
      "in": "path",
      "name": "ruleId",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "Settings": {
      "description": "The setting",
      "in": "body",
      "name": "settings",
      "required": true,
      "schema": {
        "$ref": "#/definitions/Settings"
      },
      "x-ms-parameter-location": "method"
    },
    "SettingsName": {
      "description": "The setting name. Supports- Fusion, UEBA",
      "in": "path",
      "name": "settingsName",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    },
    "SubscriptionId": {
      "description": "Azure subscription ID",
      "in": "path",
      "name": "subscriptionId",
      "pattern": "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$",
      "required": true,
      "type": "string"
    },
    "WorkspaceName": {
      "description": "The name of the workspace.",
      "in": "path",
      "maxLength": 90,
      "minLength": 1,
      "name": "workspaceName",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    }
  }
}