Skip to content

Commit a9ace5a

Browse files
hunngu-mshunngu-ms
authored
Add a new data plane Upload API (#27639)
1 parent fbc90d6 commit a9ace5a

File tree

4 files changed

+736
-1
lines changed

4 files changed

+736
-1
lines changed

‎cSpell.json

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1264,6 +1264,13 @@
12641264
"realface",
12651265
"spoofface"
12661266
]
1267+
},
1268+
{
1269+
"filename": "**/specification/securityinsights/data-plane/Microsoft.SecurityInsights/**/*.json",
1270+
"words": [
1271+
"threatintelligencestixobjects",
1272+
"stixobjects"
1273+
]
12671274
}
12681275
],
12691276
"enableFiletypes": [

‎specification/securityinsights/data-plane/Microsoft.SecurityInsights/preview/2024-02-01-preview/ThreatIntelligence.json

Lines changed: 190 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,190 @@
1+
{
2+
"swagger": "2.0",
3+
"info": {
4+
"title": "Microsoft Sentinel Upload API",
5+
"description": "Specification for Microsoft Sentinel Upload API.",
6+
"version": "2024-02-01-preview"
7+
},
8+
"host": "api.ti.sentinel.azure.com",
9+
"schemes": [
10+
"https"
11+
],
12+
"paths": {
13+
"/workspaces/{workspaceId}/threat-intelligence-stix-objects:upload": {
14+
"post": {
15+
"x-ms-examples": {
16+
"Upload Stix Objects": {
17+
"$ref": "./examples/threatintelligence/UploadStixObjects.json"
18+
}
19+
},
20+
"summary": "Upload Structured Threat Information Expression (STIX) objects to the workspace",
21+
"description": "Upload an array of Structured Threat Information Expression (STIX) objects to the workspace specified",
22+
"operationId": "ThreatIntelligenceStixObjects_Upload",
23+
"consumes": [
24+
"application/json"
25+
],
26+
"produces": [
27+
"application/json"
28+
],
29+
"parameters": [
30+
{
31+
"$ref": "#/parameters/ApiVersionParameter"
32+
},
33+
{
34+
"in": "path",
35+
"name": "workspaceId",
36+
"description": "The workspace ID for the STIX objects to be uploaded.",
37+
"required": true,
38+
"type": "string",
39+
"format": "uuid",
40+
"maxLength": 36,
41+
"pattern": "^[{]?[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}[}]?$"
42+
},
43+
{
44+
"in": "body",
45+
"name": "body",
46+
"description": "Body of the request with an array of STIX objects and other properties",
47+
"required": true,
48+
"schema": {
49+
"$ref": "#/definitions/UploadStixObjectsRequest"
50+
}
51+
}
52+
],
53+
"responses": {
54+
"200": {
55+
"description": "The API returns 200 when at least one STIX object is successfully validated and published.",
56+
"schema": {
57+
"$ref": "#/definitions/UploadStixObjectsResponse"
58+
}
59+
},
60+
"default": {
61+
"description": "Upload STIX Objects API service error response.",
62+
"headers": {
63+
"x-ms-error-code": {
64+
"type": "string",
65+
"description": "Error code for specific error that occurred."
66+
}
67+
},
68+
"schema": {
69+
"$ref": "#/definitions/ErrorResponseBody"
70+
},
71+
"x-ms-error-response": true
72+
}
73+
},
74+
"security": [
75+
{
76+
"azure_auth": [
77+
"user_impersonation"
78+
]
79+
}
80+
]
81+
}
82+
}
83+
},
84+
"definitions": {
85+
"JsonPropertyBag": {
86+
"description": "This is a STIX object. STIX objects need to be in STIX format. We only support STIX 2.0 and 2.1 format.",
87+
"type": "object",
88+
"additionalProperties": {}
89+
},
90+
"UploadStixObjectsRequest": {
91+
"description": "Schema for request body.",
92+
"type": "object",
93+
"properties": {
94+
"sourcesystem": {
95+
"description": "Source of the STIX objects to be uploaded. Source system name cannot be Microsoft Sentinel. Maximum length is 256 characters.",
96+
"type": "string"
97+
},
98+
"stixobjects": {
99+
"description": "The stixobjects param is an array of STIX objects. STIX objects need to be in STIX format. We only support STIX 2.0 and 2.1 format.",
100+
"type": "array",
101+
"items": {
102+
"$ref": "#/definitions/JsonPropertyBag"
103+
}
104+
}
105+
}
106+
},
107+
"UploadStixObjectsResponse": {
108+
"description": "Response object containing more details about the operation.",
109+
"type": "object",
110+
"properties": {
111+
"errors": {
112+
"description": "Details of the error. Contains a list of STIX objects validation errors",
113+
"type": "array",
114+
"items": {
115+
"$ref": "#/definitions/StixObjectsValidationError"
116+
}
117+
}
118+
}
119+
},
120+
"StixObjectsValidationError": {
121+
"description": "Object that stores a list of errors encountered when executing the Upload operation.",
122+
"type": "object",
123+
"properties": {
124+
"recordIndex": {
125+
"format": "int64",
126+
"description": "Index of the STIX objects in stixobjects array from request.",
127+
"type": "integer"
128+
},
129+
"validationErrorMessages": {
130+
"description": "List of validation errors for a single STIX object.",
131+
"type": "array",
132+
"items": {
133+
"type": "string"
134+
}
135+
}
136+
}
137+
},
138+
"ErrorResponseBody": {
139+
"description": "The definition of an error object.",
140+
"required": [
141+
"error"
142+
],
143+
"type": "object",
144+
"properties": {
145+
"error": {
146+
"$ref": "#/definitions/ErrorData"
147+
}
148+
}
149+
},
150+
"ErrorData": {
151+
"description": "Detailed information about the errors from the operation.",
152+
"type": "object",
153+
"required": [
154+
"code",
155+
"message"
156+
],
157+
"properties": {
158+
"code": {
159+
"description": "Server defined code for the error",
160+
"type": "string"
161+
},
162+
"message": {
163+
"description": "Error message",
164+
"type": "string"
165+
}
166+
}
167+
}
168+
},
169+
"parameters": {
170+
"ApiVersionParameter": {
171+
"in": "query",
172+
"name": "api-version",
173+
"description": "The api-version for operation",
174+
"required": true,
175+
"type": "string",
176+
"x-ms-parameter-location": "method"
177+
}
178+
},
179+
"securityDefinitions": {
180+
"azure_auth": {
181+
"type": "oauth2",
182+
"flow": "implicit",
183+
"authorizationUrl": "https://login.microsoftonline.com/common/oauth2/authorize",
184+
"scopes": {
185+
"user_impersonation": "impersonate your user account"
186+
},
187+
"description": "Azure Active Directory OAuth2 Flow"
188+
}
189+
}
190+
}

0 commit comments

Comments
 (0)