Skip to content

Commit ee2ca2f

Browse files
surashedsurashed
authored
Add SubAssessment event source type and edit automations PUT examples (#10454)
1 parent 86d915a commit ee2ca2f

File tree

4 files changed

+131
-12
lines changed

4 files changed

+131
-12
lines changed

‎specification/security/resource-manager/Microsoft.Security/preview/2019-01-01-preview/automations.json

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -158,8 +158,11 @@
158158
},
159159
"put": {
160160
"x-ms-examples": {
161-
"Create or update a security automation": {
162-
"$ref": "./examples/Automations/PutAutomation_example.json"
161+
"Create or update a security automation for all assessments": {
162+
"$ref": "./examples/Automations/PutAutomationAllAssessments_example.json"
163+
},
164+
"Create or update a security automation for all high severity assessments": {
165+
"$ref": "./examples/Automations/PutAutomationHighSeverityAssessments_example.json"
163166
},
164167
"Disable or enable a security automation": {
165168
"$ref": "./examples/Automations/PutDisableAutomation_example.json"
@@ -373,6 +376,7 @@
373376
"description": "A valid event source type.",
374377
"enum": [
375378
"Assessments",
379+
"SubAssessments",
376380
"Alerts"
377381
],
378382
"x-ms-enum": {
@@ -382,6 +386,9 @@
382386
{
383387
"value": "Assessments"
384388
},
389+
{
390+
"value": "SubAssessments"
391+
},
385392
{
386393
"value": "Alerts"
387394
}

‎specification/security/resource-manager/Microsoft.Security/preview/2019-01-01-preview/examples/Automations/PutAutomationAllAssessments_example.json

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
{
2+
"parameters": {
3+
"api-version": "2019-01-01-preview",
4+
"subscriptionId": "a5caac9c-5c04-49af-b3d0-e204f40345d5",
5+
"automationName": "exampleAutomation",
6+
"resourceGroupName": "exampleResourceGroup",
7+
"Automation": {
8+
"location": "Central US",
9+
"etag": "etag value (must be supplied for update)",
10+
"tags": {},
11+
"properties": {
12+
"description": "An example of a security automation that triggers one LogicApp resource (myTest1) on any security assessment",
13+
"isEnabled": true,
14+
"scopes": [
15+
{
16+
"description": "A description that helps to identify this scope - for example: security assessments that relate to the resource group myResourceGroup within the subscription a5caac9c-5c04-49af-b3d0-e204f40345d5",
17+
"scopePath": "/subscriptions/a5caac9c-5c04-49af-b3d0-e204f40345d5/resourceGroups/myResourceGroup"
18+
}
19+
],
20+
"sources": [
21+
{
22+
"eventSource": "Assessments",
23+
"ruleSets": []
24+
}
25+
],
26+
"actions": [
27+
{
28+
"logicAppResourceId": "/subscriptions/e54a4a18-5b94-4f90-9471-bd3decad8a2e/resourceGroups/sample/providers/Microsoft.Logic/workflows/MyTest1",
29+
"actionType": "LogicApp",
30+
"uri": "https://exampleTriggerUri1.com"
31+
}
32+
]
33+
}
34+
}
35+
},
36+
"responses": {
37+
"200": {
38+
"body": {
39+
"id": "/subscriptions/a5caac9c-5c04-49af-b3d0-e204f40345d5/resourceGroups/exampleResourceGroup/providers/Microsoft.Security/automations/exampleAutomation",
40+
"name": "exampleAutomation",
41+
"type": "Microsoft.Security/automations",
42+
"location": "Central US",
43+
"etag": "new etag value",
44+
"tags": {},
45+
"properties": {
46+
"description": "An example of a security automation that triggers one LogicApp resource (myTest1) on any security assessment",
47+
"isEnabled": true,
48+
"scopes": [
49+
{
50+
"description": "A description that helps to identify this scope - for example: security assessments that relate to the resource group myResourceGroup within the subscription a5caac9c-5c04-49af-b3d0-e204f40345d5",
51+
"scopePath": "/subscriptions/a5caac9c-5c04-49af-b3d0-e204f40345d5/resourceGroups/myResourceGroup"
52+
}
53+
],
54+
"sources": [
55+
{
56+
"eventSource": "Assessments",
57+
"ruleSets": []
58+
}
59+
],
60+
"actions": [
61+
{
62+
"logicAppResourceId": "/subscriptions/e54a4a18-5b94-4f90-9471-bd3decad8a2e/resourceGroups/sample/providers/Microsoft.Logic/workflows/MyTest1",
63+
"actionType": "LogicApp"
64+
}
65+
]
66+
}
67+
}
68+
},
69+
"201": {
70+
"body": {
71+
"id": "/subscriptions/a5caac9c-5c04-49af-b3d0-e204f40345d5/resourceGroups/exampleResourceGroup/providers/Microsoft.Security/SecurityAutomations/exampleAutomation",
72+
"name": "exampleAutomation",
73+
"type": "Microsoft.Security/SecurityAutomations",
74+
"location": "Central US",
75+
"etag": "new etag value",
76+
"tags": {},
77+
"properties": {
78+
"description": "An example of a security automation that triggers one LogicApp resource (myTest1) on any security assessment",
79+
"isEnabled": true,
80+
"scopes": [
81+
{
82+
"description": "A description that helps to identify this scope - for example: security assessments that relate to the resource group myResourceGroup within the subscription a5caac9c-5c04-49af-b3d0-e204f40345d5",
83+
"scopePath": "/subscriptions/a5caac9c-5c04-49af-b3d0-e204f40345d5/resourceGroups/myResourceGroup"
84+
}
85+
],
86+
"sources": [
87+
{
88+
"eventSource": "Assessments",
89+
"ruleSets": []
90+
}
91+
],
92+
"actions": [
93+
{
94+
"logicAppResourceId": "/subscriptions/e54a4a18-5b94-4f90-9471-bd3decad8a2e/resourceGroups/sample/providers/Microsoft.Logic/workflows/MyTest1",
95+
"actionType": "LogicApp"
96+
}
97+
]
98+
}
99+
}
100+
}
101+
}
102+
}

‎specification/security/resource-manager/Microsoft.Security/preview/2019-01-01-preview/examples/Automations/PutAutomation_example.json renamed to ‎specification/security/resource-manager/Microsoft.Security/preview/2019-01-01-preview/examples/Automations/PutAutomationHighSeverityAssessments_example.json

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
"etag": "etag value (must be supplied for update)",
1010
"tags": {},
1111
"properties": {
12-
"description": "An example of a security automation that triggers one LogicApp resource (myTest1) on any security assessment of type customAssessment",
12+
"description": "An example of a security automation that triggers one LogicApp resource (myTest1) on any high severity security assessment",
1313
"isEnabled": true,
1414
"scopes": [
1515
{
@@ -24,9 +24,9 @@
2424
{
2525
"rules": [
2626
{
27-
"propertyJPath": "$.Entity.AssessmentType",
27+
"propertyJPath": "properties.metadata.severity",
2828
"propertyType": "String",
29-
"expectedValue": "customAssessment",
29+
"expectedValue": "High",
3030
"operator": "Equals"
3131
}
3232
]
@@ -54,7 +54,7 @@
5454
"etag": "new etag value",
5555
"tags": {},
5656
"properties": {
57-
"description": "An example of a security automation that triggers one LogicApp resource (myTest1) on any security assessment of type customAssessment",
57+
"description": "An example of a security automation that triggers one LogicApp resource (myTest1) on any high severity security assessment",
5858
"isEnabled": true,
5959
"scopes": [
6060
{
@@ -69,9 +69,9 @@
6969
{
7070
"rules": [
7171
{
72-
"propertyJPath": "$.Entity.AssessmentType",
72+
"propertyJPath": "properties.metadata.severity",
7373
"propertyType": "String",
74-
"expectedValue": "customAssessment",
74+
"expectedValue": "High",
7575
"operator": "Equals"
7676
}
7777
]
@@ -97,7 +97,7 @@
9797
"etag": "new etag value",
9898
"tags": {},
9999
"properties": {
100-
"description": "An example of a security automation that triggers one LogicApp resource (myTest1) on any security assessment of type customAssessment",
100+
"description": "An example of a security automation that triggers one LogicApp resource (myTest1) on any high severity security assessment",
101101
"isEnabled": true,
102102
"scopes": [
103103
{
@@ -112,9 +112,9 @@
112112
{
113113
"rules": [
114114
{
115-
"propertyJPath": "$.Entity.AssessmentType",
115+
"propertyJPath": "properties.metadata.severity",
116116
"propertyType": "String",
117-
"expectedValue": "customAssessment",
117+
"expectedValue": "High",
118118
"operator": "Equals"
119119
}
120120
]

‎specification/security/resource-manager/common/v1/types.json

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@
6565
"$ref": "#/definitions/Resource"
6666
},
6767
{
68-
"$ref": "#/definitions/Location"
68+
"$ref": "#/definitions/TrackedResourceLocation"
6969
},
7070
{
7171
"$ref": "#/definitions/Kind"
@@ -122,6 +122,16 @@
122122
}
123123
}
124124
},
125+
"TrackedResourceLocation": {
126+
"type": "object",
127+
"description": "Describes an Azure resource with location",
128+
"properties": {
129+
"location": {
130+
"type": "string",
131+
"description": "Location where the resource is stored"
132+
}
133+
}
134+
},
125135
"AscLocationList": {
126136
"type": "object",
127137
"description": "List of locations where ASC saves your data",

0 commit comments

Comments
 (0)