Skip to content

Commit d7b7399

Browse files
yibirnbaArik RiklinariklinMeha Kaushikthramu
authored
Creating new API version for Alerts API (#17877)
* update readme * fix 3 * remove files * delete externalSecuritySolutions * add assessments.json * Fix validation errors 1 * merge * Fix validation errors 3 * Fix validation errors 5 * Fix validation errors 5 * Fix validation errors 5 * Fix validation errors 6 * Fix validation errors 7 * Fix validation errors 8 * fix validation errors 11 * fix validation errors 11 * ix validation errors 12 * Fix validation errors 15 * run prettier * test * SecuritySolution test * 2 * org * 1 * more changes * [Hub Generated] Review request for Microsoft.Consumption to add version stable/2021-10-01 (#16900) * Adding The new three properties to the latest API version for RI Transactions * Error Fixes * Fixing Type errors * Changing billingMonth format * Add new api (2022-01-01) version to alerts api * update files from origin main * get updates from origin main * update readme file * update readme * fix readme Co-authored-by: Arik Riklin <[email protected]> Co-authored-by: ariklin <[email protected]> Co-authored-by: Meha Kaushik <[email protected]> Co-authored-by: Theertharaj <[email protected]>
1 parent 03c410c commit d7b7399

17 files changed

+2594
-2
lines changed

‎specification/security/resource-manager/Microsoft.Security/stable/2022-01-01/alerts.json‎

Lines changed: 1250 additions & 0 deletions
Large diffs are not rendered by default.

‎specification/security/resource-manager/Microsoft.Security/stable/2022-01-01/examples/Alerts/GetAlertResourceGroupLocation_example.json‎

Lines changed: 154 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,154 @@
1+
{
2+
"parameters": {
3+
"api-version": "2022-01-01",
4+
"subscriptionId": "20ff7fc3-e762-44dd-bd96-b71116dcdc23",
5+
"resourceGroupName": "myRg1",
6+
"ascLocation": "westeurope",
7+
"alertName": "2518298467986649999_4d25bfef-2d77-4a08-adc0-3e35715cc92a"
8+
},
9+
"responses": {
10+
"200": {
11+
"body": {
12+
"id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/myRg1/providers/Microsoft.Security/locations/westeurope/alerts/2518770965529163669_F144EE95-A3E5-42DA-A279-967D115809AA",
13+
"name": "2518298467986649999_4d25bfef-2d77-4a08-adc0-3e35715cc92a",
14+
"type": "Microsoft.Security/Locations/alerts",
15+
"properties": {
16+
"version": "2022-01-01",
17+
"alertType": "VM_EICAR",
18+
"systemAlertId": "2518298467986649999_4d25bfef-2d77-4a08-adc0-3e35715cc92a",
19+
"productComponentName": "testName",
20+
"alertDisplayName": "Azure Security Center test alert (not a threat)",
21+
"description": "This is a test alert generated by Azure Security Center. No further action is needed.",
22+
"severity": "High",
23+
"intent": "Execution",
24+
"startTimeUtc": "2020-02-22T00:00:00.0000000Z",
25+
"endTimeUtc": "2020-02-22T00:00:00.0000000Z",
26+
"resourceIdentifiers": [
27+
{
28+
"azureResourceId": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/myRg1/providers/Microsoft.Compute/virtualMachines/vm1",
29+
"type": "AzureResource"
30+
},
31+
{
32+
"workspaceId": "f419f624-acad-4d89-b86d-f62fa387f019",
33+
"workspaceSubscriptionId": "20ff7fc3-e762-44dd-bd96-b71116dcdc23",
34+
"workspaceResourceGroup": "myRg1",
35+
"agentId": "75724a01-f021-4aa8-9ec2-329792373e6e",
36+
"type": "LogAnalytics"
37+
}
38+
],
39+
"remediationSteps": [
40+
"No further action is needed."
41+
],
42+
"vendorName": "Microsoft",
43+
"status": "Active",
44+
"extendedLinks": [
45+
{
46+
"Category": "threat_reports",
47+
"Label": "Report: RDP Brute Forcing",
48+
"Href": "https://contoso.com/reports/DisplayReport",
49+
"Type": "webLink"
50+
}
51+
],
52+
"alertUri": "https://portal.azure.com/#blade/Microsoft_Azure_Security/AlertBlade/alertId/2518298467986649999_4d25bfef-2d77-4a08-adc0-3e35715cc92a/subscriptionId/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroup/myRg1/referencedFrom/alertDeepLink/location/westeurope",
53+
"timeGeneratedUtc": "2020-02-23T13:47:58.0000000Z",
54+
"productName": "Azure Security Center",
55+
"processingEndTimeUtc": "2020-02-23T13:47:58.9205584Z",
56+
"entities": [
57+
{
58+
"address": "192.0.2.1",
59+
"location": {
60+
"countryCode": "gb",
61+
"state": "wokingham",
62+
"city": "sonning",
63+
"longitude": -0.909,
64+
"latitude": 51.468,
65+
"asn": 6584
66+
},
67+
"type": "ip"
68+
}
69+
],
70+
"isIncident": true,
71+
"correlationKey": "kso0LFWxzCll5tqrk5hmrBJ+MY1BX806W6q6+0s9Lk=",
72+
"extendedProperties": {
73+
"Property1": "Property1 information"
74+
},
75+
"compromisedEntity": "vm1",
76+
"techniques": [
77+
"T1059",
78+
"T1053",
79+
"T1072"
80+
],
81+
"subTechniques": [
82+
"T1059.001",
83+
"T1059.006",
84+
"T1053.002"
85+
],
86+
"supportingEvidence": {
87+
"supportingEvidenceList": [
88+
{
89+
"evidenceElements": [
90+
{
91+
"text": {
92+
"arguments": {
93+
"sensitiveEnumerationTypes": {
94+
"type": "string[]",
95+
"value": [
96+
"UseDesKey"
97+
]
98+
},
99+
"domainName": {
100+
"type": "string",
101+
"value": "domainName"
102+
}
103+
},
104+
"localizationKey": "AATP_ALERTS_LDAP_SENSITIVE_ATTRIBUTE_RECONNAISSANCE_SECURITY_ALERT_EVIDENCE_ENUMERATION_DETAIL_A7C00BD7",
105+
"fallback": "Actor enumerated UseDesKey on domain1.test.local"
106+
},
107+
"type": "evidenceElement",
108+
"innerElements": null
109+
}
110+
],
111+
"type": "nestedList"
112+
},
113+
{
114+
"type": "tabularEvidences",
115+
"title": "Investigate activity test",
116+
"columns": [
117+
"Date",
118+
"Activity",
119+
"User",
120+
"TestedText",
121+
"TestedValue"
122+
],
123+
"rows": [
124+
[
125+
"2022-01-17T07:03:52.034Z",
126+
"Log on",
127+
"testUser",
128+
"false",
129+
false
130+
],
131+
[
132+
"2022-01-17T07:03:52.034Z",
133+
"Log on",
134+
"testUser2",
135+
"false",
136+
false
137+
],
138+
[
139+
"2022-01-17T07:03:52.034Z",
140+
"Log on",
141+
"testUser3",
142+
"true",
143+
true
144+
]
145+
]
146+
}
147+
],
148+
"type": "supportingEvidenceList"
149+
}
150+
}
151+
}
152+
}
153+
}
154+
}

‎specification/security/resource-manager/Microsoft.Security/stable/2022-01-01/examples/Alerts/GetAlertSubscriptionLocation_example.json‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
{
2+
"parameters": {
3+
"api-version": "2022-01-01",
4+
"subscriptionId": "20ff7fc3-e762-44dd-bd96-b71116dcdc23",
5+
"ascLocation": "westeurope",
6+
"alertName": "2518770965529163669_F144EE95-A3E5-42DA-A279-967D115809AA"
7+
},
8+
"responses": {
9+
"200": {
10+
"body": {
11+
"id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/myRg1/providers/Microsoft.Security/locations/westeurope/alerts/2518770965529163669_F144EE95-A3E5-42DA-A279-967D115809AA",
12+
"name": "2518298467986649999_4d25bfef-2d77-4a08-adc0-3e35715cc92a",
13+
"type": "Microsoft.Security/Locations/alerts",
14+
"properties": {
15+
"version": "2022-01-01",
16+
"alertType": "VM_EICAR",
17+
"systemAlertId": "2518298467986649999_4d25bfef-2d77-4a08-adc0-3e35715cc92a",
18+
"productComponentName": "testName",
19+
"alertDisplayName": "Azure Security Center test alert (not a threat)",
20+
"description": "This is a test alert generated by Azure Security Center. No further action is needed.",
21+
"severity": "High",
22+
"intent": "Execution",
23+
"startTimeUtc": "2020-02-22T00:00:00.0000000Z",
24+
"endTimeUtc": "2020-02-22T00:00:00.0000000Z",
25+
"resourceIdentifiers": [
26+
{
27+
"azureResourceId": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/myRg1/providers/Microsoft.Compute/virtualMachines/vm1",
28+
"type": "AzureResource"
29+
},
30+
{
31+
"workspaceId": "f419f624-acad-4d89-b86d-f62fa387f019",
32+
"workspaceSubscriptionId": "20ff7fc3-e762-44dd-bd96-b71116dcdc23",
33+
"workspaceResourceGroup": "myRg1",
34+
"agentId": "75724a01-f021-4aa8-9ec2-329792373e6e",
35+
"type": "LogAnalytics"
36+
}
37+
],
38+
"remediationSteps": [
39+
"No further action is needed."
40+
],
41+
"vendorName": "Microsoft",
42+
"status": "Active",
43+
"extendedLinks": [
44+
{
45+
"Category": "threat_reports",
46+
"Label": "Report: RDP Brute Forcing",
47+
"Href": "https://contoso.com/reports/DisplayReport",
48+
"Type": "webLink"
49+
}
50+
],
51+
"alertUri": "https://portal.azure.com/#blade/Microsoft_Azure_Security/AlertBlade/alertId/2518298467986649999_4d25bfef-2d77-4a08-adc0-3e35715cc92a/subscriptionId/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroup/myRg1/referencedFrom/alertDeepLink/location/westeurope",
52+
"timeGeneratedUtc": "2020-02-23T13:47:58.0000000Z",
53+
"productName": "Azure Security Center",
54+
"processingEndTimeUtc": "2020-02-23T13:47:58.9205584Z",
55+
"entities": [
56+
{
57+
"address": "192.0.2.1",
58+
"location": {
59+
"countryCode": "gb",
60+
"state": "wokingham",
61+
"city": "sonning",
62+
"longitude": -0.909,
63+
"latitude": 51.468,
64+
"asn": 6584
65+
},
66+
"type": "ip"
67+
}
68+
],
69+
"isIncident": true,
70+
"correlationKey": "kso0LFWxzCll5tqrk5hmrBJ+MY1BX806W6q6+0s9Lk=",
71+
"extendedProperties": {
72+
"Property1": "Property1 information"
73+
},
74+
"compromisedEntity": "vm1",
75+
"techniques": [
76+
"T1059",
77+
"T1053",
78+
"T1072"
79+
],
80+
"subTechniques": [
81+
"T1059.001",
82+
"T1059.006",
83+
"T1053.002"
84+
],
85+
"supportingEvidence": {
86+
"type": "tabularEvidences",
87+
"title": "Investigate activity test",
88+
"columns": [
89+
"Date",
90+
"Activity",
91+
"User",
92+
"TestedText",
93+
"TestedValue"
94+
],
95+
"rows": [
96+
[
97+
"2022-01-17T07:03:52.034Z",
98+
"Log on",
99+
"testUser",
100+
"false",
101+
false
102+
],
103+
[
104+
"2022-01-17T07:03:52.034Z",
105+
"Log on",
106+
"testUser2",
107+
"false",
108+
false
109+
],
110+
[
111+
"2022-01-17T07:03:52.034Z",
112+
"Log on",
113+
"testUser3",
114+
"true",
115+
true
116+
]
117+
]
118+
}
119+
}
120+
}
121+
}
122+
}
123+
}

0 commit comments

Comments
 (0)