{
  "swagger": "2.0",
  "info": {
    "title": "Security Center",
    "description": "API spec for Microsoft.Security (Azure Security Center) resource provider",
    "version": "2019-01-01-preview"
  },
  "host": "management.azure.com",
  "schemes": ["https"],
  "consumes": ["application/json"],
  "produces": ["application/json"],
  "security": [{
    "azure_auth": ["user_impersonation"]
  }],
  "securityDefinitions": {
    "azure_auth": {
      "type": "oauth2",
      "authorizationUrl": "https://login.microsoftonline.com/common/oauth2/authorize",
      "flow": "implicit",
      "description": "Azure Active Directory OAuth2 Flow",
      "scopes": {
        "user_impersonation": "impersonate your user account"
      }
    }
  },
  "paths": {
    "/subscriptions/{subscriptionId}/providers/Microsoft.Security/automations": {
      "get": {
        "x-ms-examples": {
          "Get security automations of subscription": {
            "$ref": "./examples/Automations/GetAutomationsSubscription_example.json"
          }
        },
        "tags": ["Automations"],
        "description": "Get all security automations in a subscription.",
        "operationId": "Automations_List",
        "parameters": [{
            "$ref": "../../../common/v1/types.json#/parameters/ApiVersion"
          },
          {
            "$ref": "../../../common/v1/types.json#/parameters/SubscriptionId"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/AutomationList"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "../../../common/v1/types.json#/definitions/CloudError"
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/automations": {
      "get": {
        "x-ms-examples": {
          "Get security automations of a single resource group": {
            "$ref": "./examples/Automations/GetAutomationsResourceGroup_example.json"
          }
        },
        "tags": ["Automations"],
        "description": "Get all security automations in a resource group.",
        "operationId": "Automations_ListByResourceGroup",
        "parameters": [{
            "$ref": "../../../common/v1/types.json#/parameters/ApiVersion"
          },
          {
            "$ref": "../../../common/v1/types.json#/parameters/SubscriptionId"
          },
          {
            "$ref": "../../../common/v1/types.json#/parameters/ResourceGroupName"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/AutomationList"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "../../../common/v1/types.json#/definitions/CloudError"
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/automations/{automationName}": {
      "get": {
        "x-ms-examples": {
          "Get a single security automation details": {
            "$ref": "./examples/Automations/GetAutomationResourceGroup_example.json"
          }
        },
        "tags": ["Automations"],
        "description": "Get the details of a security automation.",
        "operationId": "Automations_Get",
        "parameters": [{
            "$ref": "../../../common/v1/types.json#/parameters/ApiVersion"
          },
          {
            "$ref": "../../../common/v1/types.json#/parameters/SubscriptionId"
          },
          {
            "$ref": "../../../common/v1/types.json#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/AutomationName"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/Automation"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "../../../common/v1/types.json#/definitions/CloudError"
            }
          }
        }
      },
      "put": {
        "x-ms-examples": {
          "Create or update a single security automation": {
            "$ref": "./examples/Automations/PutAutomation_example.json"
          }
        },
        "tags": ["Automations"],
        "description": "Create or update a security automation. If a security automation is already created and a subsequent create request is issued with different properties, the security automation properties will be updated.",
        "operationId": "Automations_CreateOrUpdate",
        "parameters": [{
            "$ref": "../../../common/v1/types.json#/parameters/ApiVersion"
          },
          {
            "$ref": "../../../common/v1/types.json#/parameters/SubscriptionId"
          },
          {
            "$ref": "../../../common/v1/types.json#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/AutomationName"
          },
          {
            "$ref": "#/parameters/AutomationInBody"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/Automation"
            }
          },
          "201": {
            "description": "Created",
            "schema": {
              "$ref": "#/definitions/Automation"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "../../../common/v1/types.json#/definitions/CloudError"
            }
          }
        }
      },
      "delete": {
        "x-ms-examples": {
          "Delete a single security automation": {
            "$ref": "./examples/Automations/DeleteAutomation_example.json"
          }
        },
        "tags": ["Automations"],
        "operationId": "Automations_Delete",
        "description": "Delete a security automation.",
        "parameters": [{
            "$ref": "../../../common/v1/types.json#/parameters/ApiVersion"
          },
          {
            "$ref": "../../../common/v1/types.json#/parameters/SubscriptionId"
          },
          {
            "$ref": "../../../common/v1/types.json#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/AutomationName"
          }
        ],
        "responses": {
          "204": {
            "description": "NoContent"
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "../../../common/v1/types.json#/definitions/CloudError"
            }
          }
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/automations/{automationName}/validate": {
      "post": {
        "x-ms-examples": {
          "Validate the security automation model before create or update": {
            "$ref": "./examples/Automations/ValidateAutomation_example.json"
          }
        },
        "tags": ["Automations"],
        "description": "Validate the security automation model before create or update. Any validation errors are returned to the client.",
        "operationId": "Automations_Validate",
        "parameters": [{
            "$ref": "../../../common/v1/types.json#/parameters/ApiVersion"
          },
          {
            "$ref": "../../../common/v1/types.json#/parameters/SubscriptionId"
          },
          {
            "$ref": "../../../common/v1/types.json#/parameters/ResourceGroupName"
          },
          {
            "$ref": "#/parameters/AutomationName"
          },
          {
            "$ref": "#/parameters/AutomationInBody"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/AutomationValidationStatus"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "../../../common/v1/types.json#/definitions/CloudError"
            }
          }
        }
      }
    }
  },
  "definitions": {
    "AutomationList": {
      "description": "List of security automations response.",
      "required": [ "value" ],
      "properties": {
        "value": {
          "type": "array",
          "description": "The list of security automations under the given scope.",
          "items": {
            "$ref": "#/definitions/Automation"
          }
        },
        "nextLink": {
          "readOnly": true,
          "type": "string",
          "description": "The URI to fetch the next page."
        }
      }
    },
    "Automation": {
      "type": "object",
      "description": "The security automation resource.",
      "properties": {
        "properties": {
          "x-ms-client-flatten": true,
          "description": "Security automation data",
          "$ref": "#/definitions/AutomationProperties"
        }
      },
      "allOf": [
        {
          "$ref": "../../../common/v1/types.json#/definitions/TrackedResource"
        }
      ]
    },
    "AutomationProperties": {
      "type": "object",
      "description": "The security automation data.",
      "properties": {
        "description": {
          "type": "string",
          "description": "The security automation description."
        },
        "isEnabled": {
          "type": "boolean",
          "description": "Indicates whether the security automation is enabled."
        },
        "metadata": {
          "type": "object",
          "description": "The metadata of the security automation resource.",
          "$ref": "#/definitions/AutomationMetadata"
        },
        "scopes": {
          "type": "array",
          "description": "A collection of the subscription's resources scopes on which the security automations logic is applied.",
          "items": {
            "$ref": "#/definitions/AutomationScope"
          }
        },
        "sources": {
          "type": "array",
          "description": "A collection of the source event types which evaluate the security automation set of rules.",
          "items": {
            "$ref": "#/definitions/AutomationSource"
          }
        },
        "actions": {
          "type": "array",
          "description": "A collection of the actions which are triggered if all the configured rule set evaluation is true.",
          "items": {
            "$ref": "#/definitions/AutomationAction"
          }
        }
      }
    },
    "AutomationMetadata": {
      "type": "object",
      "description": "The metadata of the security automation resource.",
      "properties": {
        "createdDateTimeUtc": {
          "readOnly": true,
          "type": "string",
          "format": "date-time",
          "description": "The security automation creation date."
        },
        "createdBy": {
          "readOnly": true,
          "type": "string",
          "description": "The AAD object ID of the entity that created the security automation."
        },
        "lastUpdatedDateTimeUtc": {
          "readOnly": true,
          "type": "string",
          "format": "date-time",
          "description": "The security automation last updated date."
        },
        "lastUpdatedBy": {
          "readOnly": true,
          "type": "string",
          "description": "The AAD object ID of the entity that last updated the security automation."
        }
      }
    },
    "AutomationSource": {
      "type": "object",
      "description": "The source event types which evaluate the security automation set of rules. For example - security alerts and security assessments.",
      "properties": {
        "eventSource": {
          "type": "string",
          "description": "A valid event source type."
        },
        "ruleSets": {
          "type": "array",
          "description": "A set of rules which evaluate upon event interception.",
          "items": {
            "$ref": "#/definitions/AutomationRuleSet"
          }
        }
      }
    },
    "AutomationScope": {
      "type": "object",
      "description": "The subscription's resources scope",
      "properties": {
        "description": {
          "type": "string",
          "description": "The resources scope description."
        },
        "scopePath": {
          "type": "string",
          "description": "The resources scope path."
        }
      }
    },
    "AutomationAction": {
      "type": "object",
      "description": "The action that should be triggered.",
      "discriminator": "actionType",
      "properties": {
        "actionType": {
          "type": "string",
          "description": "type of action that will be triggered by the Automation",
          "enum": [ "LogicApp", "EventHub", "SecurityEmail", "Workspace" ],
          "x-ms-enum": {
            "name": "ActionType",
            "modelAsString": true,
            "values": [
              {
                "value": "LogicApp"
              },
              {
                "value": "EventHub"
              },
              {
                "value": "SecurityEmail"
              },
              {
                "value": "Workspace"
              }
            ]
          }
        }
      }
    },
    "AutomationActionLogicApp": {
      "type": "object",
      "description": "The logic app action that should be triggered.",
      "x-ms-discriminator-value": "LogicApp",
      "allOf": [
        {
          "$ref": "#/definitions/AutomationAction"
        }
      ],
      "properties": {
        "logicAppResourceId": {
          "type": "string",
          "description": "The triggered resource id."
        },
        "uri": {
          "type": "string",
          "description": "The uri that should be triggered by an Http GET request.",
          "format": "uri"
        }
      }
    },
    "AutomationActionEventHub": {
      "type": "object",
      "description": "The event hub action that should be triggered.",
      "x-ms-discriminator-value": "EventHub",
      "allOf": [
        {
          "$ref": "#/definitions/AutomationAction"
        }
      ],
      "properties": {
        "eventHubResourceId": {
          "type": "string",
          "description": "The event hub resource id."
        },
        "connectionString": {
          "type": "string",
          "description": "The event hub connection string(the primary or secondary key)."
        }
      }
    },
    "AutomationActionSecurityEmail": {
      "type": "object",
      "description": "The Security Email action that should be triggered.",
      "x-ms-discriminator-value": "SecurityEmail",
      "allOf": [
        {
          "$ref": "#/definitions/AutomationAction"
        }
      ],
      "properties": {
        "subscriptionRbacRoles": {
          "type": "array",
          "description": "A list of allowed RBAC roles of the subscription for the email to be sent to.",
          "items": {
            "type": "string",
            "enum": [
              "AccountAdmin",
              "ServiceAdmin",
              "Owner",
              "Contributor"
            ],
            "x-ms-enum": {
              "name": "SubscriptionRbacRoles",
              "modelAsString": true,
              "values": [
                {
                  "value": "AccountAdmin"
                },
                {
                  "value": "ServiceAdmin"
                },
                {
                  "value": "Owner"
                },
                {
                  "value": "Contributor"
                }
              ]
            }
          }
        },
        "emailAddresses": {
          "type": "array",
          "description": "A list of email addresses that should receive the event data.",
          "items": {
            "type": "string",
            "format": "email"
          }
        }
      }
    },
    "AutomationActionWorkspace": {
      "type": "object",
      "description": "The log analytics workspace action that should be triggered.",
      "x-ms-discriminator-value": "Workspace",
      "allOf": [
        {
          "$ref": "#/definitions/AutomationAction"
        }
      ],
      "properties": {
        "workspaceResourceId": {
          "type": "string",
          "description": "The log analytics workspace resource id."
        },
        "workspaceId": {
          "type": "string",
          "description": "The log analytics id in a GUID format."
        }
      }
    },
    "AutomationRuleSet": {
      "type": "object",
      "description": "A rule set which evaluates all its rules upon an event interception.",
      "properties": {
        "rules": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/AutomationTriggeringRule"
          }
        }
      }
    },
    "AutomationTriggeringRule": {
      "type": "object",
      "description": "A logic rule which evaluates upon event interception. The rule is configured by comparing the specified expected value, in an expected property within the event model, by the specified operator.",
      "properties": {
        "propertyJPath": {
          "type": "string",
          "description": "The JPath of the entity model property that should be checked."
        },
        "propertyType": {
          "type": "string",
          "description": "The data type of the compared operands.",
          "enum": [
            "string",
            "integer",
            "number",
            "boolean"
          ],
          "x-ms-enum": {
            "name": "PropertyType",
            "modelAsString": true,
            "values": [
              {
                "value": "string"
              },
              {
                "value": "integer"
              },
              {
                "value": "number"
              },
              {
                "value": "boolean"
              }
            ]
          }
        },
        "expectedValue": {
          "type": "string",
          "description": "The expected value."
        },
        "operator": {
          "type": "string",
          "description": "A valid comparer operator to use.",
          "enum": [
            "Equals",
            "EqualsIgnoreCase",
            "GreaterThan",
            "GreaterThanOrEqualTo",
            "LesserThan",
            "LesserThanOrEqualTo",
            "NotEquals",
            "NotEqualsIgnoreCase",
            "Contains",
            "StartsWith",
            "EndsWith"
          ],
          "x-ms-enum": {
            "name": "Operator",
            "modelAsString": true,
            "values": [
              {
                "value": "Equals"
              },
              {
                "value": "EqualsIgnoreCase"
              },
              {
                "value": "GreaterThan"
              },
              {
                "value": "GreaterThanOrEqualTo"
              },
              {
                "value": "LesserThan"
              },
              {
                "value": "LesserThanOrEqualTo"
              },
              {
                "value": "NotEquals"
              },
              {
                "value": "NotEqualsIgnoreCase"
              },
              {
                "value": "Contains"
              },
              {
                "value": "StartsWith"
              },
              {
                "value": "EndsWith"
              }
            ]
          }
        }
      }
    },
    "AutomationValidationStatus": {
      "type": "object",
      "description": "The security automation model state property bag.",
      "properties": {
        "isValid": {
          "type": "boolean",
          "description": "Indicates whether the model is valid or not."
        },
        "message": {
          "type": "string",
          "description": "The validation message."
        }
      }
    }
  },
  "parameters": {
    "AutomationName": {
      "name": "automationName",
      "in": "path",
      "required": true,
      "type": "string",
      "description": "The security automation name.",
      "x-ms-parameter-location": "method"
    },
    "AutomationInBody": {
      "name": "Automation",
      "in": "body",
      "required": true,
      "description": "The security automation resource",
      "schema": {
        "$ref": "#/definitions/Automation"
      },
      "x-ms-parameter-location": "method"
    }
  }
}