diff --git a/src/securityinsight/azext_sentinel/generated/_client_factory.py b/src/securityinsight/azext_sentinel/generated/_client_factory.py index f14bb112f38..4143b95ccfd 100644 --- a/src/securityinsight/azext_sentinel/generated/_client_factory.py +++ b/src/securityinsight/azext_sentinel/generated/_client_factory.py @@ -23,5 +23,21 @@ def cf_action(cli_ctx, *_): return cf_sentinel(cli_ctx).action +def cf_alert_rule_template(cli_ctx, *_): + return cf_sentinel(cli_ctx).alert_rule_template + + +def cf_bookmark(cli_ctx, *_): + return cf_sentinel(cli_ctx).bookmark + + def cf_data_connector(cli_ctx, *_): return cf_sentinel(cli_ctx).data_connector + + +def cf_incident(cli_ctx, *_): + return cf_sentinel(cli_ctx).incident + + +def cf_incident_comment(cli_ctx, *_): + return cf_sentinel(cli_ctx).incident_comment diff --git a/src/securityinsight/azext_sentinel/generated/_help.py b/src/securityinsight/azext_sentinel/generated/_help.py index 13b0bc18dd8..022b99073b2 100644 --- a/src/securityinsight/azext_sentinel/generated/_help.py +++ b/src/securityinsight/azext_sentinel/generated/_help.py @@ -75,6 +75,92 @@ pace-name "myWorkspace" """ +helps['sentinel alert-rule-template'] = """ + type: group + short-summary: sentinel alert-rule-template +""" + +helps['sentinel alert-rule-template list'] = """ + type: command + short-summary: Gets all alert rule templates. + examples: + - name: Get all alert rule templates. + text: |- + az sentinel alert-rule-template list --resource-group "myRg" --workspace-name "myWorkspace" +""" + +helps['sentinel alert-rule-template show'] = """ + type: command + short-summary: Gets the alert rule template. + examples: + - name: Get alert rule template by Id. + text: |- + az sentinel alert-rule-template show --alert-rule-template-id "65360bb0-8986-4ade-a89d-af3cf44d28aa" --r\ +esource-group "myRg" --workspace-name "myWorkspace" +""" + +helps['sentinel bookmark'] = """ + type: group + short-summary: sentinel bookmark +""" + +helps['sentinel bookmark list'] = """ + type: command + short-summary: Gets all bookmarks. + examples: + - name: Get all bookmarks. + text: |- + az sentinel bookmark list --resource-group "myRg" --workspace-name "myWorkspace" +""" + +helps['sentinel bookmark show'] = """ + type: command + short-summary: Gets a bookmark. + examples: + - name: Get a bookmark. + text: |- + az sentinel bookmark show --bookmark-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" --resource-group "myRg" -\ +-workspace-name "myWorkspace" +""" + +helps['sentinel bookmark create'] = """ + type: command + short-summary: Creates or updates the bookmark. + examples: + - name: Creates or updates a bookmark. + text: |- + az sentinel bookmark create --etag "\\"0300bf09-0000-0000-0000-5c37296e0000\\"" --created "2019-01-01T13\ +:15:30Z" --created-by name="john doe" email="john@contoso.com" object-id="2046feea-040d-4a46-9e2b-91c2941bfa70" --displ\ +ay-name "My bookmark" --labels "[\\"Tag1\\",\\"Tag2\\"]" --notes "Found a suspicious activity" --query "SecurityEvent |\ + where TimeGenerated > ago(1d) and TimeGenerated < ago(2d)" --query-result "Security Event query result" --updated "201\ +9-01-01T13:15:30Z" --updated-by name="john doe" email="john@contoso.com" object-id="2046feea-040d-4a46-9e2b-91c2941bfa7\ +0" --bookmark-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" --resource-group "myRg" --workspace-name "myWorkspace" +""" + +helps['sentinel bookmark update'] = """ + type: command + short-summary: Creates or updates the bookmark. + examples: + - name: Creates or updates a bookmark. + text: |- + az sentinel bookmark update --etag "\\"0300bf09-0000-0000-0000-5c37296e0000\\"" --created "2019-01-01T13\ +:15:30Z" --created-by name="john doe" email="john@contoso.com" object-id="2046feea-040d-4a46-9e2b-91c2941bfa70" --displ\ +ay-name "My bookmark" --labels "[\\"Tag1\\",\\"Tag2\\"]" --notes "Found a suspicious activity" --query "SecurityEvent |\ + where TimeGenerated > ago(1d) and TimeGenerated < ago(2d)" --query-result "Security Event query result" --updated "201\ +9-01-01T13:15:30Z" --updated-by name="john doe" email="john@contoso.com" object-id="2046feea-040d-4a46-9e2b-91c2941bfa7\ +0" --bookmark-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" --resource-group "myRg" --workspace-name "myWorkspace" +""" + +helps['sentinel bookmark delete'] = """ + type: command + short-summary: Delete the bookmark. + examples: + - name: Delete a bookmark. + text: |- + az sentinel bookmark delete --bookmark-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" --resource-group "myRg"\ + --workspace-name "myWorkspace" +""" + helps['sentinel data-connector'] = """ type: group short-summary: sentinel data-connector @@ -156,3 +242,100 @@ az sentinel data-connector delete --data-connector-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" --resource-\ group "myRg" --workspace-name "myWorkspace" """ + +helps['sentinel incident'] = """ + type: group + short-summary: sentinel incident +""" + +helps['sentinel incident list'] = """ + type: command + short-summary: Gets all incidents. + examples: + - name: Get all incidents. + text: |- + az sentinel incident list --orderby "properties/createdTimeUtc desc" --top 1 --resource-group "myRg" --w\ +orkspace-name "myWorkspace" +""" + +helps['sentinel incident show'] = """ + type: command + short-summary: Gets an incident. + examples: + - name: Get an incident. + text: |- + az sentinel incident show --incident-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" --resource-group "myRg" -\ +-workspace-name "myWorkspace" +""" + +helps['sentinel incident create'] = """ + type: command + short-summary: Creates or updates the incident. + examples: + - name: Creates or updates an incident. + text: |- + az sentinel incident create --etag "\\"0300bf09-0000-0000-0000-5c37296e0000\\"" --description "This is a\ + demo incident" --classification "FalsePositive" --classification-comment "Not a malicious activity" --classification-r\ +eason "IncorrectAlertLogic" --first-activity-time-utc "2019-01-01T13:00:30Z" --last-activity-time-utc "2019-01-01T13:05\ +:30Z" --owner object-id="2046feea-040d-4a46-9e2b-91c2941bfa70" --severity "High" --status "Closed" --title "My incident\ +" --incident-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" --resource-group "myRg" --workspace-name "myWorkspace" +""" + +helps['sentinel incident update'] = """ + type: command + short-summary: Creates or updates the incident. + examples: + - name: Creates or updates an incident. + text: |- + az sentinel incident update --etag "\\"0300bf09-0000-0000-0000-5c37296e0000\\"" --description "This is a\ + demo incident" --classification "FalsePositive" --classification-comment "Not a malicious activity" --classification-r\ +eason "IncorrectAlertLogic" --first-activity-time-utc "2019-01-01T13:00:30Z" --last-activity-time-utc "2019-01-01T13:05\ +:30Z" --owner object-id="2046feea-040d-4a46-9e2b-91c2941bfa70" --severity "High" --status "Closed" --title "My incident\ +" --incident-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" --resource-group "myRg" --workspace-name "myWorkspace" +""" + +helps['sentinel incident delete'] = """ + type: command + short-summary: Delete the incident. + examples: + - name: Delete an incident. + text: |- + az sentinel incident delete --incident-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" --resource-group "myRg"\ + --workspace-name "myWorkspace" +""" + +helps['sentinel incident-comment'] = """ + type: group + short-summary: sentinel incident-comment +""" + +helps['sentinel incident-comment list'] = """ + type: command + short-summary: Gets all incident comments. + examples: + - name: Get all incident comments. + text: |- + az sentinel incident-comment list --incident-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" --resource-group \ +"myRg" --workspace-name "myWorkspace" +""" + +helps['sentinel incident-comment show'] = """ + type: command + short-summary: Gets an incident comment. + examples: + - name: Get an incident comment. + text: |- + az sentinel incident-comment show --incident-comment-id "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014" --inciden\ +t-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" --resource-group "myRg" --workspace-name "myWorkspace" +""" + +helps['sentinel incident-comment create'] = """ + type: command + short-summary: Creates the incident comment. + examples: + - name: Creates an incident comment. + text: |- + az sentinel incident-comment create --message "Some message" --incident-comment-id "4bb36b7b-26ff-4d1c-9\ +cbe-0d8ab3da0014" --incident-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" --resource-group "myRg" --workspace-name "myWork\ +space" +""" diff --git a/src/securityinsight/azext_sentinel/generated/_params.py b/src/securityinsight/azext_sentinel/generated/_params.py index 3bd140af725..1a8f541bc44 100644 --- a/src/securityinsight/azext_sentinel/generated/_params.py +++ b/src/securityinsight/azext_sentinel/generated/_params.py @@ -15,6 +15,12 @@ get_enum_type, resource_group_name_type ) +from azext_sentinel.action import ( + AddCreatedBy, + AddIncidentInfo, + AddLabels, + AddOwner +) def load_arguments(self, _): @@ -35,8 +41,8 @@ def load_arguments(self, _): c.argument('rule_id', help='Alert rule ID') c.argument('action_id', help='Action ID') c.argument('etag', help='Etag of the azure resource') - c.argument('logic_app_resource_id', help='Logic App Resource Id, providers/Microsoft.Logic/workflows/{WorkflowI' - 'D}.') + c.argument('logic_app_resource_id', help='Logic App Resource Id, /subscriptions/{my-subscription}/resourceGroup' + 's/{my-resource-group}/providers/Microsoft.Logic/workflows/{my-workflow-id}.') c.argument('trigger_uri', help='Logic App Callback URL for this specific workflow.') c.argument('kind', arg_type=get_enum_type(['Scheduled', 'MicrosoftSecurityIncidentCreation', 'Fusion']), help= 'The kind of the alert rule') @@ -52,6 +58,71 @@ def load_arguments(self, _): c.argument('workspace_name', help='The name of the workspace.') c.argument('rule_id', help='Alert rule ID') + with self.argument_context('sentinel alert-rule-template list') as c: + c.argument('resource_group_name', resource_group_name_type) + c.argument('workspace_name', help='The name of the workspace.') + + with self.argument_context('sentinel alert-rule-template show') as c: + c.argument('resource_group_name', resource_group_name_type) + c.argument('workspace_name', help='The name of the workspace.') + c.argument('alert_rule_template_id', help='Alert rule template ID') + + with self.argument_context('sentinel bookmark list') as c: + c.argument('resource_group_name', resource_group_name_type) + c.argument('workspace_name', help='The name of the workspace.') + + with self.argument_context('sentinel bookmark show') as c: + c.argument('resource_group_name', resource_group_name_type) + c.argument('workspace_name', help='The name of the workspace.') + c.argument('bookmark_id', help='Bookmark ID') + + with self.argument_context('sentinel bookmark create') as c: + c.argument('resource_group_name', resource_group_name_type) + c.argument('workspace_name', help='The name of the workspace.') + c.argument('bookmark_id', help='Bookmark ID') + c.argument('etag', help='Etag of the azure resource') + c.argument('created', help='The time the bookmark was created') + c.argument('created_by', action=AddCreatedBy, nargs='+', help='Describes a user that created the bookmark Expec' + 't value: object-id=xx.') + c.argument('display_name', help='The display name of the bookmark') + c.argument('labels', nargs='+', help='List of labels relevant to this bookmark Expected value: json-string/@jso' + 'n-file.') + c.argument('notes', help='The notes of the bookmark') + c.argument('query', help='The query of the bookmark.') + c.argument('query_result', help='The query result of the bookmark.') + c.argument('updated', help='The last time the bookmark was updated') + c.argument('updated_by', action=AddCreatedBy, nargs='+', help='Describes a user that updated the bookmark Expec' + 't value: object-id=xx.') + c.argument('incident_info', action=AddIncidentInfo, nargs='+', help='Describes an incident that relates to book' + 'mark Expect value: KEY1=VALUE1 KEY2=VALUE2 ... , available KEYs are: incident-id, severity, title, ' + 'relation-name.') + + with self.argument_context('sentinel bookmark update') as c: + c.argument('resource_group_name', resource_group_name_type) + c.argument('workspace_name', help='The name of the workspace.') + c.argument('bookmark_id', help='Bookmark ID') + c.argument('etag', help='Etag of the azure resource') + c.argument('created', help='The time the bookmark was created') + c.argument('created_by', action=AddCreatedBy, nargs='+', help='Describes a user that created the bookmark Expec' + 't value: object-id=xx.') + c.argument('display_name', help='The display name of the bookmark') + c.argument('labels', nargs='+', help='List of labels relevant to this bookmark Expected value: json-string/@jso' + 'n-file.') + c.argument('notes', help='The notes of the bookmark') + c.argument('query', help='The query of the bookmark.') + c.argument('query_result', help='The query result of the bookmark.') + c.argument('updated', help='The last time the bookmark was updated') + c.argument('updated_by', action=AddCreatedBy, nargs='+', help='Describes a user that updated the bookmark Expec' + 't value: object-id=xx.') + c.argument('incident_info', action=AddIncidentInfo, nargs='+', help='Describes an incident that relates to book' + 'mark Expect value: KEY1=VALUE1 KEY2=VALUE2 ... , available KEYs are: incident-id, severity, title, ' + 'relation-name.') + + with self.argument_context('sentinel bookmark delete') as c: + c.argument('resource_group_name', resource_group_name_type) + c.argument('workspace_name', help='The name of the workspace.') + c.argument('bookmark_id', help='Bookmark ID') + with self.argument_context('sentinel data-connector list') as c: c.argument('resource_group_name', resource_group_name_type) c.argument('workspace_name', help='The name of the workspace.') @@ -83,3 +154,95 @@ def load_arguments(self, _): c.argument('resource_group_name', resource_group_name_type) c.argument('workspace_name', help='The name of the workspace.') c.argument('data_connector_id', help='Connector ID') + + with self.argument_context('sentinel incident list') as c: + c.argument('resource_group_name', resource_group_name_type) + c.argument('workspace_name', help='The name of the workspace.') + c.argument('filter', help='Filters the results, based on a Boolean condition. Optional.') + c.argument('orderby', help='Sorts the results. Optional.') + c.argument('top', help='Returns only the first n results. Optional.') + c.argument('skip_token', help='Skiptoken is only used if a previous operation returned a partial result. If a p' + 'revious response contains a nextLink element, the value of the nextLink element will include a skip' + 'token parameter that specifies a starting point to use for subsequent calls. Optional.') + + with self.argument_context('sentinel incident show') as c: + c.argument('resource_group_name', resource_group_name_type) + c.argument('workspace_name', help='The name of the workspace.') + c.argument('incident_id', help='Incident ID') + + with self.argument_context('sentinel incident create') as c: + c.argument('resource_group_name', resource_group_name_type) + c.argument('workspace_name', help='The name of the workspace.') + c.argument('incident_id', help='Incident ID') + c.argument('etag', help='Etag of the azure resource') + c.argument('classification', arg_type=get_enum_type(['Undetermined', 'TruePositive', 'BenignPositive', 'FalsePo' + 'sitive']), help='The reason the incident was closed') + c.argument('classification_comment', help='Describes the reason the incident was closed') + c.argument('classification_reason', arg_type=get_enum_type(['SuspiciousActivity', 'SuspiciousButExpected', 'Inc' + 'orrectAlertLogic', 'InaccurateData']), help='The classification reason the incident was closed with' + '') + c.argument('description', help='The description of the incident') + c.argument('first_activity_time_utc', help='The time of the first activity in the incident') + c.argument('labels', action=AddLabels, nargs='+', help='List of labels relevant to this incident Expect value: ' + 'label-name=xx.') + c.argument('last_activity_time_utc', help='The time of the last activity in the incident') + c.argument('owner', action=AddOwner, nargs='+', help='Describes a user that the incident is assigned to Expect ' + 'value: KEY1=VALUE1 KEY2=VALUE2 ... , available KEYs are: email, assigned-to, object-id, user-princi' + 'pal-name.') + c.argument('severity', arg_type=get_enum_type(['High', 'Medium', 'Low', 'Informational']), help='The severity o' + 'f the incident') + c.argument('status', arg_type=get_enum_type(['New', 'Active', 'Closed']), help='The status of the incident') + c.argument('title', help='The title of the incident') + + with self.argument_context('sentinel incident update') as c: + c.argument('resource_group_name', resource_group_name_type) + c.argument('workspace_name', help='The name of the workspace.') + c.argument('incident_id', help='Incident ID') + c.argument('etag', help='Etag of the azure resource') + c.argument('classification', arg_type=get_enum_type(['Undetermined', 'TruePositive', 'BenignPositive', 'FalsePo' + 'sitive']), help='The reason the incident was closed') + c.argument('classification_comment', help='Describes the reason the incident was closed') + c.argument('classification_reason', arg_type=get_enum_type(['SuspiciousActivity', 'SuspiciousButExpected', 'Inc' + 'orrectAlertLogic', 'InaccurateData']), help='The classification reason the incident was closed with' + '') + c.argument('description', help='The description of the incident') + c.argument('first_activity_time_utc', help='The time of the first activity in the incident') + c.argument('labels', action=AddLabels, nargs='+', help='List of labels relevant to this incident Expect value: ' + 'label-name=xx.') + c.argument('last_activity_time_utc', help='The time of the last activity in the incident') + c.argument('owner', action=AddOwner, nargs='+', help='Describes a user that the incident is assigned to Expect ' + 'value: KEY1=VALUE1 KEY2=VALUE2 ... , available KEYs are: email, assigned-to, object-id, user-princi' + 'pal-name.') + c.argument('severity', arg_type=get_enum_type(['High', 'Medium', 'Low', 'Informational']), help='The severity o' + 'f the incident') + c.argument('status', arg_type=get_enum_type(['New', 'Active', 'Closed']), help='The status of the incident') + c.argument('title', help='The title of the incident') + + with self.argument_context('sentinel incident delete') as c: + c.argument('resource_group_name', resource_group_name_type) + c.argument('workspace_name', help='The name of the workspace.') + c.argument('incident_id', help='Incident ID') + + with self.argument_context('sentinel incident-comment list') as c: + c.argument('resource_group_name', resource_group_name_type) + c.argument('workspace_name', help='The name of the workspace.') + c.argument('incident_id', help='Incident ID') + c.argument('filter', help='Filters the results, based on a Boolean condition. Optional.') + c.argument('orderby', help='Sorts the results. Optional.') + c.argument('top', help='Returns only the first n results. Optional.') + c.argument('skip_token', help='Skiptoken is only used if a previous operation returned a partial result. If a p' + 'revious response contains a nextLink element, the value of the nextLink element will include a skip' + 'token parameter that specifies a starting point to use for subsequent calls. Optional.') + + with self.argument_context('sentinel incident-comment show') as c: + c.argument('resource_group_name', resource_group_name_type) + c.argument('workspace_name', help='The name of the workspace.') + c.argument('incident_id', help='Incident ID') + c.argument('incident_comment_id', help='Incident comment ID') + + with self.argument_context('sentinel incident-comment create') as c: + c.argument('resource_group_name', resource_group_name_type) + c.argument('workspace_name', help='The name of the workspace.') + c.argument('incident_id', help='Incident ID') + c.argument('incident_comment_id', help='Incident comment ID') + c.argument('message', help='The comment message') diff --git a/src/securityinsight/azext_sentinel/generated/action.py b/src/securityinsight/azext_sentinel/generated/action.py index 01ed94902ce..d3b5093fd50 100644 --- a/src/securityinsight/azext_sentinel/generated/action.py +++ b/src/securityinsight/azext_sentinel/generated/action.py @@ -12,3 +12,107 @@ import argparse from knack.util import CLIError from collections import defaultdict + + +class AddCreatedBy(argparse.Action): + def __call__(self, parser, namespace, values, option_string=None): + action = self.get_action(values, option_string) + namespace.created_by = action + + + def get_action(self, values, option_string): # pylint: disable=no-self-use + try: + properties = defaultdict(list) + for (k, v) in (x.split('=', 1) for x in values): + properties[k].append(v) + properties = dict(properties) + except ValueError: + raise CLIError('usage error: {} [KEY=VALUE ...]'.format(option_string)) + d = {} + for k in properties: + kl = k.lower() + v = properties[k] + if kl == 'object-id': + d['object_id'] = v[0] + return d + + +class AddIncidentInfo(argparse.Action): + def __call__(self, parser, namespace, values, option_string=None): + action = self.get_action(values, option_string) + namespace.incident_info = action + + + def get_action(self, values, option_string): # pylint: disable=no-self-use + try: + properties = defaultdict(list) + for (k, v) in (x.split('=', 1) for x in values): + properties[k].append(v) + properties = dict(properties) + except ValueError: + raise CLIError('usage error: {} [KEY=VALUE ...]'.format(option_string)) + d = {} + for k in properties: + kl = k.lower() + v = properties[k] + if kl == 'incident-id': + d['incident_id'] = v[0] + elif kl == 'severity': + d['severity'] = v[0] + elif kl == 'title': + d['title'] = v[0] + elif kl == 'relation-name': + d['relation_name'] = v[0] + return d + + +class AddLabels(argparse._AppendAction): + def __call__(self, parser, namespace, values, option_string=None): + action = self.get_action(values, option_string) + super(AddLabels, self).__call__(parser, namespace, action, option_string) + + + def get_action(self, values, option_string): # pylint: disable=no-self-use + try: + properties = defaultdict(list) + for (k, v) in (x.split('=', 1) for x in values): + properties[k].append(v) + properties = dict(properties) + except ValueError: + raise CLIError('usage error: {} [KEY=VALUE ...]'.format(option_string)) + d = {} + for k in properties: + kl = k.lower() + v = properties[k] + if kl == 'label-name': + d['label_name'] = v[0] + return d + + +class AddOwner(argparse.Action): + def __call__(self, parser, namespace, values, option_string=None): + action = self.get_action(values, option_string) + namespace.owner = action + + + def get_action(self, values, option_string): # pylint: disable=no-self-use + try: + properties = defaultdict(list) + for (k, v) in (x.split('=', 1) for x in values): + properties[k].append(v) + properties = dict(properties) + except ValueError: + raise CLIError('usage error: {} [KEY=VALUE ...]'.format(option_string)) + d = {} + for k in properties: + kl = k.lower() + v = properties[k] + if kl == 'email': + d['email'] = v[0] + elif kl == 'assigned-to': + d['assigned_to'] = v[0] + elif kl == 'object-id': + d['object_id'] = v[0] + elif kl == 'user-principal-name': + d['user_principal_name'] = v[0] + return d diff --git a/src/securityinsight/azext_sentinel/generated/commands.py b/src/securityinsight/azext_sentinel/generated/commands.py index d859e4c8265..47be52dd213 100644 --- a/src/securityinsight/azext_sentinel/generated/commands.py +++ b/src/securityinsight/azext_sentinel/generated/commands.py @@ -33,6 +33,29 @@ def load_command_table(self, _): with self.command_group('sentinel action', sentinel_action, client_factory=cf_action, is_experimental=True) as g: g.custom_command('list', 'sentinel_action_list') + from azext_sentinel.generated._client_factory import cf_alert_rule_template + sentinel_alert_rule_template = CliCommandType( + operations_tmpl='azext_sentinel.vendored_sdks.securityinsight.operations._alert_rule_template_operations#AlertR' + 'uleTemplateOperations.{}', + client_factory=cf_alert_rule_template) + with self.command_group('sentinel alert-rule-template', sentinel_alert_rule_template, + client_factory=cf_alert_rule_template, is_experimental=True) as g: + g.custom_command('list', 'sentinel_alert_rule_template_list') + g.custom_show_command('show', 'sentinel_alert_rule_template_show') + + from azext_sentinel.generated._client_factory import cf_bookmark + sentinel_bookmark = CliCommandType( + operations_tmpl='azext_sentinel.vendored_sdks.securityinsight.operations._bookmark_operations#BookmarkOperation' + 's.{}', + client_factory=cf_bookmark) + with self.command_group('sentinel bookmark', sentinel_bookmark, client_factory=cf_bookmark, + is_experimental=True) as g: + g.custom_command('list', 'sentinel_bookmark_list') + g.custom_show_command('show', 'sentinel_bookmark_show') + g.custom_command('create', 'sentinel_bookmark_create') + g.custom_command('update', 'sentinel_bookmark_update') + g.custom_command('delete', 'sentinel_bookmark_delete') + from azext_sentinel.generated._client_factory import cf_data_connector sentinel_data_connector = CliCommandType( operations_tmpl='azext_sentinel.vendored_sdks.securityinsight.operations._data_connector_operations#DataConnect' @@ -45,3 +68,27 @@ def load_command_table(self, _): g.custom_command('create', 'sentinel_data_connector_create') g.custom_command('update', 'sentinel_data_connector_update') g.custom_command('delete', 'sentinel_data_connector_delete') + + from azext_sentinel.generated._client_factory import cf_incident + sentinel_incident = CliCommandType( + operations_tmpl='azext_sentinel.vendored_sdks.securityinsight.operations._incident_operations#IncidentOperation' + 's.{}', + client_factory=cf_incident) + with self.command_group('sentinel incident', sentinel_incident, client_factory=cf_incident, + is_experimental=True) as g: + g.custom_command('list', 'sentinel_incident_list') + g.custom_show_command('show', 'sentinel_incident_show') + g.custom_command('create', 'sentinel_incident_create') + g.custom_command('update', 'sentinel_incident_update') + g.custom_command('delete', 'sentinel_incident_delete') + + from azext_sentinel.generated._client_factory import cf_incident_comment + sentinel_incident_comment = CliCommandType( + operations_tmpl='azext_sentinel.vendored_sdks.securityinsight.operations._incident_comment_operations#IncidentC' + 'ommentOperations.{}', + client_factory=cf_incident_comment) + with self.command_group('sentinel incident-comment', sentinel_incident_comment, client_factory=cf_incident_comment, + is_experimental=True) as g: + g.custom_command('list', 'sentinel_incident_comment_list') + g.custom_show_command('show', 'sentinel_incident_comment_show') + g.custom_command('create', 'sentinel_incident_comment_create') diff --git a/src/securityinsight/azext_sentinel/generated/custom.py b/src/securityinsight/azext_sentinel/generated/custom.py index 7788f85c4dc..39389b22c79 100644 --- a/src/securityinsight/azext_sentinel/generated/custom.py +++ b/src/securityinsight/azext_sentinel/generated/custom.py @@ -10,6 +10,8 @@ # pylint: disable=line-too-long # pylint: disable=too-many-lines +import json + def sentinel_alert_rule_list(cmd, client, resource_group_name, @@ -81,6 +83,113 @@ def sentinel_action_list(cmd, client, rule_id=rule_id) +def sentinel_alert_rule_template_list(cmd, client, + resource_group_name, + workspace_name): + return client.list(resource_group_name=resource_group_name, + workspace_name=workspace_name) + + +def sentinel_alert_rule_template_show(cmd, client, + resource_group_name, + workspace_name, + alert_rule_template_id): + return client.get(resource_group_name=resource_group_name, + workspace_name=workspace_name, + alert_rule_template_id=alert_rule_template_id) + + +def sentinel_bookmark_list(cmd, client, + resource_group_name, + workspace_name): + return client.list(resource_group_name=resource_group_name, + workspace_name=workspace_name) + + +def sentinel_bookmark_show(cmd, client, + resource_group_name, + workspace_name, + bookmark_id): + return client.get(resource_group_name=resource_group_name, + workspace_name=workspace_name, + bookmark_id=bookmark_id) + + +def sentinel_bookmark_create(cmd, client, + resource_group_name, + workspace_name, + bookmark_id, + etag=None, + created=None, + created_by=None, + display_name=None, + labels=None, + notes=None, + query=None, + query_result=None, + updated=None, + updated_by=None, + incident_info=None): + if isinstance(labels, str): + labels = json.loads(labels) + return client.create_or_update(resource_group_name=resource_group_name, + workspace_name=workspace_name, + bookmark_id=bookmark_id, + etag=etag, + created=created, + created_by=created_by, + display_name=display_name, + labels=labels, + notes=notes, + query=query, + query_result=query_result, + updated=updated, + updated_by=updated_by, + incident_info=incident_info) + + +def sentinel_bookmark_update(cmd, client, + resource_group_name, + workspace_name, + bookmark_id, + etag=None, + created=None, + created_by=None, + display_name=None, + labels=None, + notes=None, + query=None, + query_result=None, + updated=None, + updated_by=None, + incident_info=None): + if isinstance(labels, str): + labels = json.loads(labels) + return client.create_or_update(resource_group_name=resource_group_name, + workspace_name=workspace_name, + bookmark_id=bookmark_id, + etag=etag, + created=created, + created_by=created_by, + display_name=display_name, + labels=labels, + notes=notes, + query=query, + query_result=query_result, + updated=updated, + updated_by=updated_by, + incident_info=incident_info) + + +def sentinel_bookmark_delete(cmd, client, + resource_group_name, + workspace_name, + bookmark_id): + return client.delete(resource_group_name=resource_group_name, + workspace_name=workspace_name, + bookmark_id=bookmark_id) + + def sentinel_data_connector_list(cmd, client, resource_group_name, workspace_name): @@ -130,3 +239,143 @@ def sentinel_data_connector_delete(cmd, client, return client.delete(resource_group_name=resource_group_name, workspace_name=workspace_name, data_connector_id=data_connector_id) + + +def sentinel_incident_list(cmd, client, + resource_group_name, + workspace_name, + filter=None, + orderby=None, + top=None, + skip_token=None): + return client.list(resource_group_name=resource_group_name, + workspace_name=workspace_name, + filter=filter, + orderby=orderby, + top=top, + skip_token=skip_token) + + +def sentinel_incident_show(cmd, client, + resource_group_name, + workspace_name, + incident_id): + return client.get(resource_group_name=resource_group_name, + workspace_name=workspace_name, + incident_id=incident_id) + + +def sentinel_incident_create(cmd, client, + resource_group_name, + workspace_name, + incident_id, + etag=None, + classification=None, + classification_comment=None, + classification_reason=None, + description=None, + first_activity_time_utc=None, + labels=None, + last_activity_time_utc=None, + owner=None, + severity=None, + status=None, + title=None): + return client.create_or_update(resource_group_name=resource_group_name, + workspace_name=workspace_name, + incident_id=incident_id, + etag=etag, + classification=classification, + classification_comment=classification_comment, + classification_reason=classification_reason, + description=description, + first_activity_time_utc=first_activity_time_utc, + labels=labels, + last_activity_time_utc=last_activity_time_utc, + owner=owner, + severity=severity, + status=status, + title=title) + + +def sentinel_incident_update(cmd, client, + resource_group_name, + workspace_name, + incident_id, + etag=None, + classification=None, + classification_comment=None, + classification_reason=None, + description=None, + first_activity_time_utc=None, + labels=None, + last_activity_time_utc=None, + owner=None, + severity=None, + status=None, + title=None): + return client.create_or_update(resource_group_name=resource_group_name, + workspace_name=workspace_name, + incident_id=incident_id, + etag=etag, + classification=classification, + classification_comment=classification_comment, + classification_reason=classification_reason, + description=description, + first_activity_time_utc=first_activity_time_utc, + labels=labels, + last_activity_time_utc=last_activity_time_utc, + owner=owner, + severity=severity, + status=status, + title=title) + + +def sentinel_incident_delete(cmd, client, + resource_group_name, + workspace_name, + incident_id): + return client.delete(resource_group_name=resource_group_name, + workspace_name=workspace_name, + incident_id=incident_id) + + +def sentinel_incident_comment_list(cmd, client, + resource_group_name, + workspace_name, + incident_id, + filter=None, + orderby=None, + top=None, + skip_token=None): + return client.list_by_incident(resource_group_name=resource_group_name, + workspace_name=workspace_name, + incident_id=incident_id, + filter=filter, + orderby=orderby, + top=top, + skip_token=skip_token) + + +def sentinel_incident_comment_show(cmd, client, + resource_group_name, + workspace_name, + incident_id, + incident_comment_id): + return client.get_comment(resource_group_name=resource_group_name, + workspace_name=workspace_name, + incident_id=incident_id, + incident_comment_id=incident_comment_id) + + +def sentinel_incident_comment_create(cmd, client, + resource_group_name, + workspace_name, + incident_id, + incident_comment_id, + message=None): + return client.create_comment(resource_group_name=resource_group_name, + workspace_name=workspace_name, + incident_id=incident_id, + incident_comment_id=incident_comment_id, + message=message) diff --git a/src/securityinsight/azext_sentinel/tests/latest/test_sentinel_scenario.py b/src/securityinsight/azext_sentinel/tests/latest/test_sentinel_scenario.py index 64b149a7055..8f63da1fc36 100644 --- a/src/securityinsight/azext_sentinel/tests/latest/test_sentinel_scenario.py +++ b/src/securityinsight/azext_sentinel/tests/latest/test_sentinel_scenario.py @@ -35,6 +35,25 @@ def step__actions_get_get_all_actions_of_alert_rule_(test, rg): checks=[]) +# EXAMPLE: /AlertRuleTemplates/get/Get alert rule template by Id. +@try_manual +def step__alertruletemplates_get_get_alert_rule_template_by_id_(test, rg): + test.cmd('az sentinel alert-rule-template show ' + '--alert-rule-template-id "65360bb0-8986-4ade-a89d-af3cf44d28aa" ' + '--resource-group "{rg}" ' + '--workspace-name "myWorkspace"', + checks=[]) + + +# EXAMPLE: /AlertRuleTemplates/get/Get all alert rule templates. +@try_manual +def step__alertruletemplates_get_get_all_alert_rule_templates_(test, rg): + test.cmd('az sentinel alert-rule-template list ' + '--resource-group "{rg}" ' + '--workspace-name "myWorkspace"', + checks=[]) + + # EXAMPLE: /AlertRules/put/Creates or updates a Fusion alert rule. @try_manual def step__alertrules_put_creates_or_updates_a_fusion_alert_rule_(test, rg): @@ -138,6 +157,45 @@ def step__alertrules_get_get_an_action_of_alert_rule_(test, rg): checks=[]) +# EXAMPLE: /Bookmarks/put/Creates or updates a bookmark. +@try_manual +def step__bookmarks_put_creates_or_updates_a_bookmark_(test, rg): + test.cmd('az sentinel bookmark create ' + '--etag "\\"0300bf09-0000-0000-0000-5c37296e0000\\"" ' + '--created "2019-01-01T13:15:30Z" ' + '--created-by name="john doe" email="john@contoso.com" object-id="2046feea-040d-4a46-9e2b-91c2941bfa70" ' + '--display-name "My bookmark" ' + '--labels "[\\"Tag1\\",\\"Tag2\\"]" ' + '--notes "Found a suspicious activity" ' + '--query "SecurityEvent | where TimeGenerated > ago(1d) and TimeGenerated < ago(2d)" ' + '--query-result "Security Event query result" ' + '--updated "2019-01-01T13:15:30Z" ' + '--updated-by name="john doe" email="john@contoso.com" object-id="2046feea-040d-4a46-9e2b-91c2941bfa70" ' + '--bookmark-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" ' + '--resource-group "{rg}" ' + '--workspace-name "myWorkspace"', + checks=[]) + + +# EXAMPLE: /Bookmarks/get/Get a bookmark. +@try_manual +def step__bookmarks_get_get_a_bookmark_(test, rg): + test.cmd('az sentinel bookmark show ' + '--bookmark-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" ' + '--resource-group "{rg}" ' + '--workspace-name "myWorkspace"', + checks=[]) + + +# EXAMPLE: /Bookmarks/get/Get all bookmarks. +@try_manual +def step__bookmarks_get_get_all_bookmarks_(test, rg): + test.cmd('az sentinel bookmark list ' + '--resource-group "{rg}" ' + '--workspace-name "myWorkspace"', + checks=[]) + + # EXAMPLE: /DataConnectors/put/Creates or updates an Office365 data connector. @try_manual def step__dataconnectors_put_creates_or_updates_an_office365_data_connector_(test, rg): @@ -239,6 +297,81 @@ def step__dataconnectors_get_get_an_office365_data_connector_(test, rg): checks=[]) +# EXAMPLE: /IncidentComments/put/Creates an incident comment. +@try_manual +def step__incidentcomments_put_creates_an_incident_comment_(test, rg): + test.cmd('az sentinel incident-comment create ' + '--message "Some message" ' + '--incident-comment-id "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014" ' + '--incident-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" ' + '--resource-group "{rg}" ' + '--workspace-name "myWorkspace"', + checks=[]) + + +# EXAMPLE: /IncidentComments/get/Get all incident comments. +@try_manual +def step__incidentcomments_get_get_all_incident_comments_(test, rg): + test.cmd('az sentinel incident-comment list ' + '--incident-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" ' + '--resource-group "{rg}" ' + '--workspace-name "myWorkspace"', + checks=[]) + + +# EXAMPLE: /IncidentComments/get/Get an incident comment. +@try_manual +def step__incidentcomments_get_get_an_incident_comment_(test, rg): + test.cmd('az sentinel incident-comment show ' + '--incident-comment-id "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014" ' + '--incident-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" ' + '--resource-group "{rg}" ' + '--workspace-name "myWorkspace"', + checks=[]) + + +# EXAMPLE: /Incidents/put/Creates or updates an incident. +@try_manual +def step__incidents_put_creates_or_updates_an_incident_(test, rg): + test.cmd('az sentinel incident create ' + '--etag "\\"0300bf09-0000-0000-0000-5c37296e0000\\"" ' + '--description "This is a demo incident" ' + '--classification "FalsePositive" ' + '--classification-comment "Not a malicious activity" ' + '--classification-reason "IncorrectAlertLogic" ' + '--first-activity-time-utc "2019-01-01T13:00:30Z" ' + '--last-activity-time-utc "2019-01-01T13:05:30Z" ' + '--owner object-id="2046feea-040d-4a46-9e2b-91c2941bfa70" ' + '--severity "High" ' + '--status "Closed" ' + '--title "My incident" ' + '--incident-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" ' + '--resource-group "{rg}" ' + '--workspace-name "myWorkspace"', + checks=[]) + + +# EXAMPLE: /Incidents/get/Get all incidents. +@try_manual +def step__incidents_get_get_all_incidents_(test, rg): + test.cmd('az sentinel incident list ' + '--orderby "properties/createdTimeUtc desc" ' + '--top 1 ' + '--resource-group "{rg}" ' + '--workspace-name "myWorkspace"', + checks=[]) + + +# EXAMPLE: /Incidents/get/Get an incident. +@try_manual +def step__incidents_get_get_an_incident_(test, rg): + test.cmd('az sentinel incident show ' + '--incident-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" ' + '--resource-group "{rg}" ' + '--workspace-name "myWorkspace"', + checks=[]) + + # EXAMPLE: /AlertRules/delete/Delete an alert rule. @try_manual def step__alertrules_delete_delete_an_alert_rule_(test, rg): @@ -260,6 +393,16 @@ def step__alertrules_delete_delete_an_action_of_alert_rule_(test, rg): checks=[]) +# EXAMPLE: /Bookmarks/delete/Delete a bookmark. +@try_manual +def step__bookmarks_delete_delete_a_bookmark_(test, rg): + test.cmd('az sentinel bookmark delete ' + '--bookmark-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" ' + '--resource-group "{rg}" ' + '--workspace-name "myWorkspace"', + checks=[]) + + # EXAMPLE: /DataConnectors/delete/Delete an Office365 data connector. @try_manual def step__dataconnectors_delete_delete_an_office365_data_connector_(test, rg): @@ -270,6 +413,16 @@ def step__dataconnectors_delete_delete_an_office365_data_connector_(test, rg): checks=[]) +# EXAMPLE: /Incidents/delete/Delete an incident. +@try_manual +def step__incidents_delete_delete_an_incident_(test, rg): + test.cmd('az sentinel incident delete ' + '--incident-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" ' + '--resource-group "{rg}" ' + '--workspace-name "myWorkspace"', + checks=[]) + + @try_manual def cleanup(test, rg): pass @@ -279,6 +432,8 @@ def cleanup(test, rg): def call_scenario(test, rg): setup(test, rg) step__actions_get_get_all_actions_of_alert_rule_(test, rg) + step__alertruletemplates_get_get_alert_rule_template_by_id_(test, rg) + step__alertruletemplates_get_get_all_alert_rule_templates_(test, rg) step__alertrules_put_creates_or_updates_a_fusion_alert_rule_(test, rg) step__alertrules_put_creates_or_updates_a_microsoftsecurityincidentcreation_rule_(test, rg) step__alertrules_put_creates_or_updates_a_scheduled_alert_rule_(test, rg) @@ -288,6 +443,9 @@ def call_scenario(test, rg): step__alertrules_get_get_a_scheduled_alert_rule_(test, rg) step__alertrules_get_get_all_alert_rules_(test, rg) step__alertrules_get_get_an_action_of_alert_rule_(test, rg) + step__bookmarks_put_creates_or_updates_a_bookmark_(test, rg) + step__bookmarks_get_get_a_bookmark_(test, rg) + step__bookmarks_get_get_all_bookmarks_(test, rg) step__dataconnectors_put_creates_or_updates_an_office365_data_connector_(test, rg) step__dataconnectors_get_get_a_asc_data_connector_(test, rg) step__dataconnectors_get_get_a_mcas_data_connector_(test, rg) @@ -298,9 +456,17 @@ def call_scenario(test, rg): step__dataconnectors_get_get_an_aatp_data_connector_(test, rg) step__dataconnectors_get_get_an_awscloudtrail_data_connector_(test, rg) step__dataconnectors_get_get_an_office365_data_connector_(test, rg) + step__incidentcomments_put_creates_an_incident_comment_(test, rg) + step__incidentcomments_get_get_all_incident_comments_(test, rg) + step__incidentcomments_get_get_an_incident_comment_(test, rg) + step__incidents_put_creates_or_updates_an_incident_(test, rg) + step__incidents_get_get_all_incidents_(test, rg) + step__incidents_get_get_an_incident_(test, rg) step__alertrules_delete_delete_an_alert_rule_(test, rg) step__alertrules_delete_delete_an_action_of_alert_rule_(test, rg) + step__bookmarks_delete_delete_a_bookmark_(test, rg) step__dataconnectors_delete_delete_an_office365_data_connector_(test, rg) + step__incidents_delete_delete_an_incident_(test, rg) cleanup(test, rg) diff --git a/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/_security_insights.py b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/_security_insights.py index 2a1c0d76cbf..f589a21b79d 100644 --- a/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/_security_insights.py +++ b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/_security_insights.py @@ -19,7 +19,11 @@ from .operations import OperationOperations from .operations import AlertRuleOperations from .operations import ActionOperations +from .operations import AlertRuleTemplateOperations +from .operations import BookmarkOperations from .operations import DataConnectorOperations +from .operations import IncidentOperations +from .operations import IncidentCommentOperations from . import models @@ -32,8 +36,16 @@ class SecurityInsights(object): :vartype alert_rule: azure.mgmt.securityinsight.operations.AlertRuleOperations :ivar action: ActionOperations operations :vartype action: azure.mgmt.securityinsight.operations.ActionOperations + :ivar alert_rule_template: AlertRuleTemplateOperations operations + :vartype alert_rule_template: azure.mgmt.securityinsight.operations.AlertRuleTemplateOperations + :ivar bookmark: BookmarkOperations operations + :vartype bookmark: azure.mgmt.securityinsight.operations.BookmarkOperations :ivar data_connector: DataConnectorOperations operations :vartype data_connector: azure.mgmt.securityinsight.operations.DataConnectorOperations + :ivar incident: IncidentOperations operations + :vartype incident: azure.mgmt.securityinsight.operations.IncidentOperations + :ivar incident_comment: IncidentCommentOperations operations + :vartype incident_comment: azure.mgmt.securityinsight.operations.IncidentCommentOperations :param credential: Credential needed for the client to connect to Azure. :type credential: ~azure.core.credentials.TokenCredential :param subscription_id: Azure subscription ID. @@ -64,8 +76,16 @@ def __init__( self._client, self._config, self._serialize, self._deserialize) self.action = ActionOperations( self._client, self._config, self._serialize, self._deserialize) + self.alert_rule_template = AlertRuleTemplateOperations( + self._client, self._config, self._serialize, self._deserialize) + self.bookmark = BookmarkOperations( + self._client, self._config, self._serialize, self._deserialize) self.data_connector = DataConnectorOperations( self._client, self._config, self._serialize, self._deserialize) + self.incident = IncidentOperations( + self._client, self._config, self._serialize, self._deserialize) + self.incident_comment = IncidentCommentOperations( + self._client, self._config, self._serialize, self._deserialize) def close(self): # type: () -> None diff --git a/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/aio/_security_insights_async.py b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/aio/_security_insights_async.py index 2bf9b373cc9..1a1347c6fb7 100644 --- a/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/aio/_security_insights_async.py +++ b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/aio/_security_insights_async.py @@ -15,7 +15,11 @@ from .operations_async import OperationOperations from .operations_async import AlertRuleOperations from .operations_async import ActionOperations +from .operations_async import AlertRuleTemplateOperations +from .operations_async import BookmarkOperations from .operations_async import DataConnectorOperations +from .operations_async import IncidentOperations +from .operations_async import IncidentCommentOperations from .. import models @@ -28,8 +32,16 @@ class SecurityInsights(object): :vartype alert_rule: azure.mgmt.securityinsight.aio.operations_async.AlertRuleOperations :ivar action: ActionOperations operations :vartype action: azure.mgmt.securityinsight.aio.operations_async.ActionOperations + :ivar alert_rule_template: AlertRuleTemplateOperations operations + :vartype alert_rule_template: azure.mgmt.securityinsight.aio.operations_async.AlertRuleTemplateOperations + :ivar bookmark: BookmarkOperations operations + :vartype bookmark: azure.mgmt.securityinsight.aio.operations_async.BookmarkOperations :ivar data_connector: DataConnectorOperations operations :vartype data_connector: azure.mgmt.securityinsight.aio.operations_async.DataConnectorOperations + :ivar incident: IncidentOperations operations + :vartype incident: azure.mgmt.securityinsight.aio.operations_async.IncidentOperations + :ivar incident_comment: IncidentCommentOperations operations + :vartype incident_comment: azure.mgmt.securityinsight.aio.operations_async.IncidentCommentOperations :param credential: Credential needed for the client to connect to Azure. :type credential: ~azure.core.credentials_async.AsyncTokenCredential :param subscription_id: Azure subscription ID. @@ -59,8 +71,16 @@ def __init__( self._client, self._config, self._serialize, self._deserialize) self.action = ActionOperations( self._client, self._config, self._serialize, self._deserialize) + self.alert_rule_template = AlertRuleTemplateOperations( + self._client, self._config, self._serialize, self._deserialize) + self.bookmark = BookmarkOperations( + self._client, self._config, self._serialize, self._deserialize) self.data_connector = DataConnectorOperations( self._client, self._config, self._serialize, self._deserialize) + self.incident = IncidentOperations( + self._client, self._config, self._serialize, self._deserialize) + self.incident_comment = IncidentCommentOperations( + self._client, self._config, self._serialize, self._deserialize) async def close(self) -> None: await self._client.close() diff --git a/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/aio/operations_async/__init__.py b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/aio/operations_async/__init__.py index cf3fbf02464..0d2fb1ec8ad 100644 --- a/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/aio/operations_async/__init__.py +++ b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/aio/operations_async/__init__.py @@ -9,11 +9,19 @@ from ._operation_operations_async import OperationOperations from ._alert_rule_operations_async import AlertRuleOperations from ._action_operations_async import ActionOperations +from ._alert_rule_template_operations_async import AlertRuleTemplateOperations +from ._bookmark_operations_async import BookmarkOperations from ._data_connector_operations_async import DataConnectorOperations +from ._incident_operations_async import IncidentOperations +from ._incident_comment_operations_async import IncidentCommentOperations __all__ = [ 'OperationOperations', 'AlertRuleOperations', 'ActionOperations', + 'AlertRuleTemplateOperations', + 'BookmarkOperations', 'DataConnectorOperations', + 'IncidentOperations', + 'IncidentCommentOperations', ] diff --git a/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/aio/operations_async/_alert_rule_operations_async.py b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/aio/operations_async/_alert_rule_operations_async.py index ad38776c736..6f145c9ebc0 100644 --- a/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/aio/operations_async/_alert_rule_operations_async.py +++ b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/aio/operations_async/_alert_rule_operations_async.py @@ -395,8 +395,9 @@ async def create_or_update_action( :type action_id: str :param etag: Etag of the azure resource. :type etag: str - :param logic_app_resource_id: Logic App Resource Id, - providers/Microsoft.Logic/workflows/{WorkflowID}. + :param logic_app_resource_id: Logic App Resource Id, /subscriptions/{my- + subscription}/resourceGroups/{my-resource-group}/providers/Microsoft.Logic/workflows/{my- + workflow-id}. :type logic_app_resource_id: str :param trigger_uri: Logic App Callback URL for this specific workflow. :type trigger_uri: str diff --git a/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/aio/operations_async/_alert_rule_template_operations_async.py b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/aio/operations_async/_alert_rule_template_operations_async.py new file mode 100644 index 00000000000..d57fb29f400 --- /dev/null +++ b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/aio/operations_async/_alert_rule_template_operations_async.py @@ -0,0 +1,173 @@ +# coding=utf-8 +# -------------------------------------------------------------------------- +# Copyright (c) Microsoft Corporation. All rights reserved. +# Licensed under the MIT License. See License.txt in the project root for license information. +# Code generated by Microsoft (R) AutoRest Code Generator. +# Changes may cause incorrect behavior and will be lost if the code is regenerated. +# -------------------------------------------------------------------------- +from typing import Any, Callable, Dict, Generic, Optional, TypeVar +import warnings + +from azure.core.async_paging import AsyncItemPaged, AsyncList +from azure.core.exceptions import HttpResponseError, ResourceExistsError, ResourceNotFoundError, map_error +from azure.core.pipeline import PipelineResponse +from azure.core.pipeline.transport import AsyncHttpResponse, HttpRequest +from azure.mgmt.core.exceptions import ARMErrorFormat + +from ... import models + +T = TypeVar('T') +ClsType = Optional[Callable[[PipelineResponse[HttpRequest, AsyncHttpResponse], T, Dict[str, Any]], Any]] + +class AlertRuleTemplateOperations: + """AlertRuleTemplateOperations async operations. + + You should not instantiate this class directly. Instead, you should create a Client instance that + instantiates it for you and attaches it as an attribute. + + :ivar models: Alias to model classes used in this operation group. + :type models: ~azure.mgmt.securityinsight.models + :param client: Client for service requests. + :param config: Configuration of service client. + :param serializer: An object model serializer. + :param deserializer: An object model deserializer. + """ + + models = models + + def __init__(self, client, config, serializer, deserializer) -> None: + self._client = client + self._serialize = serializer + self._deserialize = deserializer + self._config = config + + def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs + ) -> "models.AlertRuleTemplatesList": + """Gets all alert rule templates. + + :param resource_group_name: The name of the resource group within the user's subscription. The + name is case insensitive. + :type resource_group_name: str + :param workspace_name: The name of the workspace. + :type workspace_name: str + :keyword callable cls: A custom type or function that will be passed the direct response + :return: AlertRuleTemplatesList or the result of cls(response) + :rtype: ~azure.mgmt.securityinsight.models.AlertRuleTemplatesList + :raises: ~azure.core.exceptions.HttpResponseError + """ + cls = kwargs.pop('cls', None) # type: ClsType["models.AlertRuleTemplatesList"] + error_map = kwargs.pop('error_map', {404: ResourceNotFoundError, 409: ResourceExistsError}) + api_version = "2020-01-01" + + def prepare_request(next_link=None): + if not next_link: + # Construct URL + url = self.list.metadata['url'] + path_format_arguments = { + 'subscriptionId': self._serialize.url("self._config.subscription_id", self._config.subscription_id, 'str', pattern=r'^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$'), + 'resourceGroupName': self._serialize.url("resource_group_name", resource_group_name, 'str', max_length=90, min_length=1, pattern=r'^[-\w\._\(\)]+$'), + 'workspaceName': self._serialize.url("workspace_name", workspace_name, 'str', max_length=90, min_length=1), + } + url = self._client.format_url(url, **path_format_arguments) + else: + url = next_link + + # Construct parameters + query_parameters = {} # type: Dict[str, Any] + query_parameters['api-version'] = self._serialize.query("api_version", api_version, 'str') + + # Construct headers + header_parameters = {} # type: Dict[str, Any] + header_parameters['Accept'] = 'application/json' + + # Construct and send request + request = self._client.get(url, query_parameters, header_parameters) + return request + + async def extract_data(pipeline_response): + deserialized = self._deserialize('AlertRuleTemplatesList', pipeline_response) + list_of_elem = deserialized.value + if cls: + list_of_elem = cls(list_of_elem) + return deserialized.next_link or None, AsyncList(list_of_elem) + + async def get_next(next_link=None): + request = prepare_request(next_link) + + pipeline_response = await self._client._pipeline.run(request, stream=False, **kwargs) + response = pipeline_response.http_response + + if response.status_code not in [200]: + map_error(status_code=response.status_code, response=response, error_map=error_map) + raise HttpResponseError(response=response, error_format=ARMErrorFormat) + + return pipeline_response + + return AsyncItemPaged( + get_next, extract_data + ) + list.metadata = {'url': '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRuleTemplates'} + + async def get( + self, + resource_group_name: str, + workspace_name: str, + alert_rule_template_id: str, + **kwargs + ) -> "models.AlertRuleTemplate": + """Gets the alert rule template. + + :param resource_group_name: The name of the resource group within the user's subscription. The + name is case insensitive. + :type resource_group_name: str + :param workspace_name: The name of the workspace. + :type workspace_name: str + :param alert_rule_template_id: Alert rule template ID. + :type alert_rule_template_id: str + :keyword callable cls: A custom type or function that will be passed the direct response + :return: AlertRuleTemplate or the result of cls(response) + :rtype: ~azure.mgmt.securityinsight.models.AlertRuleTemplate + :raises: ~azure.core.exceptions.HttpResponseError + """ + cls = kwargs.pop('cls', None) # type: ClsType["models.AlertRuleTemplate"] + error_map = kwargs.pop('error_map', {404: ResourceNotFoundError, 409: ResourceExistsError}) + api_version = "2020-01-01" + + # Construct URL + url = self.get.metadata['url'] + path_format_arguments = { + 'subscriptionId': self._serialize.url("self._config.subscription_id", self._config.subscription_id, 'str', pattern=r'^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$'), + 'resourceGroupName': self._serialize.url("resource_group_name", resource_group_name, 'str', max_length=90, min_length=1, pattern=r'^[-\w\._\(\)]+$'), + 'workspaceName': self._serialize.url("workspace_name", workspace_name, 'str', max_length=90, min_length=1), + 'alertRuleTemplateId': self._serialize.url("alert_rule_template_id", alert_rule_template_id, 'str'), + } + url = self._client.format_url(url, **path_format_arguments) + + # Construct parameters + query_parameters = {} # type: Dict[str, Any] + query_parameters['api-version'] = self._serialize.query("api_version", api_version, 'str') + + # Construct headers + header_parameters = {} # type: Dict[str, Any] + header_parameters['Accept'] = 'application/json' + + # Construct and send request + request = self._client.get(url, query_parameters, header_parameters) + pipeline_response = await self._client._pipeline.run(request, stream=False, **kwargs) + response = pipeline_response.http_response + + if response.status_code not in [200]: + map_error(status_code=response.status_code, response=response, error_map=error_map) + raise HttpResponseError(response=response, error_format=ARMErrorFormat) + + deserialized = self._deserialize('AlertRuleTemplate', pipeline_response) + + if cls: + return cls(pipeline_response, deserialized, {}) + + return deserialized + get.metadata = {'url': '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRuleTemplates/{alertRuleTemplateId}'} diff --git a/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/aio/operations_async/_bookmark_operations_async.py b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/aio/operations_async/_bookmark_operations_async.py new file mode 100644 index 00000000000..d6156f07bf9 --- /dev/null +++ b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/aio/operations_async/_bookmark_operations_async.py @@ -0,0 +1,336 @@ +# coding=utf-8 +# -------------------------------------------------------------------------- +# Copyright (c) Microsoft Corporation. All rights reserved. +# Licensed under the MIT License. See License.txt in the project root for license information. +# Code generated by Microsoft (R) AutoRest Code Generator. +# Changes may cause incorrect behavior and will be lost if the code is regenerated. +# -------------------------------------------------------------------------- +import datetime +from typing import Any, Callable, Dict, Generic, List, Optional, TypeVar, Union +import warnings + +from azure.core.async_paging import AsyncItemPaged, AsyncList +from azure.core.exceptions import HttpResponseError, ResourceExistsError, ResourceNotFoundError, map_error +from azure.core.pipeline import PipelineResponse +from azure.core.pipeline.transport import AsyncHttpResponse, HttpRequest +from azure.mgmt.core.exceptions import ARMErrorFormat + +from ... import models + +T = TypeVar('T') +ClsType = Optional[Callable[[PipelineResponse[HttpRequest, AsyncHttpResponse], T, Dict[str, Any]], Any]] + +class BookmarkOperations: + """BookmarkOperations async operations. + + You should not instantiate this class directly. Instead, you should create a Client instance that + instantiates it for you and attaches it as an attribute. + + :ivar models: Alias to model classes used in this operation group. + :type models: ~azure.mgmt.securityinsight.models + :param client: Client for service requests. + :param config: Configuration of service client. + :param serializer: An object model serializer. + :param deserializer: An object model deserializer. + """ + + models = models + + def __init__(self, client, config, serializer, deserializer) -> None: + self._client = client + self._serialize = serializer + self._deserialize = deserializer + self._config = config + + def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs + ) -> "models.BookmarkList": + """Gets all bookmarks. + + :param resource_group_name: The name of the resource group within the user's subscription. The + name is case insensitive. + :type resource_group_name: str + :param workspace_name: The name of the workspace. + :type workspace_name: str + :keyword callable cls: A custom type or function that will be passed the direct response + :return: BookmarkList or the result of cls(response) + :rtype: ~azure.mgmt.securityinsight.models.BookmarkList + :raises: ~azure.core.exceptions.HttpResponseError + """ + cls = kwargs.pop('cls', None) # type: ClsType["models.BookmarkList"] + error_map = kwargs.pop('error_map', {404: ResourceNotFoundError, 409: ResourceExistsError}) + api_version = "2020-01-01" + + def prepare_request(next_link=None): + if not next_link: + # Construct URL + url = self.list.metadata['url'] + path_format_arguments = { + 'subscriptionId': self._serialize.url("self._config.subscription_id", self._config.subscription_id, 'str', pattern=r'^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$'), + 'resourceGroupName': self._serialize.url("resource_group_name", resource_group_name, 'str', max_length=90, min_length=1, pattern=r'^[-\w\._\(\)]+$'), + 'workspaceName': self._serialize.url("workspace_name", workspace_name, 'str', max_length=90, min_length=1), + } + url = self._client.format_url(url, **path_format_arguments) + else: + url = next_link + + # Construct parameters + query_parameters = {} # type: Dict[str, Any] + query_parameters['api-version'] = self._serialize.query("api_version", api_version, 'str') + + # Construct headers + header_parameters = {} # type: Dict[str, Any] + header_parameters['Accept'] = 'application/json' + + # Construct and send request + request = self._client.get(url, query_parameters, header_parameters) + return request + + async def extract_data(pipeline_response): + deserialized = self._deserialize('BookmarkList', pipeline_response) + list_of_elem = deserialized.value + if cls: + list_of_elem = cls(list_of_elem) + return deserialized.next_link or None, AsyncList(list_of_elem) + + async def get_next(next_link=None): + request = prepare_request(next_link) + + pipeline_response = await self._client._pipeline.run(request, stream=False, **kwargs) + response = pipeline_response.http_response + + if response.status_code not in [200]: + map_error(status_code=response.status_code, response=response, error_map=error_map) + raise HttpResponseError(response=response, error_format=ARMErrorFormat) + + return pipeline_response + + return AsyncItemPaged( + get_next, extract_data + ) + list.metadata = {'url': '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/bookmarks'} + + async def get( + self, + resource_group_name: str, + workspace_name: str, + bookmark_id: str, + **kwargs + ) -> "models.Bookmark": + """Gets a bookmark. + + :param resource_group_name: The name of the resource group within the user's subscription. The + name is case insensitive. + :type resource_group_name: str + :param workspace_name: The name of the workspace. + :type workspace_name: str + :param bookmark_id: Bookmark ID. + :type bookmark_id: str + :keyword callable cls: A custom type or function that will be passed the direct response + :return: Bookmark or the result of cls(response) + :rtype: ~azure.mgmt.securityinsight.models.Bookmark + :raises: ~azure.core.exceptions.HttpResponseError + """ + cls = kwargs.pop('cls', None) # type: ClsType["models.Bookmark"] + error_map = kwargs.pop('error_map', {404: ResourceNotFoundError, 409: ResourceExistsError}) + api_version = "2020-01-01" + + # Construct URL + url = self.get.metadata['url'] + path_format_arguments = { + 'subscriptionId': self._serialize.url("self._config.subscription_id", self._config.subscription_id, 'str', pattern=r'^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$'), + 'resourceGroupName': self._serialize.url("resource_group_name", resource_group_name, 'str', max_length=90, min_length=1, pattern=r'^[-\w\._\(\)]+$'), + 'workspaceName': self._serialize.url("workspace_name", workspace_name, 'str', max_length=90, min_length=1), + 'bookmarkId': self._serialize.url("bookmark_id", bookmark_id, 'str'), + } + url = self._client.format_url(url, **path_format_arguments) + + # Construct parameters + query_parameters = {} # type: Dict[str, Any] + query_parameters['api-version'] = self._serialize.query("api_version", api_version, 'str') + + # Construct headers + header_parameters = {} # type: Dict[str, Any] + header_parameters['Accept'] = 'application/json' + + # Construct and send request + request = self._client.get(url, query_parameters, header_parameters) + pipeline_response = await self._client._pipeline.run(request, stream=False, **kwargs) + response = pipeline_response.http_response + + if response.status_code not in [200]: + map_error(status_code=response.status_code, response=response, error_map=error_map) + raise HttpResponseError(response=response, error_format=ARMErrorFormat) + + deserialized = self._deserialize('Bookmark', pipeline_response) + + if cls: + return cls(pipeline_response, deserialized, {}) + + return deserialized + get.metadata = {'url': '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/bookmarks/{bookmarkId}'} + + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + bookmark_id: str, + etag: Optional[str] = None, + created: Optional[datetime.datetime] = None, + created_by: Optional["models.UserInfo"] = None, + display_name: Optional[str] = None, + labels: Optional[List[str]] = None, + notes: Optional[str] = None, + query: Optional[str] = None, + query_result: Optional[str] = None, + updated: Optional[datetime.datetime] = None, + updated_by: Optional["models.UserInfo"] = None, + incident_info: Optional["models.IncidentInfo"] = None, + **kwargs + ) -> "models.Bookmark": + """Creates or updates the bookmark. + + :param resource_group_name: The name of the resource group within the user's subscription. The + name is case insensitive. + :type resource_group_name: str + :param workspace_name: The name of the workspace. + :type workspace_name: str + :param bookmark_id: Bookmark ID. + :type bookmark_id: str + :param etag: Etag of the azure resource. + :type etag: str + :param created: The time the bookmark was created. + :type created: ~datetime.datetime + :param created_by: Describes a user that created the bookmark. + :type created_by: ~azure.mgmt.securityinsight.models.UserInfo + :param display_name: The display name of the bookmark. + :type display_name: str + :param labels: List of labels relevant to this bookmark. + :type labels: list[str] + :param notes: The notes of the bookmark. + :type notes: str + :param query: The query of the bookmark. + :type query: str + :param query_result: The query result of the bookmark. + :type query_result: str + :param updated: The last time the bookmark was updated. + :type updated: ~datetime.datetime + :param updated_by: Describes a user that updated the bookmark. + :type updated_by: ~azure.mgmt.securityinsight.models.UserInfo + :param incident_info: Describes an incident that relates to bookmark. + :type incident_info: ~azure.mgmt.securityinsight.models.IncidentInfo + :keyword callable cls: A custom type or function that will be passed the direct response + :return: Bookmark or the result of cls(response) + :rtype: ~azure.mgmt.securityinsight.models.Bookmark or ~azure.mgmt.securityinsight.models.Bookmark + :raises: ~azure.core.exceptions.HttpResponseError + """ + cls = kwargs.pop('cls', None) # type: ClsType["models.Bookmark"] + error_map = kwargs.pop('error_map', {404: ResourceNotFoundError, 409: ResourceExistsError}) + + _bookmark = models.Bookmark(etag=etag, created=created, created_by=created_by, display_name=display_name, labels=labels, notes=notes, query=query, query_result=query_result, updated=updated, updated_by=updated_by, incident_info=incident_info) + api_version = "2020-01-01" + content_type = kwargs.pop("content_type", "application/json") + + # Construct URL + url = self.create_or_update.metadata['url'] + path_format_arguments = { + 'subscriptionId': self._serialize.url("self._config.subscription_id", self._config.subscription_id, 'str', pattern=r'^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$'), + 'resourceGroupName': self._serialize.url("resource_group_name", resource_group_name, 'str', max_length=90, min_length=1, pattern=r'^[-\w\._\(\)]+$'), + 'workspaceName': self._serialize.url("workspace_name", workspace_name, 'str', max_length=90, min_length=1), + 'bookmarkId': self._serialize.url("bookmark_id", bookmark_id, 'str'), + } + url = self._client.format_url(url, **path_format_arguments) + + # Construct parameters + query_parameters = {} # type: Dict[str, Any] + query_parameters['api-version'] = self._serialize.query("api_version", api_version, 'str') + + # Construct headers + header_parameters = {} # type: Dict[str, Any] + header_parameters['Content-Type'] = self._serialize.header("content_type", content_type, 'str') + header_parameters['Accept'] = 'application/json' + + # Construct and send request + body_content_kwargs = {} # type: Dict[str, Any] + body_content = self._serialize.body(_bookmark, 'Bookmark') + body_content_kwargs['content'] = body_content + request = self._client.put(url, query_parameters, header_parameters, **body_content_kwargs) + + pipeline_response = await self._client._pipeline.run(request, stream=False, **kwargs) + response = pipeline_response.http_response + + if response.status_code not in [200, 201]: + map_error(status_code=response.status_code, response=response, error_map=error_map) + raise HttpResponseError(response=response, error_format=ARMErrorFormat) + + deserialized = None + if response.status_code == 200: + deserialized = self._deserialize('Bookmark', pipeline_response) + + if response.status_code == 201: + deserialized = self._deserialize('Bookmark', pipeline_response) + + if cls: + return cls(pipeline_response, deserialized, {}) + + return deserialized + create_or_update.metadata = {'url': '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/bookmarks/{bookmarkId}'} + + async def delete( + self, + resource_group_name: str, + workspace_name: str, + bookmark_id: str, + **kwargs + ) -> None: + """Delete the bookmark. + + :param resource_group_name: The name of the resource group within the user's subscription. The + name is case insensitive. + :type resource_group_name: str + :param workspace_name: The name of the workspace. + :type workspace_name: str + :param bookmark_id: Bookmark ID. + :type bookmark_id: str + :keyword callable cls: A custom type or function that will be passed the direct response + :return: None or the result of cls(response) + :rtype: None + :raises: ~azure.core.exceptions.HttpResponseError + """ + cls = kwargs.pop('cls', None) # type: ClsType[None] + error_map = kwargs.pop('error_map', {404: ResourceNotFoundError, 409: ResourceExistsError}) + api_version = "2020-01-01" + + # Construct URL + url = self.delete.metadata['url'] + path_format_arguments = { + 'subscriptionId': self._serialize.url("self._config.subscription_id", self._config.subscription_id, 'str', pattern=r'^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$'), + 'resourceGroupName': self._serialize.url("resource_group_name", resource_group_name, 'str', max_length=90, min_length=1, pattern=r'^[-\w\._\(\)]+$'), + 'workspaceName': self._serialize.url("workspace_name", workspace_name, 'str', max_length=90, min_length=1), + 'bookmarkId': self._serialize.url("bookmark_id", bookmark_id, 'str'), + } + url = self._client.format_url(url, **path_format_arguments) + + # Construct parameters + query_parameters = {} # type: Dict[str, Any] + query_parameters['api-version'] = self._serialize.query("api_version", api_version, 'str') + + # Construct headers + header_parameters = {} # type: Dict[str, Any] + + # Construct and send request + request = self._client.delete(url, query_parameters, header_parameters) + pipeline_response = await self._client._pipeline.run(request, stream=False, **kwargs) + response = pipeline_response.http_response + + if response.status_code not in [200, 204]: + map_error(status_code=response.status_code, response=response, error_map=error_map) + raise HttpResponseError(response=response, error_format=ARMErrorFormat) + + if cls: + return cls(pipeline_response, None, {}) + + delete.metadata = {'url': '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/bookmarks/{bookmarkId}'} diff --git a/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/aio/operations_async/_incident_comment_operations_async.py b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/aio/operations_async/_incident_comment_operations_async.py new file mode 100644 index 00000000000..f955a7d49af --- /dev/null +++ b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/aio/operations_async/_incident_comment_operations_async.py @@ -0,0 +1,278 @@ +# coding=utf-8 +# -------------------------------------------------------------------------- +# Copyright (c) Microsoft Corporation. All rights reserved. +# Licensed under the MIT License. See License.txt in the project root for license information. +# Code generated by Microsoft (R) AutoRest Code Generator. +# Changes may cause incorrect behavior and will be lost if the code is regenerated. +# -------------------------------------------------------------------------- +from typing import Any, Callable, Dict, Generic, Optional, TypeVar +import warnings + +from azure.core.async_paging import AsyncItemPaged, AsyncList +from azure.core.exceptions import HttpResponseError, ResourceExistsError, ResourceNotFoundError, map_error +from azure.core.pipeline import PipelineResponse +from azure.core.pipeline.transport import AsyncHttpResponse, HttpRequest +from azure.mgmt.core.exceptions import ARMErrorFormat + +from ... import models + +T = TypeVar('T') +ClsType = Optional[Callable[[PipelineResponse[HttpRequest, AsyncHttpResponse], T, Dict[str, Any]], Any]] + +class IncidentCommentOperations: + """IncidentCommentOperations async operations. + + You should not instantiate this class directly. Instead, you should create a Client instance that + instantiates it for you and attaches it as an attribute. + + :ivar models: Alias to model classes used in this operation group. + :type models: ~azure.mgmt.securityinsight.models + :param client: Client for service requests. + :param config: Configuration of service client. + :param serializer: An object model serializer. + :param deserializer: An object model deserializer. + """ + + models = models + + def __init__(self, client, config, serializer, deserializer) -> None: + self._client = client + self._serialize = serializer + self._deserialize = deserializer + self._config = config + + def list_by_incident( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + filter: Optional[str] = None, + orderby: Optional[str] = None, + top: Optional[int] = None, + skip_token: Optional[str] = None, + **kwargs + ) -> "models.IncidentCommentList": + """Gets all incident comments. + + :param resource_group_name: The name of the resource group within the user's subscription. The + name is case insensitive. + :type resource_group_name: str + :param workspace_name: The name of the workspace. + :type workspace_name: str + :param incident_id: Incident ID. + :type incident_id: str + :param filter: Filters the results, based on a Boolean condition. Optional. + :type filter: str + :param orderby: Sorts the results. Optional. + :type orderby: str + :param top: Returns only the first n results. Optional. + :type top: int + :param skip_token: Skiptoken is only used if a previous operation returned a partial result. If + a previous response contains a nextLink element, the value of the nextLink element will include + a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional. + :type skip_token: str + :keyword callable cls: A custom type or function that will be passed the direct response + :return: IncidentCommentList or the result of cls(response) + :rtype: ~azure.mgmt.securityinsight.models.IncidentCommentList + :raises: ~azure.core.exceptions.HttpResponseError + """ + cls = kwargs.pop('cls', None) # type: ClsType["models.IncidentCommentList"] + error_map = kwargs.pop('error_map', {404: ResourceNotFoundError, 409: ResourceExistsError}) + api_version = "2020-01-01" + + def prepare_request(next_link=None): + if not next_link: + # Construct URL + url = self.list_by_incident.metadata['url'] + path_format_arguments = { + 'subscriptionId': self._serialize.url("self._config.subscription_id", self._config.subscription_id, 'str', pattern=r'^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$'), + 'resourceGroupName': self._serialize.url("resource_group_name", resource_group_name, 'str', max_length=90, min_length=1, pattern=r'^[-\w\._\(\)]+$'), + 'workspaceName': self._serialize.url("workspace_name", workspace_name, 'str', max_length=90, min_length=1), + 'incidentId': self._serialize.url("incident_id", incident_id, 'str'), + } + url = self._client.format_url(url, **path_format_arguments) + else: + url = next_link + + # Construct parameters + query_parameters = {} # type: Dict[str, Any] + query_parameters['api-version'] = self._serialize.query("api_version", api_version, 'str') + if filter is not None: + query_parameters['$filter'] = self._serialize.query("filter", filter, 'str') + if orderby is not None: + query_parameters['$orderby'] = self._serialize.query("orderby", orderby, 'str') + if top is not None: + query_parameters['$top'] = self._serialize.query("top", top, 'int') + if skip_token is not None: + query_parameters['$skipToken'] = self._serialize.query("skip_token", skip_token, 'str') + + # Construct headers + header_parameters = {} # type: Dict[str, Any] + header_parameters['Accept'] = 'application/json' + + # Construct and send request + request = self._client.get(url, query_parameters, header_parameters) + return request + + async def extract_data(pipeline_response): + deserialized = self._deserialize('IncidentCommentList', pipeline_response) + list_of_elem = deserialized.value + if cls: + list_of_elem = cls(list_of_elem) + return deserialized.next_link or None, AsyncList(list_of_elem) + + async def get_next(next_link=None): + request = prepare_request(next_link) + + pipeline_response = await self._client._pipeline.run(request, stream=False, **kwargs) + response = pipeline_response.http_response + + if response.status_code not in [200]: + map_error(status_code=response.status_code, response=response, error_map=error_map) + raise HttpResponseError(response=response, error_format=ARMErrorFormat) + + return pipeline_response + + return AsyncItemPaged( + get_next, extract_data + ) + list_by_incident.metadata = {'url': '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/comments'} + + async def get_comment( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + incident_comment_id: str, + **kwargs + ) -> "models.IncidentComment": + """Gets an incident comment. + + :param resource_group_name: The name of the resource group within the user's subscription. The + name is case insensitive. + :type resource_group_name: str + :param workspace_name: The name of the workspace. + :type workspace_name: str + :param incident_id: Incident ID. + :type incident_id: str + :param incident_comment_id: Incident comment ID. + :type incident_comment_id: str + :keyword callable cls: A custom type or function that will be passed the direct response + :return: IncidentComment or the result of cls(response) + :rtype: ~azure.mgmt.securityinsight.models.IncidentComment + :raises: ~azure.core.exceptions.HttpResponseError + """ + cls = kwargs.pop('cls', None) # type: ClsType["models.IncidentComment"] + error_map = kwargs.pop('error_map', {404: ResourceNotFoundError, 409: ResourceExistsError}) + api_version = "2020-01-01" + + # Construct URL + url = self.get_comment.metadata['url'] + path_format_arguments = { + 'subscriptionId': self._serialize.url("self._config.subscription_id", self._config.subscription_id, 'str', pattern=r'^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$'), + 'resourceGroupName': self._serialize.url("resource_group_name", resource_group_name, 'str', max_length=90, min_length=1, pattern=r'^[-\w\._\(\)]+$'), + 'workspaceName': self._serialize.url("workspace_name", workspace_name, 'str', max_length=90, min_length=1), + 'incidentId': self._serialize.url("incident_id", incident_id, 'str'), + 'incidentCommentId': self._serialize.url("incident_comment_id", incident_comment_id, 'str'), + } + url = self._client.format_url(url, **path_format_arguments) + + # Construct parameters + query_parameters = {} # type: Dict[str, Any] + query_parameters['api-version'] = self._serialize.query("api_version", api_version, 'str') + + # Construct headers + header_parameters = {} # type: Dict[str, Any] + header_parameters['Accept'] = 'application/json' + + # Construct and send request + request = self._client.get(url, query_parameters, header_parameters) + pipeline_response = await self._client._pipeline.run(request, stream=False, **kwargs) + response = pipeline_response.http_response + + if response.status_code not in [200]: + map_error(status_code=response.status_code, response=response, error_map=error_map) + raise HttpResponseError(response=response, error_format=ARMErrorFormat) + + deserialized = self._deserialize('IncidentComment', pipeline_response) + + if cls: + return cls(pipeline_response, deserialized, {}) + + return deserialized + get_comment.metadata = {'url': '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/comments/{incidentCommentId}'} + + async def create_comment( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + incident_comment_id: str, + message: Optional[str] = None, + **kwargs + ) -> "models.IncidentComment": + """Creates the incident comment. + + :param resource_group_name: The name of the resource group within the user's subscription. The + name is case insensitive. + :type resource_group_name: str + :param workspace_name: The name of the workspace. + :type workspace_name: str + :param incident_id: Incident ID. + :type incident_id: str + :param incident_comment_id: Incident comment ID. + :type incident_comment_id: str + :param message: The comment message. + :type message: str + :keyword callable cls: A custom type or function that will be passed the direct response + :return: IncidentComment or the result of cls(response) + :rtype: ~azure.mgmt.securityinsight.models.IncidentComment + :raises: ~azure.core.exceptions.HttpResponseError + """ + cls = kwargs.pop('cls', None) # type: ClsType["models.IncidentComment"] + error_map = kwargs.pop('error_map', {404: ResourceNotFoundError, 409: ResourceExistsError}) + + _incident_comment = models.IncidentComment(message=message) + api_version = "2020-01-01" + content_type = kwargs.pop("content_type", "application/json") + + # Construct URL + url = self.create_comment.metadata['url'] + path_format_arguments = { + 'subscriptionId': self._serialize.url("self._config.subscription_id", self._config.subscription_id, 'str', pattern=r'^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$'), + 'resourceGroupName': self._serialize.url("resource_group_name", resource_group_name, 'str', max_length=90, min_length=1, pattern=r'^[-\w\._\(\)]+$'), + 'workspaceName': self._serialize.url("workspace_name", workspace_name, 'str', max_length=90, min_length=1), + 'incidentId': self._serialize.url("incident_id", incident_id, 'str'), + 'incidentCommentId': self._serialize.url("incident_comment_id", incident_comment_id, 'str'), + } + url = self._client.format_url(url, **path_format_arguments) + + # Construct parameters + query_parameters = {} # type: Dict[str, Any] + query_parameters['api-version'] = self._serialize.query("api_version", api_version, 'str') + + # Construct headers + header_parameters = {} # type: Dict[str, Any] + header_parameters['Content-Type'] = self._serialize.header("content_type", content_type, 'str') + header_parameters['Accept'] = 'application/json' + + # Construct and send request + body_content_kwargs = {} # type: Dict[str, Any] + body_content = self._serialize.body(_incident_comment, 'IncidentComment') + body_content_kwargs['content'] = body_content + request = self._client.put(url, query_parameters, header_parameters, **body_content_kwargs) + + pipeline_response = await self._client._pipeline.run(request, stream=False, **kwargs) + response = pipeline_response.http_response + + if response.status_code not in [201]: + map_error(status_code=response.status_code, response=response, error_map=error_map) + raise HttpResponseError(response=response, error_format=ARMErrorFormat) + + deserialized = self._deserialize('IncidentComment', pipeline_response) + + if cls: + return cls(pipeline_response, deserialized, {}) + + return deserialized + create_comment.metadata = {'url': '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/comments/{incidentCommentId}'} diff --git a/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/aio/operations_async/_incident_operations_async.py b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/aio/operations_async/_incident_operations_async.py new file mode 100644 index 00000000000..35d4313c5b8 --- /dev/null +++ b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/aio/operations_async/_incident_operations_async.py @@ -0,0 +1,361 @@ +# coding=utf-8 +# -------------------------------------------------------------------------- +# Copyright (c) Microsoft Corporation. All rights reserved. +# Licensed under the MIT License. See License.txt in the project root for license information. +# Code generated by Microsoft (R) AutoRest Code Generator. +# Changes may cause incorrect behavior and will be lost if the code is regenerated. +# -------------------------------------------------------------------------- +import datetime +from typing import Any, Callable, Dict, Generic, List, Optional, TypeVar, Union +import warnings + +from azure.core.async_paging import AsyncItemPaged, AsyncList +from azure.core.exceptions import HttpResponseError, ResourceExistsError, ResourceNotFoundError, map_error +from azure.core.pipeline import PipelineResponse +from azure.core.pipeline.transport import AsyncHttpResponse, HttpRequest +from azure.mgmt.core.exceptions import ARMErrorFormat + +from ... import models + +T = TypeVar('T') +ClsType = Optional[Callable[[PipelineResponse[HttpRequest, AsyncHttpResponse], T, Dict[str, Any]], Any]] + +class IncidentOperations: + """IncidentOperations async operations. + + You should not instantiate this class directly. Instead, you should create a Client instance that + instantiates it for you and attaches it as an attribute. + + :ivar models: Alias to model classes used in this operation group. + :type models: ~azure.mgmt.securityinsight.models + :param client: Client for service requests. + :param config: Configuration of service client. + :param serializer: An object model serializer. + :param deserializer: An object model deserializer. + """ + + models = models + + def __init__(self, client, config, serializer, deserializer) -> None: + self._client = client + self._serialize = serializer + self._deserialize = deserializer + self._config = config + + def list( + self, + resource_group_name: str, + workspace_name: str, + filter: Optional[str] = None, + orderby: Optional[str] = None, + top: Optional[int] = None, + skip_token: Optional[str] = None, + **kwargs + ) -> "models.IncidentList": + """Gets all incidents. + + :param resource_group_name: The name of the resource group within the user's subscription. The + name is case insensitive. + :type resource_group_name: str + :param workspace_name: The name of the workspace. + :type workspace_name: str + :param filter: Filters the results, based on a Boolean condition. Optional. + :type filter: str + :param orderby: Sorts the results. Optional. + :type orderby: str + :param top: Returns only the first n results. Optional. + :type top: int + :param skip_token: Skiptoken is only used if a previous operation returned a partial result. If + a previous response contains a nextLink element, the value of the nextLink element will include + a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional. + :type skip_token: str + :keyword callable cls: A custom type or function that will be passed the direct response + :return: IncidentList or the result of cls(response) + :rtype: ~azure.mgmt.securityinsight.models.IncidentList + :raises: ~azure.core.exceptions.HttpResponseError + """ + cls = kwargs.pop('cls', None) # type: ClsType["models.IncidentList"] + error_map = kwargs.pop('error_map', {404: ResourceNotFoundError, 409: ResourceExistsError}) + api_version = "2020-01-01" + + def prepare_request(next_link=None): + if not next_link: + # Construct URL + url = self.list.metadata['url'] + path_format_arguments = { + 'subscriptionId': self._serialize.url("self._config.subscription_id", self._config.subscription_id, 'str', pattern=r'^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$'), + 'resourceGroupName': self._serialize.url("resource_group_name", resource_group_name, 'str', max_length=90, min_length=1, pattern=r'^[-\w\._\(\)]+$'), + 'workspaceName': self._serialize.url("workspace_name", workspace_name, 'str', max_length=90, min_length=1), + } + url = self._client.format_url(url, **path_format_arguments) + else: + url = next_link + + # Construct parameters + query_parameters = {} # type: Dict[str, Any] + query_parameters['api-version'] = self._serialize.query("api_version", api_version, 'str') + if filter is not None: + query_parameters['$filter'] = self._serialize.query("filter", filter, 'str') + if orderby is not None: + query_parameters['$orderby'] = self._serialize.query("orderby", orderby, 'str') + if top is not None: + query_parameters['$top'] = self._serialize.query("top", top, 'int') + if skip_token is not None: + query_parameters['$skipToken'] = self._serialize.query("skip_token", skip_token, 'str') + + # Construct headers + header_parameters = {} # type: Dict[str, Any] + header_parameters['Accept'] = 'application/json' + + # Construct and send request + request = self._client.get(url, query_parameters, header_parameters) + return request + + async def extract_data(pipeline_response): + deserialized = self._deserialize('IncidentList', pipeline_response) + list_of_elem = deserialized.value + if cls: + list_of_elem = cls(list_of_elem) + return deserialized.next_link or None, AsyncList(list_of_elem) + + async def get_next(next_link=None): + request = prepare_request(next_link) + + pipeline_response = await self._client._pipeline.run(request, stream=False, **kwargs) + response = pipeline_response.http_response + + if response.status_code not in [200]: + map_error(status_code=response.status_code, response=response, error_map=error_map) + raise HttpResponseError(response=response, error_format=ARMErrorFormat) + + return pipeline_response + + return AsyncItemPaged( + get_next, extract_data + ) + list.metadata = {'url': '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents'} + + async def get( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + **kwargs + ) -> "models.Incident": + """Gets an incident. + + :param resource_group_name: The name of the resource group within the user's subscription. The + name is case insensitive. + :type resource_group_name: str + :param workspace_name: The name of the workspace. + :type workspace_name: str + :param incident_id: Incident ID. + :type incident_id: str + :keyword callable cls: A custom type or function that will be passed the direct response + :return: Incident or the result of cls(response) + :rtype: ~azure.mgmt.securityinsight.models.Incident + :raises: ~azure.core.exceptions.HttpResponseError + """ + cls = kwargs.pop('cls', None) # type: ClsType["models.Incident"] + error_map = kwargs.pop('error_map', {404: ResourceNotFoundError, 409: ResourceExistsError}) + api_version = "2020-01-01" + + # Construct URL + url = self.get.metadata['url'] + path_format_arguments = { + 'subscriptionId': self._serialize.url("self._config.subscription_id", self._config.subscription_id, 'str', pattern=r'^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$'), + 'resourceGroupName': self._serialize.url("resource_group_name", resource_group_name, 'str', max_length=90, min_length=1, pattern=r'^[-\w\._\(\)]+$'), + 'workspaceName': self._serialize.url("workspace_name", workspace_name, 'str', max_length=90, min_length=1), + 'incidentId': self._serialize.url("incident_id", incident_id, 'str'), + } + url = self._client.format_url(url, **path_format_arguments) + + # Construct parameters + query_parameters = {} # type: Dict[str, Any] + query_parameters['api-version'] = self._serialize.query("api_version", api_version, 'str') + + # Construct headers + header_parameters = {} # type: Dict[str, Any] + header_parameters['Accept'] = 'application/json' + + # Construct and send request + request = self._client.get(url, query_parameters, header_parameters) + pipeline_response = await self._client._pipeline.run(request, stream=False, **kwargs) + response = pipeline_response.http_response + + if response.status_code not in [200]: + map_error(status_code=response.status_code, response=response, error_map=error_map) + raise HttpResponseError(response=response, error_format=ARMErrorFormat) + + deserialized = self._deserialize('Incident', pipeline_response) + + if cls: + return cls(pipeline_response, deserialized, {}) + + return deserialized + get.metadata = {'url': '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}'} + + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + etag: Optional[str] = None, + classification: Optional[Union[str, "models.IncidentClassification"]] = None, + classification_comment: Optional[str] = None, + classification_reason: Optional[Union[str, "models.IncidentClassificationReason"]] = None, + description: Optional[str] = None, + first_activity_time_utc: Optional[datetime.datetime] = None, + labels: Optional[List["IncidentLabel"]] = None, + last_activity_time_utc: Optional[datetime.datetime] = None, + owner: Optional["models.IncidentOwnerInfo"] = None, + severity: Optional[Union[str, "models.IncidentSeverity"]] = None, + status: Optional[Union[str, "models.IncidentStatus"]] = None, + title: Optional[str] = None, + **kwargs + ) -> "models.Incident": + """Creates or updates the incident. + + :param resource_group_name: The name of the resource group within the user's subscription. The + name is case insensitive. + :type resource_group_name: str + :param workspace_name: The name of the workspace. + :type workspace_name: str + :param incident_id: Incident ID. + :type incident_id: str + :param etag: Etag of the azure resource. + :type etag: str + :param classification: The reason the incident was closed. + :type classification: str or ~azure.mgmt.securityinsight.models.IncidentClassification + :param classification_comment: Describes the reason the incident was closed. + :type classification_comment: str + :param classification_reason: The classification reason the incident was closed with. + :type classification_reason: str or ~azure.mgmt.securityinsight.models.IncidentClassificationReason + :param description: The description of the incident. + :type description: str + :param first_activity_time_utc: The time of the first activity in the incident. + :type first_activity_time_utc: ~datetime.datetime + :param labels: List of labels relevant to this incident. + :type labels: list[~azure.mgmt.securityinsight.models.IncidentLabel] + :param last_activity_time_utc: The time of the last activity in the incident. + :type last_activity_time_utc: ~datetime.datetime + :param owner: Describes a user that the incident is assigned to. + :type owner: ~azure.mgmt.securityinsight.models.IncidentOwnerInfo + :param severity: The severity of the incident. + :type severity: str or ~azure.mgmt.securityinsight.models.IncidentSeverity + :param status: The status of the incident. + :type status: str or ~azure.mgmt.securityinsight.models.IncidentStatus + :param title: The title of the incident. + :type title: str + :keyword callable cls: A custom type or function that will be passed the direct response + :return: Incident or the result of cls(response) + :rtype: ~azure.mgmt.securityinsight.models.Incident or ~azure.mgmt.securityinsight.models.Incident + :raises: ~azure.core.exceptions.HttpResponseError + """ + cls = kwargs.pop('cls', None) # type: ClsType["models.Incident"] + error_map = kwargs.pop('error_map', {404: ResourceNotFoundError, 409: ResourceExistsError}) + + _incident = models.Incident(etag=etag, classification=classification, classification_comment=classification_comment, classification_reason=classification_reason, description=description, first_activity_time_utc=first_activity_time_utc, labels=labels, last_activity_time_utc=last_activity_time_utc, owner=owner, severity=severity, status=status, title=title) + api_version = "2020-01-01" + content_type = kwargs.pop("content_type", "application/json") + + # Construct URL + url = self.create_or_update.metadata['url'] + path_format_arguments = { + 'subscriptionId': self._serialize.url("self._config.subscription_id", self._config.subscription_id, 'str', pattern=r'^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$'), + 'resourceGroupName': self._serialize.url("resource_group_name", resource_group_name, 'str', max_length=90, min_length=1, pattern=r'^[-\w\._\(\)]+$'), + 'workspaceName': self._serialize.url("workspace_name", workspace_name, 'str', max_length=90, min_length=1), + 'incidentId': self._serialize.url("incident_id", incident_id, 'str'), + } + url = self._client.format_url(url, **path_format_arguments) + + # Construct parameters + query_parameters = {} # type: Dict[str, Any] + query_parameters['api-version'] = self._serialize.query("api_version", api_version, 'str') + + # Construct headers + header_parameters = {} # type: Dict[str, Any] + header_parameters['Content-Type'] = self._serialize.header("content_type", content_type, 'str') + header_parameters['Accept'] = 'application/json' + + # Construct and send request + body_content_kwargs = {} # type: Dict[str, Any] + body_content = self._serialize.body(_incident, 'Incident') + body_content_kwargs['content'] = body_content + request = self._client.put(url, query_parameters, header_parameters, **body_content_kwargs) + + pipeline_response = await self._client._pipeline.run(request, stream=False, **kwargs) + response = pipeline_response.http_response + + if response.status_code not in [200, 201]: + map_error(status_code=response.status_code, response=response, error_map=error_map) + raise HttpResponseError(response=response, error_format=ARMErrorFormat) + + deserialized = None + if response.status_code == 200: + deserialized = self._deserialize('Incident', pipeline_response) + + if response.status_code == 201: + deserialized = self._deserialize('Incident', pipeline_response) + + if cls: + return cls(pipeline_response, deserialized, {}) + + return deserialized + create_or_update.metadata = {'url': '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}'} + + async def delete( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + **kwargs + ) -> None: + """Delete the incident. + + :param resource_group_name: The name of the resource group within the user's subscription. The + name is case insensitive. + :type resource_group_name: str + :param workspace_name: The name of the workspace. + :type workspace_name: str + :param incident_id: Incident ID. + :type incident_id: str + :keyword callable cls: A custom type or function that will be passed the direct response + :return: None or the result of cls(response) + :rtype: None + :raises: ~azure.core.exceptions.HttpResponseError + """ + cls = kwargs.pop('cls', None) # type: ClsType[None] + error_map = kwargs.pop('error_map', {404: ResourceNotFoundError, 409: ResourceExistsError}) + api_version = "2020-01-01" + + # Construct URL + url = self.delete.metadata['url'] + path_format_arguments = { + 'subscriptionId': self._serialize.url("self._config.subscription_id", self._config.subscription_id, 'str', pattern=r'^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$'), + 'resourceGroupName': self._serialize.url("resource_group_name", resource_group_name, 'str', max_length=90, min_length=1, pattern=r'^[-\w\._\(\)]+$'), + 'workspaceName': self._serialize.url("workspace_name", workspace_name, 'str', max_length=90, min_length=1), + 'incidentId': self._serialize.url("incident_id", incident_id, 'str'), + } + url = self._client.format_url(url, **path_format_arguments) + + # Construct parameters + query_parameters = {} # type: Dict[str, Any] + query_parameters['api-version'] = self._serialize.query("api_version", api_version, 'str') + + # Construct headers + header_parameters = {} # type: Dict[str, Any] + + # Construct and send request + request = self._client.delete(url, query_parameters, header_parameters) + pipeline_response = await self._client._pipeline.run(request, stream=False, **kwargs) + response = pipeline_response.http_response + + if response.status_code not in [200, 204]: + map_error(status_code=response.status_code, response=response, error_map=error_map) + raise HttpResponseError(response=response, error_format=ARMErrorFormat) + + if cls: + return cls(pipeline_response, None, {}) + + delete.metadata = {'url': '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}'} diff --git a/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/models/__init__.py b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/models/__init__.py index 6c372e7a5b4..86be1a2aaae 100644 --- a/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/models/__init__.py +++ b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/models/__init__.py @@ -22,6 +22,7 @@ from ._models_py3 import AlertRuleTemplate from ._models_py3 import AlertRuleTemplateDataSource from ._models_py3 import AlertRuleTemplatePropertiesBase + from ._models_py3 import AlertRuleTemplatesList from ._models_py3 import AlertRulesList from ._models_py3 import AlertsDataTypeOfDataConnector from ._models_py3 import AlertsDataTypeOfDataConnectorAlerts @@ -30,6 +31,9 @@ from ._models_py3 import AwsCloudTrailDataConnector from ._models_py3 import AwsCloudTrailDataConnectorDataTypes from ._models_py3 import AwsCloudTrailDataConnectorDataTypesLogs + from ._models_py3 import Bookmark + from ._models_py3 import BookmarkList + from ._models_py3 import ClientInfo from ._models_py3 import DataConnector from ._models_py3 import DataConnectorDataTypeCommon from ._models_py3 import DataConnectorKind @@ -39,7 +43,14 @@ from ._models_py3 import FusionAlertRule from ._models_py3 import FusionAlertRuleTemplate from ._models_py3 import FusionAlertRuleTemplateProperties + from ._models_py3 import Incident + from ._models_py3 import IncidentAdditionalData + from ._models_py3 import IncidentComment + from ._models_py3 import IncidentCommentList from ._models_py3 import IncidentInfo + from ._models_py3 import IncidentLabel + from ._models_py3 import IncidentList + from ._models_py3 import IncidentOwnerInfo from ._models_py3 import McasDataConnector from ._models_py3 import McasDataConnectorDataTypes from ._models_py3 import McasDataConnectorDataTypesDiscoveryLogs @@ -94,6 +105,7 @@ from ._models import AlertRuleTemplate # type: ignore from ._models import AlertRuleTemplateDataSource # type: ignore from ._models import AlertRuleTemplatePropertiesBase # type: ignore + from ._models import AlertRuleTemplatesList # type: ignore from ._models import AlertRulesList # type: ignore from ._models import AlertsDataTypeOfDataConnector # type: ignore from ._models import AlertsDataTypeOfDataConnectorAlerts # type: ignore @@ -102,6 +114,9 @@ from ._models import AwsCloudTrailDataConnector # type: ignore from ._models import AwsCloudTrailDataConnectorDataTypes # type: ignore from ._models import AwsCloudTrailDataConnectorDataTypesLogs # type: ignore + from ._models import Bookmark # type: ignore + from ._models import BookmarkList # type: ignore + from ._models import ClientInfo # type: ignore from ._models import DataConnector # type: ignore from ._models import DataConnectorDataTypeCommon # type: ignore from ._models import DataConnectorKind # type: ignore @@ -111,7 +126,14 @@ from ._models import FusionAlertRule # type: ignore from ._models import FusionAlertRuleTemplate # type: ignore from ._models import FusionAlertRuleTemplateProperties # type: ignore + from ._models import Incident # type: ignore + from ._models import IncidentAdditionalData # type: ignore + from ._models import IncidentComment # type: ignore + from ._models import IncidentCommentList # type: ignore from ._models import IncidentInfo # type: ignore + from ._models import IncidentLabel # type: ignore + from ._models import IncidentList # type: ignore + from ._models import IncidentOwnerInfo # type: ignore from ._models import McasDataConnector # type: ignore from ._models import McasDataConnectorDataTypes # type: ignore from ._models import McasDataConnectorDataTypesDiscoveryLogs # type: ignore @@ -155,9 +177,14 @@ AlertRuleKindEnum, AlertSeverity, AttackTactic, + CaseSeverity, DataConnectorKindEnum, DataTypeState, + IncidentClassification, + IncidentClassificationReason, + IncidentLabelType, IncidentSeverity, + IncidentStatus, LicenseStatus, MicrosoftSecurityProductName, SettingKind, @@ -182,6 +209,7 @@ 'AlertRuleTemplate', 'AlertRuleTemplateDataSource', 'AlertRuleTemplatePropertiesBase', + 'AlertRuleTemplatesList', 'AlertRulesList', 'AlertsDataTypeOfDataConnector', 'AlertsDataTypeOfDataConnectorAlerts', @@ -190,6 +218,9 @@ 'AwsCloudTrailDataConnector', 'AwsCloudTrailDataConnectorDataTypes', 'AwsCloudTrailDataConnectorDataTypesLogs', + 'Bookmark', + 'BookmarkList', + 'ClientInfo', 'DataConnector', 'DataConnectorDataTypeCommon', 'DataConnectorKind', @@ -199,7 +230,14 @@ 'FusionAlertRule', 'FusionAlertRuleTemplate', 'FusionAlertRuleTemplateProperties', + 'Incident', + 'IncidentAdditionalData', + 'IncidentComment', + 'IncidentCommentList', 'IncidentInfo', + 'IncidentLabel', + 'IncidentList', + 'IncidentOwnerInfo', 'McasDataConnector', 'McasDataConnectorDataTypes', 'McasDataConnectorDataTypesDiscoveryLogs', @@ -241,9 +279,14 @@ 'AlertRuleKindEnum', 'AlertSeverity', 'AttackTactic', + 'CaseSeverity', 'DataConnectorKindEnum', 'DataTypeState', + 'IncidentClassification', + 'IncidentClassificationReason', + 'IncidentLabelType', 'IncidentSeverity', + 'IncidentStatus', 'LicenseStatus', 'MicrosoftSecurityProductName', 'SettingKind', diff --git a/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/models/_models.py b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/models/_models.py index 18fb9bc0952..897403eabd7 100644 --- a/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/models/_models.py +++ b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/models/_models.py @@ -170,8 +170,9 @@ class ActionPropertiesBase(msrest.serialization.Model): All required parameters must be populated in order to send to Azure. - :param logic_app_resource_id: Required. Logic App Resource Id, - providers/Microsoft.Logic/workflows/{WorkflowID}. + :param logic_app_resource_id: Required. Logic App Resource Id, /subscriptions/{my- + subscription}/resourceGroups/{my-resource-group}/providers/Microsoft.Logic/workflows/{my- + workflow-id}. :type logic_app_resource_id: str """ @@ -243,8 +244,9 @@ class ActionRequest(ResourceWithEtag): :vartype type: str :param etag: Etag of the azure resource. :type etag: str - :param logic_app_resource_id: Logic App Resource Id, - providers/Microsoft.Logic/workflows/{WorkflowID}. + :param logic_app_resource_id: Logic App Resource Id, /subscriptions/{my- + subscription}/resourceGroups/{my-resource-group}/providers/Microsoft.Logic/workflows/{my- + workflow-id}. :type logic_app_resource_id: str :param trigger_uri: Logic App Callback URL for this specific workflow. :type trigger_uri: str @@ -279,8 +281,9 @@ class ActionRequestProperties(ActionPropertiesBase): All required parameters must be populated in order to send to Azure. - :param logic_app_resource_id: Required. Logic App Resource Id, - providers/Microsoft.Logic/workflows/{WorkflowID}. + :param logic_app_resource_id: Required. Logic App Resource Id, /subscriptions/{my- + subscription}/resourceGroups/{my-resource-group}/providers/Microsoft.Logic/workflows/{my- + workflow-id}. :type logic_app_resource_id: str :param trigger_uri: Logic App Callback URL for this specific workflow. :type trigger_uri: str @@ -351,8 +354,9 @@ class ActionResponse(Resource): :vartype type: str :param etag: Etag of the action. :type etag: str - :param logic_app_resource_id: Logic App Resource Id, - providers/Microsoft.Logic/workflows/{WorkflowID}. + :param logic_app_resource_id: Logic App Resource Id, /subscriptions/{my- + subscription}/resourceGroups/{my-resource-group}/providers/Microsoft.Logic/workflows/{my- + workflow-id}. :type logic_app_resource_id: str :param workflow_id: The name of the logic app's workflow. :type workflow_id: str @@ -388,8 +392,9 @@ class ActionResponseProperties(ActionPropertiesBase): All required parameters must be populated in order to send to Azure. - :param logic_app_resource_id: Required. Logic App Resource Id, - providers/Microsoft.Logic/workflows/{WorkflowID}. + :param logic_app_resource_id: Required. Logic App Resource Id, /subscriptions/{my- + subscription}/resourceGroups/{my-resource-group}/providers/Microsoft.Logic/workflows/{my- + workflow-id}. :type logic_app_resource_id: str :param workflow_id: The name of the logic app's workflow. :type workflow_id: str @@ -623,6 +628,38 @@ def __init__( self.status = kwargs.get('status', None) +class AlertRuleTemplatesList(msrest.serialization.Model): + """List all the alert rule templates. + + Variables are only populated by the server, and will be ignored when sending a request. + + All required parameters must be populated in order to send to Azure. + + :ivar next_link: URL to fetch the next set of alert rule templates. + :vartype next_link: str + :param value: Required. Array of alert rule templates. + :type value: list[~azure.mgmt.securityinsight.models.AlertRuleTemplate] + """ + + _validation = { + 'next_link': {'readonly': True}, + 'value': {'required': True}, + } + + _attribute_map = { + 'next_link': {'key': 'nextLink', 'type': 'str'}, + 'value': {'key': 'value', 'type': '[AlertRuleTemplate]'}, + } + + def __init__( + self, + **kwargs + ): + super(AlertRuleTemplatesList, self).__init__(**kwargs) + self.next_link = None + self.value = kwargs['value'] + + class AlertsDataTypeOfDataConnector(msrest.serialization.Model): """Alerts data type for data connectors. @@ -800,6 +837,144 @@ def __init__( super(AwsCloudTrailDataConnectorDataTypesLogs, self).__init__(**kwargs) +class Bookmark(ResourceWithEtag): + """Represents a bookmark in Azure Security Insights. + + Variables are only populated by the server, and will be ignored when sending a request. + + :ivar id: Azure resource Id. + :vartype id: str + :ivar name: Azure resource name. + :vartype name: str + :ivar type: Azure resource type. + :vartype type: str + :param etag: Etag of the azure resource. + :type etag: str + :param created: The time the bookmark was created. + :type created: ~datetime.datetime + :param created_by: Describes a user that created the bookmark. + :type created_by: ~azure.mgmt.securityinsight.models.UserInfo + :param display_name: The display name of the bookmark. + :type display_name: str + :param labels: List of labels relevant to this bookmark. + :type labels: list[str] + :param notes: The notes of the bookmark. + :type notes: str + :param query: The query of the bookmark. + :type query: str + :param query_result: The query result of the bookmark. + :type query_result: str + :param updated: The last time the bookmark was updated. + :type updated: ~datetime.datetime + :param updated_by: Describes a user that updated the bookmark. + :type updated_by: ~azure.mgmt.securityinsight.models.UserInfo + :param incident_info: Describes an incident that relates to bookmark. + :type incident_info: ~azure.mgmt.securityinsight.models.IncidentInfo + """ + + _validation = { + 'id': {'readonly': True}, + 'name': {'readonly': True}, + 'type': {'readonly': True}, + } + + _attribute_map = { + 'id': {'key': 'id', 'type': 'str'}, + 'name': {'key': 'name', 'type': 'str'}, + 'type': {'key': 'type', 'type': 'str'}, + 'etag': {'key': 'etag', 'type': 'str'}, + 'created': {'key': 'properties.created', 'type': 'iso-8601'}, + 'created_by': {'key': 'properties.createdBy', 'type': 'UserInfo'}, + 'display_name': {'key': 'properties.displayName', 'type': 'str'}, + 'labels': {'key': 'properties.labels', 'type': '[str]'}, + 'notes': {'key': 'properties.notes', 'type': 'str'}, + 'query': {'key': 'properties.query', 'type': 'str'}, + 'query_result': {'key': 'properties.queryResult', 'type': 'str'}, + 'updated': {'key': 'properties.updated', 'type': 'iso-8601'}, + 'updated_by': {'key': 'properties.updatedBy', 'type': 'UserInfo'}, + 'incident_info': {'key': 'properties.incidentInfo', 'type': 'IncidentInfo'}, + } + + def __init__( + self, + **kwargs + ): + super(Bookmark, self).__init__(**kwargs) + self.created = kwargs.get('created', None) + self.created_by = kwargs.get('created_by', None) + self.display_name = kwargs.get('display_name', None) + self.labels = kwargs.get('labels', None) + self.notes = kwargs.get('notes', None) + self.query = kwargs.get('query', None) + self.query_result = kwargs.get('query_result', None) + self.updated = kwargs.get('updated', None) + self.updated_by = kwargs.get('updated_by', None) + self.incident_info = kwargs.get('incident_info', None) + + +class BookmarkList(msrest.serialization.Model): + """List all the bookmarks. + + Variables are only populated by the server, and will be ignored when sending a request. + + All required parameters must be populated in order to send to Azure. + + :ivar next_link: URL to fetch the next set of cases. + :vartype next_link: str + :param value: Required. Array of bookmarks. + :type value: list[~azure.mgmt.securityinsight.models.Bookmark] + """ + + _validation = { + 'next_link': {'readonly': True}, + 'value': {'required': True}, + } + + _attribute_map = { + 'next_link': {'key': 'nextLink', 'type': 'str'}, + 'value': {'key': 'value', 'type': '[Bookmark]'}, + } + + def __init__( + self, + **kwargs + ): + super(BookmarkList, self).__init__(**kwargs) + self.next_link = None + self.value = kwargs['value'] + + +class ClientInfo(msrest.serialization.Model): + """Information on the client (user or application) that made some action. + + :param email: The email of the client. + :type email: str + :param name: The name of the client. + :type name: str + :param object_id: The object id of the client. + :type object_id: str + :param user_principal_name: The user principal name of the client. + :type user_principal_name: str + """ + + _attribute_map = { + 'email': {'key': 'email', 'type': 'str'}, + 'name': {'key': 'name', 'type': 'str'}, + 'object_id': {'key': 'objectId', 'type': 'str'}, + 'user_principal_name': {'key': 'userPrincipalName', 'type': 'str'}, + } + + def __init__( + self, + **kwargs + ): + super(ClientInfo, self).__init__(**kwargs) + self.email = kwargs.get('email', None) + self.name = kwargs.get('name', None) + self.object_id = kwargs.get('object_id', None) + self.user_principal_name = kwargs.get('user_principal_name', None) + + class DataConnectorList(msrest.serialization.Model): """List all the data connectors. @@ -1030,6 +1205,244 @@ def __init__( self.tactics = kwargs.get('tactics', None) +class Incident(ResourceWithEtag): + """Represents an incident in Azure Security Insights. + + Variables are only populated by the server, and will be ignored when sending a request. + + :ivar id: Azure resource Id. + :vartype id: str + :ivar name: Azure resource name. + :vartype name: str + :ivar type: Azure resource type. + :vartype type: str + :param etag: Etag of the azure resource. + :type etag: str + :ivar additional_data: Additional data on the incident. + :vartype additional_data: ~azure.mgmt.securityinsight.models.IncidentAdditionalData + :param classification: The reason the incident was closed. Possible values include: + "Undetermined", "TruePositive", "BenignPositive", "FalsePositive". + :type classification: str or ~azure.mgmt.securityinsight.models.IncidentClassification + :param classification_comment: Describes the reason the incident was closed. + :type classification_comment: str + :param classification_reason: The classification reason the incident was closed with. Possible + values include: "SuspiciousActivity", "SuspiciousButExpected", "IncorrectAlertLogic", + "InaccurateData". + :type classification_reason: str or + ~azure.mgmt.securityinsight.models.IncidentClassificationReason + :ivar created_time_utc: The time the incident was created. + :vartype created_time_utc: ~datetime.datetime + :param description: The description of the incident. + :type description: str + :param first_activity_time_utc: The time of the first activity in the incident. + :type first_activity_time_utc: ~datetime.datetime + :ivar incident_url: The deep-link url to the incident in Azure portal. + :vartype incident_url: str + :ivar incident_number: A sequential number. + :vartype incident_number: int + :param labels: List of labels relevant to this incident. + :type labels: list[~azure.mgmt.securityinsight.models.IncidentLabel] + :param last_activity_time_utc: The time of the last activity in the incident. + :type last_activity_time_utc: ~datetime.datetime + :ivar last_modified_time_utc: The last time the incident was updated. + :vartype last_modified_time_utc: ~datetime.datetime + :param owner: Describes a user that the incident is assigned to. + :type owner: ~azure.mgmt.securityinsight.models.IncidentOwnerInfo + :ivar related_analytic_rule_ids: List of resource ids of Analytic rules related to the + incident. + :vartype related_analytic_rule_ids: list[str] + :param severity: The severity of the incident. Possible values include: "High", "Medium", + "Low", "Informational". + :type severity: str or ~azure.mgmt.securityinsight.models.IncidentSeverity + :param status: The status of the incident. Possible values include: "New", "Active", "Closed". + :type status: str or ~azure.mgmt.securityinsight.models.IncidentStatus + :param title: The title of the incident. + :type title: str + """ + + _validation = { + 'id': {'readonly': True}, + 'name': {'readonly': True}, + 'type': {'readonly': True}, + 'additional_data': {'readonly': True}, + 'created_time_utc': {'readonly': True}, + 'incident_url': {'readonly': True}, + 'incident_number': {'readonly': True}, + 'last_modified_time_utc': {'readonly': True}, + 'related_analytic_rule_ids': {'readonly': True}, + } + + _attribute_map = { + 'id': {'key': 'id', 'type': 'str'}, + 'name': {'key': 'name', 'type': 'str'}, + 'type': {'key': 'type', 'type': 'str'}, + 'etag': {'key': 'etag', 'type': 'str'}, + 'additional_data': {'key': 'properties.additionalData', 'type': 'IncidentAdditionalData'}, + 'classification': {'key': 'properties.classification', 'type': 'str'}, + 'classification_comment': {'key': 'properties.classificationComment', 'type': 'str'}, + 'classification_reason': {'key': 'properties.classificationReason', 'type': 'str'}, + 'created_time_utc': {'key': 'properties.createdTimeUtc', 'type': 'iso-8601'}, + 'description': {'key': 'properties.description', 'type': 'str'}, + 'first_activity_time_utc': {'key': 'properties.firstActivityTimeUtc', 'type': 'iso-8601'}, + 'incident_url': {'key': 'properties.incidentUrl', 'type': 'str'}, + 'incident_number': {'key': 'properties.incidentNumber', 'type': 'int'}, + 'labels': {'key': 'properties.labels', 'type': '[IncidentLabel]'}, + 'last_activity_time_utc': {'key': 'properties.lastActivityTimeUtc', 'type': 'iso-8601'}, + 'last_modified_time_utc': {'key': 'properties.lastModifiedTimeUtc', 'type': 'iso-8601'}, + 'owner': {'key': 'properties.owner', 'type': 'IncidentOwnerInfo'}, + 'related_analytic_rule_ids': {'key': 'properties.relatedAnalyticRuleIds', 'type': '[str]'}, + 'severity': {'key': 'properties.severity', 'type': 'str'}, + 'status': {'key': 'properties.status', 'type': 'str'}, + 'title': {'key': 'properties.title', 'type': 'str'}, + } + + def __init__( + self, + **kwargs + ): + super(Incident, self).__init__(**kwargs) + self.additional_data = None + self.classification = kwargs.get('classification', None) + self.classification_comment = kwargs.get('classification_comment', None) + self.classification_reason = kwargs.get('classification_reason', None) + self.created_time_utc = None + self.description = kwargs.get('description', None) + self.first_activity_time_utc = kwargs.get('first_activity_time_utc', None) + self.incident_url = None + self.incident_number = None + self.labels = kwargs.get('labels', None) + self.last_activity_time_utc = kwargs.get('last_activity_time_utc', None) + self.last_modified_time_utc = None + self.owner = kwargs.get('owner', None) + self.related_analytic_rule_ids = None + self.severity = kwargs.get('severity', None) + self.status = kwargs.get('status', None) + self.title = kwargs.get('title', None) + + +class IncidentAdditionalData(msrest.serialization.Model): + """Incident additional data property bag. + + Variables are only populated by the server, and will be ignored when sending a request. + + :ivar alerts_count: The number of alerts in the incident. + :vartype alerts_count: int + :ivar bookmarks_count: The number of bookmarks in the incident. + :vartype bookmarks_count: int + :ivar comments_count: The number of comments in the incident. + :vartype comments_count: int + :ivar alert_product_names: List of product names of alerts in the incident. + :vartype alert_product_names: list[str] + :ivar tactics: The tactics associated with incident. + :vartype tactics: list[str or ~azure.mgmt.securityinsight.models.AttackTactic] + """ + + _validation = { + 'alerts_count': {'readonly': True}, + 'bookmarks_count': {'readonly': True}, + 'comments_count': {'readonly': True}, + 'alert_product_names': {'readonly': True}, + 'tactics': {'readonly': True}, + } + + _attribute_map = { + 'alerts_count': {'key': 'alertsCount', 'type': 'int'}, + 'bookmarks_count': {'key': 'bookmarksCount', 'type': 'int'}, + 'comments_count': {'key': 'commentsCount', 'type': 'int'}, + 'alert_product_names': {'key': 'alertProductNames', 'type': '[str]'}, + 'tactics': {'key': 'tactics', 'type': '[str]'}, + } + + def __init__( + self, + **kwargs + ): + super(IncidentAdditionalData, self).__init__(**kwargs) + self.alerts_count = None + self.bookmarks_count = None + self.comments_count = None + self.alert_product_names = None + self.tactics = None + + +class IncidentComment(Resource): + """Represents an incident comment. + + Variables are only populated by the server, and will be ignored when sending a request. + + :ivar id: Azure resource Id. + :vartype id: str + :ivar name: Azure resource name. + :vartype name: str + :ivar type: Azure resource type. + :vartype type: str + :ivar created_time_utc: The time the comment was created. + :vartype created_time_utc: ~datetime.datetime + :param message: The comment message. + :type message: str + :ivar author: Describes the client that created the comment. + :vartype author: ~azure.mgmt.securityinsight.models.ClientInfo + """ + + _validation = { + 'id': {'readonly': True}, + 'name': {'readonly': True}, + 'type': {'readonly': True}, + 'created_time_utc': {'readonly': True}, + 'author': {'readonly': True}, + } + + _attribute_map = { + 'id': {'key': 'id', 'type': 'str'}, + 'name': {'key': 'name', 'type': 'str'}, + 'type': {'key': 'type', 'type': 'str'}, + 'created_time_utc': {'key': 'properties.createdTimeUtc', 'type': 'iso-8601'}, + 'message': {'key': 'properties.message', 'type': 'str'}, + 'author': {'key': 'properties.author', 'type': 'ClientInfo'}, + } + + def __init__( + self, + **kwargs + ): + super(IncidentComment, self).__init__(**kwargs) + self.created_time_utc = None + self.message = kwargs.get('message', None) + self.author = None + + +class IncidentCommentList(msrest.serialization.Model): + """List of incident comments. + + Variables are only populated by the server, and will be ignored when sending a request. + + All required parameters must be populated in order to send to Azure. + + :ivar next_link: URL to fetch the next set of comments. + :vartype next_link: str + :param value: Required. Array of comments. + :type value: list[~azure.mgmt.securityinsight.models.IncidentComment] + """ + + _validation = { + 'next_link': {'readonly': True}, + 'value': {'required': True}, + } + + _attribute_map = { + 'next_link': {'key': 'nextLink', 'type': 'str'}, + 'value': {'key': 'value', 'type': '[IncidentComment]'}, + } + + def __init__( + self, + **kwargs + ): + super(IncidentCommentList, self).__init__(**kwargs) + self.next_link = None + self.value = kwargs['value'] + + class IncidentInfo(msrest.serialization.Model): """Describes related incident information for the bookmark. @@ -1039,7 +1452,7 @@ class IncidentInfo(msrest.serialization.Model): :type incident_id: str :param severity: Required. The severity of the incident. Possible values include: "Critical", "High", "Medium", "Low", "Informational". - :type severity: str or ~azure.mgmt.securityinsight.models.IncidentSeverity + :type severity: str or ~azure.mgmt.securityinsight.models.CaseSeverity :param title: Required. The title of the incident. :type title: str :param relation_name: Required. Relation Name. @@ -1071,6 +1484,101 @@ def __init__( self.relation_name = kwargs['relation_name'] +class IncidentLabel(msrest.serialization.Model): + """Represents an incident label. + + Variables are only populated by the server, and will be ignored when sending a request. + + All required parameters must be populated in order to send to Azure. + + :param label_name: Required. The name of the label. + :type label_name: str + :ivar label_type: The type of the label. Possible values include: "User", "System". + :vartype label_type: str or ~azure.mgmt.securityinsight.models.IncidentLabelType + """ + + _validation = { + 'label_name': {'required': True}, + 'label_type': {'readonly': True}, + } + + _attribute_map = { + 'label_name': {'key': 'labelName', 'type': 'str'}, + 'label_type': {'key': 'labelType', 'type': 'str'}, + } + + def __init__( + self, + **kwargs + ): + super(IncidentLabel, self).__init__(**kwargs) + self.label_name = kwargs['label_name'] + self.label_type = None + + +class IncidentList(msrest.serialization.Model): + """List all the incidents. + + Variables are only populated by the server, and will be ignored when sending a request. + + All required parameters must be populated in order to send to Azure. + + :ivar next_link: URL to fetch the next set of incidents. + :vartype next_link: str + :param value: Required. Array of incidents. + :type value: list[~azure.mgmt.securityinsight.models.Incident] + """ + + _validation = { + 'next_link': {'readonly': True}, + 'value': {'required': True}, + } + + _attribute_map = { + 'next_link': {'key': 'nextLink', 'type': 'str'}, + 'value': {'key': 'value', 'type': '[Incident]'}, + } + + def __init__( + self, + **kwargs + ): + super(IncidentList, self).__init__(**kwargs) + self.next_link = None + self.value = kwargs['value'] + + +class IncidentOwnerInfo(msrest.serialization.Model): + """Information on the user an incident is assigned to. + + :param email: The email of the user the incident is assigned to. + :type email: str + :param assigned_to: The name of the user the incident is assigned to. + :type assigned_to: str + :param object_id: The object id of the user the incident is assigned to. + :type object_id: str + :param user_principal_name: The user principal name of the user the incident is assigned to. + :type user_principal_name: str + """ + + _attribute_map = { + 'email': {'key': 'email', 'type': 'str'}, + 'assigned_to': {'key': 'assignedTo', 'type': 'str'}, + 'object_id': {'key': 'objectId', 'type': 'str'}, + 'user_principal_name': {'key': 'userPrincipalName', 'type': 'str'}, + } + + def __init__( + self, + **kwargs + ): + super(IncidentOwnerInfo, self).__init__(**kwargs) + self.email = kwargs.get('email', None) + self.assigned_to = kwargs.get('assigned_to', None) + self.object_id = kwargs.get('object_id', None) + self.user_principal_name = kwargs.get('user_principal_name', None) + + class McasDataConnector(DataConnector): """Represents MCAS (Microsoft Cloud App Security) data connector. @@ -1223,6 +1731,9 @@ class MicrosoftSecurityIncidentCreationAlertRule(AlertRule): :type kind: str or ~azure.mgmt.securityinsight.models.AlertRuleKindEnum :param display_names_filter: the alerts' displayNames on which the cases will be generated. :type display_names_filter: list[str] + :param display_names_exclude_filter: the alerts' displayNames on which the cases will not be + generated. + :type display_names_exclude_filter: list[str] :param product_filter: The alerts' productName on which the cases will be generated. Possible values include: "Microsoft Cloud App Security", "Azure Security Center", "Azure Advanced Threat Protection", "Azure Active Directory Identity Protection", "Azure Security Center for IoT". @@ -1249,6 +1760,7 @@ class MicrosoftSecurityIncidentCreationAlertRule(AlertRule): _attribute_map = { 'kind': {'key': 'kind', 'type': 'str'}, 'display_names_filter': {'key': 'properties.displayNamesFilter', 'type': '[str]'}, + 'display_names_exclude_filter': {'key': 'properties.displayNamesExcludeFilter', 'type': '[str]'}, 'product_filter': {'key': 'properties.productFilter', 'type': 'str'}, 'severities_filter': {'key': 'properties.severitiesFilter', 'type': '[str]'}, 'alert_rule_template_name': {'key': 'properties.alertRuleTemplateName', 'type': 'str'}, @@ -1264,6 +1776,7 @@ def __init__( ): super(MicrosoftSecurityIncidentCreationAlertRule, self).__init__(**kwargs) self.display_names_filter = kwargs.get('display_names_filter', None) + self.display_names_exclude_filter = kwargs.get('display_names_exclude_filter', None) self.product_filter = kwargs.get('product_filter', None) self.severities_filter = kwargs.get('severities_filter', None) self.alert_rule_template_name = kwargs.get('alert_rule_template_name', None) @@ -1280,6 +1793,9 @@ class MicrosoftSecurityIncidentCreationAlertRuleCommonProperties(msrest.serializ :param display_names_filter: the alerts' displayNames on which the cases will be generated. :type display_names_filter: list[str] + :param display_names_exclude_filter: the alerts' displayNames on which the cases will not be + generated. + :type display_names_exclude_filter: list[str] :param product_filter: Required. The alerts' productName on which the cases will be generated. Possible values include: "Microsoft Cloud App Security", "Azure Security Center", "Azure Advanced Threat Protection", "Azure Active Directory Identity Protection", "Azure Security @@ -1295,6 +1811,7 @@ class MicrosoftSecurityIncidentCreationAlertRuleCommonProperties(msrest.serializ _attribute_map = { 'display_names_filter': {'key': 'displayNamesFilter', 'type': '[str]'}, + 'display_names_exclude_filter': {'key': 'displayNamesExcludeFilter', 'type': '[str]'}, 'product_filter': {'key': 'productFilter', 'type': 'str'}, 'severities_filter': {'key': 'severitiesFilter', 'type': '[str]'}, } @@ -1305,6 +1822,7 @@ def __init__( ): super(MicrosoftSecurityIncidentCreationAlertRuleCommonProperties, self).__init__(**kwargs) self.display_names_filter = kwargs.get('display_names_filter', None) + self.display_names_exclude_filter = kwargs.get('display_names_exclude_filter', None) self.product_filter = kwargs['product_filter'] self.severities_filter = kwargs.get('severities_filter', None) @@ -1318,6 +1836,9 @@ class MicrosoftSecurityIncidentCreationAlertRuleProperties(MicrosoftSecurityInci :param display_names_filter: the alerts' displayNames on which the cases will be generated. :type display_names_filter: list[str] + :param display_names_exclude_filter: the alerts' displayNames on which the cases will not be + generated. + :type display_names_exclude_filter: list[str] :param product_filter: Required. The alerts' productName on which the cases will be generated. Possible values include: "Microsoft Cloud App Security", "Azure Security Center", "Azure Advanced Threat Protection", "Azure Active Directory Identity Protection", "Azure Security @@ -1346,6 +1867,7 @@ class MicrosoftSecurityIncidentCreationAlertRuleProperties(MicrosoftSecurityInci _attribute_map = { 'display_names_filter': {'key': 'displayNamesFilter', 'type': '[str]'}, + 'display_names_exclude_filter': {'key': 'displayNamesExcludeFilter', 'type': '[str]'}, 'product_filter': {'key': 'productFilter', 'type': 'str'}, 'severities_filter': {'key': 'severitiesFilter', 'type': '[str]'}, 'alert_rule_template_name': {'key': 'alertRuleTemplateName', 'type': 'str'}, @@ -1394,6 +1916,9 @@ class MicrosoftSecurityIncidentCreationAlertRuleTemplate(AlertRuleTemplate): :type status: str or ~azure.mgmt.securityinsight.models.TemplateStatus :param display_names_filter: the alerts' displayNames on which the cases will be generated. :type display_names_filter: list[str] + :param display_names_exclude_filter: the alerts' displayNames on which the cases will not be + generated. + :type display_names_exclude_filter: list[str] :param product_filter: The alerts' productName on which the cases will be generated. Possible values include: "Microsoft Cloud App Security", "Azure Security Center", "Azure Advanced Threat Protection", "Azure Active Directory Identity Protection", "Azure Security Center for IoT". @@ -1416,6 +1941,7 @@ class MicrosoftSecurityIncidentCreationAlertRuleTemplate(AlertRuleTemplate): 'required_data_connectors': {'key': 'properties.requiredDataConnectors', 'type': '[AlertRuleTemplateDataSource]'}, 'status': {'key': 'properties.status', 'type': 'str'}, 'display_names_filter': {'key': 'properties.displayNamesFilter', 'type': '[str]'}, + 'display_names_exclude_filter': {'key': 'properties.displayNamesExcludeFilter', 'type': '[str]'}, 'product_filter': {'key': 'properties.productFilter', 'type': 'str'}, 'severities_filter': {'key': 'properties.severitiesFilter', 'type': '[str]'}, } @@ -1432,6 +1958,7 @@ def __init__( self.required_data_connectors = kwargs.get('required_data_connectors', None) self.status = kwargs.get('status', None) self.display_names_filter = kwargs.get('display_names_filter', None) + self.display_names_exclude_filter = kwargs.get('display_names_exclude_filter', None) self.product_filter = kwargs.get('product_filter', None) self.severities_filter = kwargs.get('severities_filter', None) @@ -1443,6 +1970,9 @@ class MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties(MicrosoftSecu :param display_names_filter: the alerts' displayNames on which the cases will be generated. :type display_names_filter: list[str] + :param display_names_exclude_filter: the alerts' displayNames on which the cases will not be + generated. + :type display_names_exclude_filter: list[str] :param product_filter: Required. The alerts' productName on which the cases will be generated. Possible values include: "Microsoft Cloud App Security", "Azure Security Center", "Azure Advanced Threat Protection", "Azure Active Directory Identity Protection", "Azure Security @@ -1458,6 +1988,7 @@ class MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties(MicrosoftSecu _attribute_map = { 'display_names_filter': {'key': 'displayNamesFilter', 'type': '[str]'}, + 'display_names_exclude_filter': {'key': 'displayNamesExcludeFilter', 'type': '[str]'}, 'product_filter': {'key': 'productFilter', 'type': 'str'}, 'severities_filter': {'key': 'severitiesFilter', 'type': '[str]'}, } diff --git a/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/models/_models_py3.py b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/models/_models_py3.py index 3b59f51509b..86400b4751e 100644 --- a/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/models/_models_py3.py +++ b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/models/_models_py3.py @@ -191,8 +191,9 @@ class ActionPropertiesBase(msrest.serialization.Model): All required parameters must be populated in order to send to Azure. - :param logic_app_resource_id: Required. Logic App Resource Id, - providers/Microsoft.Logic/workflows/{WorkflowID}. + :param logic_app_resource_id: Required. Logic App Resource Id, /subscriptions/{my- + subscription}/resourceGroups/{my-resource-group}/providers/Microsoft.Logic/workflows/{my- + workflow-id}. :type logic_app_resource_id: str """ @@ -268,8 +269,9 @@ class ActionRequest(ResourceWithEtag): :vartype type: str :param etag: Etag of the azure resource. :type etag: str - :param logic_app_resource_id: Logic App Resource Id, - providers/Microsoft.Logic/workflows/{WorkflowID}. + :param logic_app_resource_id: Logic App Resource Id, /subscriptions/{my- + subscription}/resourceGroups/{my-resource-group}/providers/Microsoft.Logic/workflows/{my- + workflow-id}. :type logic_app_resource_id: str :param trigger_uri: Logic App Callback URL for this specific workflow. :type trigger_uri: str @@ -308,8 +310,9 @@ class ActionRequestProperties(ActionPropertiesBase): All required parameters must be populated in order to send to Azure. - :param logic_app_resource_id: Required. Logic App Resource Id, - providers/Microsoft.Logic/workflows/{WorkflowID}. + :param logic_app_resource_id: Required. Logic App Resource Id, /subscriptions/{my- + subscription}/resourceGroups/{my-resource-group}/providers/Microsoft.Logic/workflows/{my- + workflow-id}. :type logic_app_resource_id: str :param trigger_uri: Logic App Callback URL for this specific workflow. :type trigger_uri: str @@ -383,8 +386,9 @@ class ActionResponse(Resource): :vartype type: str :param etag: Etag of the action. :type etag: str - :param logic_app_resource_id: Logic App Resource Id, - providers/Microsoft.Logic/workflows/{WorkflowID}. + :param logic_app_resource_id: Logic App Resource Id, /subscriptions/{my- + subscription}/resourceGroups/{my-resource-group}/providers/Microsoft.Logic/workflows/{my- + workflow-id}. :type logic_app_resource_id: str :param workflow_id: The name of the logic app's workflow. :type workflow_id: str @@ -424,8 +428,9 @@ class ActionResponseProperties(ActionPropertiesBase): All required parameters must be populated in order to send to Azure. - :param logic_app_resource_id: Required. Logic App Resource Id, - providers/Microsoft.Logic/workflows/{WorkflowID}. + :param logic_app_resource_id: Required. Logic App Resource Id, /subscriptions/{my- + subscription}/resourceGroups/{my-resource-group}/providers/Microsoft.Logic/workflows/{my- + workflow-id}. :type logic_app_resource_id: str :param workflow_id: The name of the logic app's workflow. :type workflow_id: str @@ -681,6 +686,40 @@ def __init__( self.status = status +class AlertRuleTemplatesList(msrest.serialization.Model): + """List all the alert rule templates. + + Variables are only populated by the server, and will be ignored when sending a request. + + All required parameters must be populated in order to send to Azure. + + :ivar next_link: URL to fetch the next set of alert rule templates. + :vartype next_link: str + :param value: Required. Array of alert rule templates. + :type value: list[~azure.mgmt.securityinsight.models.AlertRuleTemplate] + """ + + _validation = { + 'next_link': {'readonly': True}, + 'value': {'required': True}, + } + + _attribute_map = { + 'next_link': {'key': 'nextLink', 'type': 'str'}, + 'value': {'key': 'value', 'type': '[AlertRuleTemplate]'}, + } + + def __init__( + self, + *, + value: List["AlertRuleTemplate"], + **kwargs + ): + super(AlertRuleTemplatesList, self).__init__(**kwargs) + self.next_link = None + self.value = value + + class AlertsDataTypeOfDataConnector(msrest.serialization.Model): """Alerts data type for data connectors. @@ -879,6 +918,163 @@ def __init__( super(AwsCloudTrailDataConnectorDataTypesLogs, self).__init__(state=state, **kwargs) +class Bookmark(ResourceWithEtag): + """Represents a bookmark in Azure Security Insights. + + Variables are only populated by the server, and will be ignored when sending a request. + + :ivar id: Azure resource Id. + :vartype id: str + :ivar name: Azure resource name. + :vartype name: str + :ivar type: Azure resource type. + :vartype type: str + :param etag: Etag of the azure resource. + :type etag: str + :param created: The time the bookmark was created. + :type created: ~datetime.datetime + :param created_by: Describes a user that created the bookmark. + :type created_by: ~azure.mgmt.securityinsight.models.UserInfo + :param display_name: The display name of the bookmark. + :type display_name: str + :param labels: List of labels relevant to this bookmark. + :type labels: list[str] + :param notes: The notes of the bookmark. + :type notes: str + :param query: The query of the bookmark. + :type query: str + :param query_result: The query result of the bookmark. + :type query_result: str + :param updated: The last time the bookmark was updated. + :type updated: ~datetime.datetime + :param updated_by: Describes a user that updated the bookmark. + :type updated_by: ~azure.mgmt.securityinsight.models.UserInfo + :param incident_info: Describes an incident that relates to bookmark. + :type incident_info: ~azure.mgmt.securityinsight.models.IncidentInfo + """ + + _validation = { + 'id': {'readonly': True}, + 'name': {'readonly': True}, + 'type': {'readonly': True}, + } + + _attribute_map = { + 'id': {'key': 'id', 'type': 'str'}, + 'name': {'key': 'name', 'type': 'str'}, + 'type': {'key': 'type', 'type': 'str'}, + 'etag': {'key': 'etag', 'type': 'str'}, + 'created': {'key': 'properties.created', 'type': 'iso-8601'}, + 'created_by': {'key': 'properties.createdBy', 'type': 'UserInfo'}, + 'display_name': {'key': 'properties.displayName', 'type': 'str'}, + 'labels': {'key': 'properties.labels', 'type': '[str]'}, + 'notes': {'key': 'properties.notes', 'type': 'str'}, + 'query': {'key': 'properties.query', 'type': 'str'}, + 'query_result': {'key': 'properties.queryResult', 'type': 'str'}, + 'updated': {'key': 'properties.updated', 'type': 'iso-8601'}, + 'updated_by': {'key': 'properties.updatedBy', 'type': 'UserInfo'}, + 'incident_info': {'key': 'properties.incidentInfo', 'type': 'IncidentInfo'}, + } + + def __init__( + self, + *, + etag: Optional[str] = None, + created: Optional[datetime.datetime] = None, + created_by: Optional["UserInfo"] = None, + display_name: Optional[str] = None, + labels: Optional[List[str]] = None, + notes: Optional[str] = None, + query: Optional[str] = None, + query_result: Optional[str] = None, + updated: Optional[datetime.datetime] = None, + updated_by: Optional["UserInfo"] = None, + incident_info: Optional["IncidentInfo"] = None, + **kwargs + ): + super(Bookmark, self).__init__(etag=etag, **kwargs) + self.created = created + self.created_by = created_by + self.display_name = display_name + self.labels = labels + self.notes = notes + self.query = query + self.query_result = query_result + self.updated = updated + self.updated_by = updated_by + self.incident_info = incident_info + + +class BookmarkList(msrest.serialization.Model): + """List all the bookmarks. + + Variables are only populated by the server, and will be ignored when sending a request. + + All required parameters must be populated in order to send to Azure. + + :ivar next_link: URL to fetch the next set of cases. + :vartype next_link: str + :param value: Required. Array of bookmarks. + :type value: list[~azure.mgmt.securityinsight.models.Bookmark] + """ + + _validation = { + 'next_link': {'readonly': True}, + 'value': {'required': True}, + } + + _attribute_map = { + 'next_link': {'key': 'nextLink', 'type': 'str'}, + 'value': {'key': 'value', 'type': '[Bookmark]'}, + } + + def __init__( + self, + *, + value: List["Bookmark"], + **kwargs + ): + super(BookmarkList, self).__init__(**kwargs) + self.next_link = None + self.value = value + + +class ClientInfo(msrest.serialization.Model): + """Information on the client (user or application) that made some action. + + :param email: The email of the client. + :type email: str + :param name: The name of the client. + :type name: str + :param object_id: The object id of the client. + :type object_id: str + :param user_principal_name: The user principal name of the client. + :type user_principal_name: str + """ + + _attribute_map = { + 'email': {'key': 'email', 'type': 'str'}, + 'name': {'key': 'name', 'type': 'str'}, + 'object_id': {'key': 'objectId', 'type': 'str'}, + 'user_principal_name': {'key': 'userPrincipalName', 'type': 'str'}, + } + + def __init__( + self, + *, + email: Optional[str] = None, + name: Optional[str] = None, + object_id: Optional[str] = None, + user_principal_name: Optional[str] = None, + **kwargs + ): + super(ClientInfo, self).__init__(**kwargs) + self.email = email + self.name = name + self.object_id = object_id + self.user_principal_name = user_principal_name + + class DataConnectorList(msrest.serialization.Model): """List all the data connectors. @@ -1134,6 +1330,261 @@ def __init__( self.tactics = tactics +class Incident(ResourceWithEtag): + """Represents an incident in Azure Security Insights. + + Variables are only populated by the server, and will be ignored when sending a request. + + :ivar id: Azure resource Id. + :vartype id: str + :ivar name: Azure resource name. + :vartype name: str + :ivar type: Azure resource type. + :vartype type: str + :param etag: Etag of the azure resource. + :type etag: str + :ivar additional_data: Additional data on the incident. + :vartype additional_data: ~azure.mgmt.securityinsight.models.IncidentAdditionalData + :param classification: The reason the incident was closed. Possible values include: + "Undetermined", "TruePositive", "BenignPositive", "FalsePositive". + :type classification: str or ~azure.mgmt.securityinsight.models.IncidentClassification + :param classification_comment: Describes the reason the incident was closed. + :type classification_comment: str + :param classification_reason: The classification reason the incident was closed with. Possible + values include: "SuspiciousActivity", "SuspiciousButExpected", "IncorrectAlertLogic", + "InaccurateData". + :type classification_reason: str or + ~azure.mgmt.securityinsight.models.IncidentClassificationReason + :ivar created_time_utc: The time the incident was created. + :vartype created_time_utc: ~datetime.datetime + :param description: The description of the incident. + :type description: str + :param first_activity_time_utc: The time of the first activity in the incident. + :type first_activity_time_utc: ~datetime.datetime + :ivar incident_url: The deep-link url to the incident in Azure portal. + :vartype incident_url: str + :ivar incident_number: A sequential number. + :vartype incident_number: int + :param labels: List of labels relevant to this incident. + :type labels: list[~azure.mgmt.securityinsight.models.IncidentLabel] + :param last_activity_time_utc: The time of the last activity in the incident. + :type last_activity_time_utc: ~datetime.datetime + :ivar last_modified_time_utc: The last time the incident was updated. + :vartype last_modified_time_utc: ~datetime.datetime + :param owner: Describes a user that the incident is assigned to. + :type owner: ~azure.mgmt.securityinsight.models.IncidentOwnerInfo + :ivar related_analytic_rule_ids: List of resource ids of Analytic rules related to the + incident. + :vartype related_analytic_rule_ids: list[str] + :param severity: The severity of the incident. Possible values include: "High", "Medium", + "Low", "Informational". + :type severity: str or ~azure.mgmt.securityinsight.models.IncidentSeverity + :param status: The status of the incident. Possible values include: "New", "Active", "Closed". + :type status: str or ~azure.mgmt.securityinsight.models.IncidentStatus + :param title: The title of the incident. + :type title: str + """ + + _validation = { + 'id': {'readonly': True}, + 'name': {'readonly': True}, + 'type': {'readonly': True}, + 'additional_data': {'readonly': True}, + 'created_time_utc': {'readonly': True}, + 'incident_url': {'readonly': True}, + 'incident_number': {'readonly': True}, + 'last_modified_time_utc': {'readonly': True}, + 'related_analytic_rule_ids': {'readonly': True}, + } + + _attribute_map = { + 'id': {'key': 'id', 'type': 'str'}, + 'name': {'key': 'name', 'type': 'str'}, + 'type': {'key': 'type', 'type': 'str'}, + 'etag': {'key': 'etag', 'type': 'str'}, + 'additional_data': {'key': 'properties.additionalData', 'type': 'IncidentAdditionalData'}, + 'classification': {'key': 'properties.classification', 'type': 'str'}, + 'classification_comment': {'key': 'properties.classificationComment', 'type': 'str'}, + 'classification_reason': {'key': 'properties.classificationReason', 'type': 'str'}, + 'created_time_utc': {'key': 'properties.createdTimeUtc', 'type': 'iso-8601'}, + 'description': {'key': 'properties.description', 'type': 'str'}, + 'first_activity_time_utc': {'key': 'properties.firstActivityTimeUtc', 'type': 'iso-8601'}, + 'incident_url': {'key': 'properties.incidentUrl', 'type': 'str'}, + 'incident_number': {'key': 'properties.incidentNumber', 'type': 'int'}, + 'labels': {'key': 'properties.labels', 'type': '[IncidentLabel]'}, + 'last_activity_time_utc': {'key': 'properties.lastActivityTimeUtc', 'type': 'iso-8601'}, + 'last_modified_time_utc': {'key': 'properties.lastModifiedTimeUtc', 'type': 'iso-8601'}, + 'owner': {'key': 'properties.owner', 'type': 'IncidentOwnerInfo'}, + 'related_analytic_rule_ids': {'key': 'properties.relatedAnalyticRuleIds', 'type': '[str]'}, + 'severity': {'key': 'properties.severity', 'type': 'str'}, + 'status': {'key': 'properties.status', 'type': 'str'}, + 'title': {'key': 'properties.title', 'type': 'str'}, + } + + def __init__( + self, + *, + etag: Optional[str] = None, + classification: Optional[Union[str, "IncidentClassification"]] = None, + classification_comment: Optional[str] = None, + classification_reason: Optional[Union[str, "IncidentClassificationReason"]] = None, + description: Optional[str] = None, + first_activity_time_utc: Optional[datetime.datetime] = None, + labels: Optional[List["IncidentLabel"]] = None, + last_activity_time_utc: Optional[datetime.datetime] = None, + owner: Optional["IncidentOwnerInfo"] = None, + severity: Optional[Union[str, "IncidentSeverity"]] = None, + status: Optional[Union[str, "IncidentStatus"]] = None, + title: Optional[str] = None, + **kwargs + ): + super(Incident, self).__init__(etag=etag, **kwargs) + self.additional_data = None + self.classification = classification + self.classification_comment = classification_comment + self.classification_reason = classification_reason + self.created_time_utc = None + self.description = description + self.first_activity_time_utc = first_activity_time_utc + self.incident_url = None + self.incident_number = None + self.labels = labels + self.last_activity_time_utc = last_activity_time_utc + self.last_modified_time_utc = None + self.owner = owner + self.related_analytic_rule_ids = None + self.severity = severity + self.status = status + self.title = title + + +class IncidentAdditionalData(msrest.serialization.Model): + """Incident additional data property bag. + + Variables are only populated by the server, and will be ignored when sending a request. + + :ivar alerts_count: The number of alerts in the incident. + :vartype alerts_count: int + :ivar bookmarks_count: The number of bookmarks in the incident. + :vartype bookmarks_count: int + :ivar comments_count: The number of comments in the incident. + :vartype comments_count: int + :ivar alert_product_names: List of product names of alerts in the incident. + :vartype alert_product_names: list[str] + :ivar tactics: The tactics associated with incident. + :vartype tactics: list[str or ~azure.mgmt.securityinsight.models.AttackTactic] + """ + + _validation = { + 'alerts_count': {'readonly': True}, + 'bookmarks_count': {'readonly': True}, + 'comments_count': {'readonly': True}, + 'alert_product_names': {'readonly': True}, + 'tactics': {'readonly': True}, + } + + _attribute_map = { + 'alerts_count': {'key': 'alertsCount', 'type': 'int'}, + 'bookmarks_count': {'key': 'bookmarksCount', 'type': 'int'}, + 'comments_count': {'key': 'commentsCount', 'type': 'int'}, + 'alert_product_names': {'key': 'alertProductNames', 'type': '[str]'}, + 'tactics': {'key': 'tactics', 'type': '[str]'}, + } + + def __init__( + self, + **kwargs + ): + super(IncidentAdditionalData, self).__init__(**kwargs) + self.alerts_count = None + self.bookmarks_count = None + self.comments_count = None + self.alert_product_names = None + self.tactics = None + + +class IncidentComment(Resource): + """Represents an incident comment. + + Variables are only populated by the server, and will be ignored when sending a request. + + :ivar id: Azure resource Id. + :vartype id: str + :ivar name: Azure resource name. + :vartype name: str + :ivar type: Azure resource type. + :vartype type: str + :ivar created_time_utc: The time the comment was created. + :vartype created_time_utc: ~datetime.datetime + :param message: The comment message. + :type message: str + :ivar author: Describes the client that created the comment. + :vartype author: ~azure.mgmt.securityinsight.models.ClientInfo + """ + + _validation = { + 'id': {'readonly': True}, + 'name': {'readonly': True}, + 'type': {'readonly': True}, + 'created_time_utc': {'readonly': True}, + 'author': {'readonly': True}, + } + + _attribute_map = { + 'id': {'key': 'id', 'type': 'str'}, + 'name': {'key': 'name', 'type': 'str'}, + 'type': {'key': 'type', 'type': 'str'}, + 'created_time_utc': {'key': 'properties.createdTimeUtc', 'type': 'iso-8601'}, + 'message': {'key': 'properties.message', 'type': 'str'}, + 'author': {'key': 'properties.author', 'type': 'ClientInfo'}, + } + + def __init__( + self, + *, + message: Optional[str] = None, + **kwargs + ): + super(IncidentComment, self).__init__(**kwargs) + self.created_time_utc = None + self.message = message + self.author = None + + +class IncidentCommentList(msrest.serialization.Model): + """List of incident comments. + + Variables are only populated by the server, and will be ignored when sending a request. + + All required parameters must be populated in order to send to Azure. + + :ivar next_link: URL to fetch the next set of comments. + :vartype next_link: str + :param value: Required. Array of comments. + :type value: list[~azure.mgmt.securityinsight.models.IncidentComment] + """ + + _validation = { + 'next_link': {'readonly': True}, + 'value': {'required': True}, + } + + _attribute_map = { + 'next_link': {'key': 'nextLink', 'type': 'str'}, + 'value': {'key': 'value', 'type': '[IncidentComment]'}, + } + + def __init__( + self, + *, + value: List["IncidentComment"], + **kwargs + ): + super(IncidentCommentList, self).__init__(**kwargs) + self.next_link = None + self.value = value + + class IncidentInfo(msrest.serialization.Model): """Describes related incident information for the bookmark. @@ -1143,7 +1594,7 @@ class IncidentInfo(msrest.serialization.Model): :type incident_id: str :param severity: Required. The severity of the incident. Possible values include: "Critical", "High", "Medium", "Low", "Informational". - :type severity: str or ~azure.mgmt.securityinsight.models.IncidentSeverity + :type severity: str or ~azure.mgmt.securityinsight.models.CaseSeverity :param title: Required. The title of the incident. :type title: str :param relation_name: Required. Relation Name. @@ -1168,7 +1619,7 @@ def __init__( self, *, incident_id: str, - severity: Union[str, "IncidentSeverity"], + severity: Union[str, "CaseSeverity"], title: str, relation_name: str, **kwargs @@ -1180,6 +1631,110 @@ def __init__( self.relation_name = relation_name +class IncidentLabel(msrest.serialization.Model): + """Represents an incident label. + + Variables are only populated by the server, and will be ignored when sending a request. + + All required parameters must be populated in order to send to Azure. + + :param label_name: Required. The name of the label. + :type label_name: str + :ivar label_type: The type of the label. Possible values include: "User", "System". + :vartype label_type: str or ~azure.mgmt.securityinsight.models.IncidentLabelType + """ + + _validation = { + 'label_name': {'required': True}, + 'label_type': {'readonly': True}, + } + + _attribute_map = { + 'label_name': {'key': 'labelName', 'type': 'str'}, + 'label_type': {'key': 'labelType', 'type': 'str'}, + } + + def __init__( + self, + *, + label_name: str, + **kwargs + ): + super(IncidentLabel, self).__init__(**kwargs) + self.label_name = label_name + self.label_type = None + + +class IncidentList(msrest.serialization.Model): + """List all the incidents. + + Variables are only populated by the server, and will be ignored when sending a request. + + All required parameters must be populated in order to send to Azure. + + :ivar next_link: URL to fetch the next set of incidents. + :vartype next_link: str + :param value: Required. Array of incidents. + :type value: list[~azure.mgmt.securityinsight.models.Incident] + """ + + _validation = { + 'next_link': {'readonly': True}, + 'value': {'required': True}, + } + + _attribute_map = { + 'next_link': {'key': 'nextLink', 'type': 'str'}, + 'value': {'key': 'value', 'type': '[Incident]'}, + } + + def __init__( + self, + *, + value: List["Incident"], + **kwargs + ): + super(IncidentList, self).__init__(**kwargs) + self.next_link = None + self.value = value + + +class IncidentOwnerInfo(msrest.serialization.Model): + """Information on the user an incident is assigned to. + + :param email: The email of the user the incident is assigned to. + :type email: str + :param assigned_to: The name of the user the incident is assigned to. + :type assigned_to: str + :param object_id: The object id of the user the incident is assigned to. + :type object_id: str + :param user_principal_name: The user principal name of the user the incident is assigned to. + :type user_principal_name: str + """ + + _attribute_map = { + 'email': {'key': 'email', 'type': 'str'}, + 'assigned_to': {'key': 'assignedTo', 'type': 'str'}, + 'object_id': {'key': 'objectId', 'type': 'str'}, + 'user_principal_name': {'key': 'userPrincipalName', 'type': 'str'}, + } + + def __init__( + self, + *, + email: Optional[str] = None, + assigned_to: Optional[str] = None, + object_id: Optional[str] = None, + user_principal_name: Optional[str] = None, + **kwargs + ): + super(IncidentOwnerInfo, self).__init__(**kwargs) + self.email = email + self.assigned_to = assigned_to + self.object_id = object_id + self.user_principal_name = user_principal_name + + class McasDataConnector(DataConnector): """Represents MCAS (Microsoft Cloud App Security) data connector. @@ -1350,6 +1905,9 @@ class MicrosoftSecurityIncidentCreationAlertRule(AlertRule): :type kind: str or ~azure.mgmt.securityinsight.models.AlertRuleKindEnum :param display_names_filter: the alerts' displayNames on which the cases will be generated. :type display_names_filter: list[str] + :param display_names_exclude_filter: the alerts' displayNames on which the cases will not be + generated. + :type display_names_exclude_filter: list[str] :param product_filter: The alerts' productName on which the cases will be generated. Possible values include: "Microsoft Cloud App Security", "Azure Security Center", "Azure Advanced Threat Protection", "Azure Active Directory Identity Protection", "Azure Security Center for IoT". @@ -1376,6 +1934,7 @@ class MicrosoftSecurityIncidentCreationAlertRule(AlertRule): _attribute_map = { 'kind': {'key': 'kind', 'type': 'str'}, 'display_names_filter': {'key': 'properties.displayNamesFilter', 'type': '[str]'}, + 'display_names_exclude_filter': {'key': 'properties.displayNamesExcludeFilter', 'type': '[str]'}, 'product_filter': {'key': 'properties.productFilter', 'type': 'str'}, 'severities_filter': {'key': 'properties.severitiesFilter', 'type': '[str]'}, 'alert_rule_template_name': {'key': 'properties.alertRuleTemplateName', 'type': 'str'}, @@ -1390,6 +1949,7 @@ def __init__( *, kind: Union[str, "AlertRuleKindEnum"], display_names_filter: Optional[List[str]] = None, + display_names_exclude_filter: Optional[List[str]] = None, product_filter: Optional[Union[str, "MicrosoftSecurityProductName"]] = None, severities_filter: Optional[List[Union[str, "AlertSeverity"]]] = None, alert_rule_template_name: Optional[str] = None, @@ -1400,6 +1960,7 @@ def __init__( ): super(MicrosoftSecurityIncidentCreationAlertRule, self).__init__(kind=kind, **kwargs) self.display_names_filter = display_names_filter + self.display_names_exclude_filter = display_names_exclude_filter self.product_filter = product_filter self.severities_filter = severities_filter self.alert_rule_template_name = alert_rule_template_name @@ -1416,6 +1977,9 @@ class MicrosoftSecurityIncidentCreationAlertRuleCommonProperties(msrest.serializ :param display_names_filter: the alerts' displayNames on which the cases will be generated. :type display_names_filter: list[str] + :param display_names_exclude_filter: the alerts' displayNames on which the cases will not be + generated. + :type display_names_exclude_filter: list[str] :param product_filter: Required. The alerts' productName on which the cases will be generated. Possible values include: "Microsoft Cloud App Security", "Azure Security Center", "Azure Advanced Threat Protection", "Azure Active Directory Identity Protection", "Azure Security @@ -1431,6 +1995,7 @@ class MicrosoftSecurityIncidentCreationAlertRuleCommonProperties(msrest.serializ _attribute_map = { 'display_names_filter': {'key': 'displayNamesFilter', 'type': '[str]'}, + 'display_names_exclude_filter': {'key': 'displayNamesExcludeFilter', 'type': '[str]'}, 'product_filter': {'key': 'productFilter', 'type': 'str'}, 'severities_filter': {'key': 'severitiesFilter', 'type': '[str]'}, } @@ -1440,11 +2005,13 @@ def __init__( *, product_filter: Union[str, "MicrosoftSecurityProductName"], display_names_filter: Optional[List[str]] = None, + display_names_exclude_filter: Optional[List[str]] = None, severities_filter: Optional[List[Union[str, "AlertSeverity"]]] = None, **kwargs ): super(MicrosoftSecurityIncidentCreationAlertRuleCommonProperties, self).__init__(**kwargs) self.display_names_filter = display_names_filter + self.display_names_exclude_filter = display_names_exclude_filter self.product_filter = product_filter self.severities_filter = severities_filter @@ -1458,6 +2025,9 @@ class MicrosoftSecurityIncidentCreationAlertRuleProperties(MicrosoftSecurityInci :param display_names_filter: the alerts' displayNames on which the cases will be generated. :type display_names_filter: list[str] + :param display_names_exclude_filter: the alerts' displayNames on which the cases will not be + generated. + :type display_names_exclude_filter: list[str] :param product_filter: Required. The alerts' productName on which the cases will be generated. Possible values include: "Microsoft Cloud App Security", "Azure Security Center", "Azure Advanced Threat Protection", "Azure Active Directory Identity Protection", "Azure Security @@ -1486,6 +2056,7 @@ class MicrosoftSecurityIncidentCreationAlertRuleProperties(MicrosoftSecurityInci _attribute_map = { 'display_names_filter': {'key': 'displayNamesFilter', 'type': '[str]'}, + 'display_names_exclude_filter': {'key': 'displayNamesExcludeFilter', 'type': '[str]'}, 'product_filter': {'key': 'productFilter', 'type': 'str'}, 'severities_filter': {'key': 'severitiesFilter', 'type': '[str]'}, 'alert_rule_template_name': {'key': 'alertRuleTemplateName', 'type': 'str'}, @@ -1502,12 +2073,13 @@ def __init__( display_name: str, enabled: bool, display_names_filter: Optional[List[str]] = None, + display_names_exclude_filter: Optional[List[str]] = None, severities_filter: Optional[List[Union[str, "AlertSeverity"]]] = None, alert_rule_template_name: Optional[str] = None, description: Optional[str] = None, **kwargs ): - super(MicrosoftSecurityIncidentCreationAlertRuleProperties, self).__init__(display_names_filter=display_names_filter, product_filter=product_filter, severities_filter=severities_filter, **kwargs) + super(MicrosoftSecurityIncidentCreationAlertRuleProperties, self).__init__(display_names_filter=display_names_filter, display_names_exclude_filter=display_names_exclude_filter, product_filter=product_filter, severities_filter=severities_filter, **kwargs) self.alert_rule_template_name = alert_rule_template_name self.description = description self.display_name = display_name @@ -1542,6 +2114,9 @@ class MicrosoftSecurityIncidentCreationAlertRuleTemplate(AlertRuleTemplate): :type status: str or ~azure.mgmt.securityinsight.models.TemplateStatus :param display_names_filter: the alerts' displayNames on which the cases will be generated. :type display_names_filter: list[str] + :param display_names_exclude_filter: the alerts' displayNames on which the cases will not be + generated. + :type display_names_exclude_filter: list[str] :param product_filter: The alerts' productName on which the cases will be generated. Possible values include: "Microsoft Cloud App Security", "Azure Security Center", "Azure Advanced Threat Protection", "Azure Active Directory Identity Protection", "Azure Security Center for IoT". @@ -1564,6 +2139,7 @@ class MicrosoftSecurityIncidentCreationAlertRuleTemplate(AlertRuleTemplate): 'required_data_connectors': {'key': 'properties.requiredDataConnectors', 'type': '[AlertRuleTemplateDataSource]'}, 'status': {'key': 'properties.status', 'type': 'str'}, 'display_names_filter': {'key': 'properties.displayNamesFilter', 'type': '[str]'}, + 'display_names_exclude_filter': {'key': 'properties.displayNamesExcludeFilter', 'type': '[str]'}, 'product_filter': {'key': 'properties.productFilter', 'type': 'str'}, 'severities_filter': {'key': 'properties.severitiesFilter', 'type': '[str]'}, } @@ -1578,6 +2154,7 @@ def __init__( required_data_connectors: Optional[List["AlertRuleTemplateDataSource"]] = None, status: Optional[Union[str, "TemplateStatus"]] = None, display_names_filter: Optional[List[str]] = None, + display_names_exclude_filter: Optional[List[str]] = None, product_filter: Optional[Union[str, "MicrosoftSecurityProductName"]] = None, severities_filter: Optional[List[Union[str, "AlertSeverity"]]] = None, **kwargs @@ -1590,6 +2167,7 @@ def __init__( self.required_data_connectors = required_data_connectors self.status = status self.display_names_filter = display_names_filter + self.display_names_exclude_filter = display_names_exclude_filter self.product_filter = product_filter self.severities_filter = severities_filter @@ -1601,6 +2179,9 @@ class MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties(MicrosoftSecu :param display_names_filter: the alerts' displayNames on which the cases will be generated. :type display_names_filter: list[str] + :param display_names_exclude_filter: the alerts' displayNames on which the cases will not be + generated. + :type display_names_exclude_filter: list[str] :param product_filter: Required. The alerts' productName on which the cases will be generated. Possible values include: "Microsoft Cloud App Security", "Azure Security Center", "Azure Advanced Threat Protection", "Azure Active Directory Identity Protection", "Azure Security @@ -1616,6 +2197,7 @@ class MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties(MicrosoftSecu _attribute_map = { 'display_names_filter': {'key': 'displayNamesFilter', 'type': '[str]'}, + 'display_names_exclude_filter': {'key': 'displayNamesExcludeFilter', 'type': '[str]'}, 'product_filter': {'key': 'productFilter', 'type': 'str'}, 'severities_filter': {'key': 'severitiesFilter', 'type': '[str]'}, } @@ -1625,10 +2207,11 @@ def __init__( *, product_filter: Union[str, "MicrosoftSecurityProductName"], display_names_filter: Optional[List[str]] = None, + display_names_exclude_filter: Optional[List[str]] = None, severities_filter: Optional[List[Union[str, "AlertSeverity"]]] = None, **kwargs ): - super(MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties, self).__init__(display_names_filter=display_names_filter, product_filter=product_filter, severities_filter=severities_filter, **kwargs) + super(MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties, self).__init__(display_names_filter=display_names_filter, display_names_exclude_filter=display_names_exclude_filter, product_filter=product_filter, severities_filter=severities_filter, **kwargs) class OfficeConsent(Resource): diff --git a/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/models/_security_insights_enums.py b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/models/_security_insights_enums.py index bf1438e28e5..bc1c2d0d08c 100644 --- a/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/models/_security_insights_enums.py +++ b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/models/_security_insights_enums.py @@ -42,6 +42,16 @@ class AttackTactic(str, Enum): command_and_control = "CommandAndControl" impact = "Impact" +class CaseSeverity(str, Enum): + """The severity of the incident + """ + + critical = "Critical" #: Critical severity. + high = "High" #: High severity. + medium = "Medium" #: Medium severity. + low = "Low" #: Low severity. + informational = "Informational" #: Informational severity. + class DataConnectorKindEnum(str, Enum): """The kind of the data connector """ @@ -62,16 +72,48 @@ class DataTypeState(str, Enum): enabled = "Enabled" disabled = "Disabled" +class IncidentClassification(str, Enum): + """The reason the incident was closed + """ + + undetermined = "Undetermined" #: Incident classification was undetermined. + true_positive = "TruePositive" #: Incident was true positive. + benign_positive = "BenignPositive" #: Incident was benign positive. + false_positive = "FalsePositive" #: Incident was false positive. + +class IncidentClassificationReason(str, Enum): + """The classification reason the incident was closed with + """ + + suspicious_activity = "SuspiciousActivity" #: Classification reason was suspicious activity. + suspicious_but_expected = "SuspiciousButExpected" #: Classification reason was suspicious but expected. + incorrect_alert_logic = "IncorrectAlertLogic" #: Classification reason was incorrect alert logic. + inaccurate_data = "InaccurateData" #: Classification reason was inaccurate data. + +class IncidentLabelType(str, Enum): + """The type of the label + """ + + user = "User" #: Label manually created by a user. + system = "System" #: Label automatically created by the system. + class IncidentSeverity(str, Enum): """The severity of the incident """ - critical = "Critical" #: Critical severity. high = "High" #: High severity. medium = "Medium" #: Medium severity. low = "Low" #: Low severity. informational = "Informational" #: Informational severity. +class IncidentStatus(str, Enum): + """The status of the incident + """ + + new = "New" #: An active incident which isn't being handled currently. + active = "Active" #: An active incident which is being handled. + closed = "Closed" #: A non-active incident. + class LicenseStatus(str, Enum): """Determines whether the tenant has ATP (Advanced Threat Protection) license. """ diff --git a/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/operations/__init__.py b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/operations/__init__.py index a99ec2ca26d..5e67996dcd4 100644 --- a/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/operations/__init__.py +++ b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/operations/__init__.py @@ -9,11 +9,19 @@ from ._operation_operations import OperationOperations from ._alert_rule_operations import AlertRuleOperations from ._action_operations import ActionOperations +from ._alert_rule_template_operations import AlertRuleTemplateOperations +from ._bookmark_operations import BookmarkOperations from ._data_connector_operations import DataConnectorOperations +from ._incident_operations import IncidentOperations +from ._incident_comment_operations import IncidentCommentOperations __all__ = [ 'OperationOperations', 'AlertRuleOperations', 'ActionOperations', + 'AlertRuleTemplateOperations', + 'BookmarkOperations', 'DataConnectorOperations', + 'IncidentOperations', + 'IncidentCommentOperations', ] diff --git a/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/operations/_alert_rule_operations.py b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/operations/_alert_rule_operations.py index ed661c6500d..05f4d3ab736 100644 --- a/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/operations/_alert_rule_operations.py +++ b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/operations/_alert_rule_operations.py @@ -405,8 +405,9 @@ def create_or_update_action( :type action_id: str :param etag: Etag of the azure resource. :type etag: str - :param logic_app_resource_id: Logic App Resource Id, - providers/Microsoft.Logic/workflows/{WorkflowID}. + :param logic_app_resource_id: Logic App Resource Id, /subscriptions/{my- + subscription}/resourceGroups/{my-resource-group}/providers/Microsoft.Logic/workflows/{my- + workflow-id}. :type logic_app_resource_id: str :param trigger_uri: Logic App Callback URL for this specific workflow. :type trigger_uri: str diff --git a/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/operations/_alert_rule_template_operations.py b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/operations/_alert_rule_template_operations.py new file mode 100644 index 00000000000..74ad58a85f6 --- /dev/null +++ b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/operations/_alert_rule_template_operations.py @@ -0,0 +1,179 @@ +# coding=utf-8 +# -------------------------------------------------------------------------- +# Copyright (c) Microsoft Corporation. All rights reserved. +# Licensed under the MIT License. See License.txt in the project root for license information. +# Code generated by Microsoft (R) AutoRest Code Generator. +# Changes may cause incorrect behavior and will be lost if the code is regenerated. +# -------------------------------------------------------------------------- +from typing import TYPE_CHECKING +import warnings + +from azure.core.exceptions import HttpResponseError, ResourceExistsError, ResourceNotFoundError, map_error +from azure.core.paging import ItemPaged +from azure.core.pipeline import PipelineResponse +from azure.core.pipeline.transport import HttpRequest, HttpResponse +from azure.mgmt.core.exceptions import ARMErrorFormat + +from .. import models + +if TYPE_CHECKING: + # pylint: disable=unused-import,ungrouped-imports + from typing import Any, Callable, Dict, Generic, Optional, TypeVar + + T = TypeVar('T') + ClsType = Optional[Callable[[PipelineResponse[HttpRequest, HttpResponse], T, Dict[str, Any]], Any]] + +class AlertRuleTemplateOperations(object): + """AlertRuleTemplateOperations operations. + + You should not instantiate this class directly. Instead, you should create a Client instance that + instantiates it for you and attaches it as an attribute. + + :ivar models: Alias to model classes used in this operation group. + :type models: ~azure.mgmt.securityinsight.models + :param client: Client for service requests. + :param config: Configuration of service client. + :param serializer: An object model serializer. + :param deserializer: An object model deserializer. + """ + + models = models + + def __init__(self, client, config, serializer, deserializer): + self._client = client + self._serialize = serializer + self._deserialize = deserializer + self._config = config + + def list( + self, + resource_group_name, # type: str + workspace_name, # type: str + **kwargs # type: Any + ): + # type: (...) -> "models.AlertRuleTemplatesList" + """Gets all alert rule templates. + + :param resource_group_name: The name of the resource group within the user's subscription. The + name is case insensitive. + :type resource_group_name: str + :param workspace_name: The name of the workspace. + :type workspace_name: str + :keyword callable cls: A custom type or function that will be passed the direct response + :return: AlertRuleTemplatesList or the result of cls(response) + :rtype: ~azure.mgmt.securityinsight.models.AlertRuleTemplatesList + :raises: ~azure.core.exceptions.HttpResponseError + """ + cls = kwargs.pop('cls', None) # type: ClsType["models.AlertRuleTemplatesList"] + error_map = kwargs.pop('error_map', {404: ResourceNotFoundError, 409: ResourceExistsError}) + api_version = "2020-01-01" + + def prepare_request(next_link=None): + if not next_link: + # Construct URL + url = self.list.metadata['url'] + path_format_arguments = { + 'subscriptionId': self._serialize.url("self._config.subscription_id", self._config.subscription_id, 'str', pattern=r'^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$'), + 'resourceGroupName': self._serialize.url("resource_group_name", resource_group_name, 'str', max_length=90, min_length=1, pattern=r'^[-\w\._\(\)]+$'), + 'workspaceName': self._serialize.url("workspace_name", workspace_name, 'str', max_length=90, min_length=1), + } + url = self._client.format_url(url, **path_format_arguments) + else: + url = next_link + + # Construct parameters + query_parameters = {} # type: Dict[str, Any] + query_parameters['api-version'] = self._serialize.query("api_version", api_version, 'str') + + # Construct headers + header_parameters = {} # type: Dict[str, Any] + header_parameters['Accept'] = 'application/json' + + # Construct and send request + request = self._client.get(url, query_parameters, header_parameters) + return request + + def extract_data(pipeline_response): + deserialized = self._deserialize('AlertRuleTemplatesList', pipeline_response) + list_of_elem = deserialized.value + if cls: + list_of_elem = cls(list_of_elem) + return deserialized.next_link or None, iter(list_of_elem) + + def get_next(next_link=None): + request = prepare_request(next_link) + + pipeline_response = self._client._pipeline.run(request, stream=False, **kwargs) + response = pipeline_response.http_response + + if response.status_code not in [200]: + map_error(status_code=response.status_code, response=response, error_map=error_map) + raise HttpResponseError(response=response, error_format=ARMErrorFormat) + + return pipeline_response + + return ItemPaged( + get_next, extract_data + ) + list.metadata = {'url': '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRuleTemplates'} + + def get( + self, + resource_group_name, # type: str + workspace_name, # type: str + alert_rule_template_id, # type: str + **kwargs # type: Any + ): + # type: (...) -> "models.AlertRuleTemplate" + """Gets the alert rule template. + + :param resource_group_name: The name of the resource group within the user's subscription. The + name is case insensitive. + :type resource_group_name: str + :param workspace_name: The name of the workspace. + :type workspace_name: str + :param alert_rule_template_id: Alert rule template ID. + :type alert_rule_template_id: str + :keyword callable cls: A custom type or function that will be passed the direct response + :return: AlertRuleTemplate or the result of cls(response) + :rtype: ~azure.mgmt.securityinsight.models.AlertRuleTemplate + :raises: ~azure.core.exceptions.HttpResponseError + """ + cls = kwargs.pop('cls', None) # type: ClsType["models.AlertRuleTemplate"] + error_map = kwargs.pop('error_map', {404: ResourceNotFoundError, 409: ResourceExistsError}) + api_version = "2020-01-01" + + # Construct URL + url = self.get.metadata['url'] + path_format_arguments = { + 'subscriptionId': self._serialize.url("self._config.subscription_id", self._config.subscription_id, 'str', pattern=r'^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$'), + 'resourceGroupName': self._serialize.url("resource_group_name", resource_group_name, 'str', max_length=90, min_length=1, pattern=r'^[-\w\._\(\)]+$'), + 'workspaceName': self._serialize.url("workspace_name", workspace_name, 'str', max_length=90, min_length=1), + 'alertRuleTemplateId': self._serialize.url("alert_rule_template_id", alert_rule_template_id, 'str'), + } + url = self._client.format_url(url, **path_format_arguments) + + # Construct parameters + query_parameters = {} # type: Dict[str, Any] + query_parameters['api-version'] = self._serialize.query("api_version", api_version, 'str') + + # Construct headers + header_parameters = {} # type: Dict[str, Any] + header_parameters['Accept'] = 'application/json' + + # Construct and send request + request = self._client.get(url, query_parameters, header_parameters) + pipeline_response = self._client._pipeline.run(request, stream=False, **kwargs) + response = pipeline_response.http_response + + if response.status_code not in [200]: + map_error(status_code=response.status_code, response=response, error_map=error_map) + raise HttpResponseError(response=response, error_format=ARMErrorFormat) + + deserialized = self._deserialize('AlertRuleTemplate', pipeline_response) + + if cls: + return cls(pipeline_response, deserialized, {}) + + return deserialized + get.metadata = {'url': '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRuleTemplates/{alertRuleTemplateId}'} diff --git a/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/operations/_bookmark_operations.py b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/operations/_bookmark_operations.py new file mode 100644 index 00000000000..2a301b32045 --- /dev/null +++ b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/operations/_bookmark_operations.py @@ -0,0 +1,344 @@ +# coding=utf-8 +# -------------------------------------------------------------------------- +# Copyright (c) Microsoft Corporation. All rights reserved. +# Licensed under the MIT License. See License.txt in the project root for license information. +# Code generated by Microsoft (R) AutoRest Code Generator. +# Changes may cause incorrect behavior and will be lost if the code is regenerated. +# -------------------------------------------------------------------------- +import datetime +from typing import TYPE_CHECKING +import warnings + +from azure.core.exceptions import HttpResponseError, ResourceExistsError, ResourceNotFoundError, map_error +from azure.core.paging import ItemPaged +from azure.core.pipeline import PipelineResponse +from azure.core.pipeline.transport import HttpRequest, HttpResponse +from azure.mgmt.core.exceptions import ARMErrorFormat + +from .. import models + +if TYPE_CHECKING: + # pylint: disable=unused-import,ungrouped-imports + from typing import Any, Callable, Dict, Generic, List, Optional, TypeVar, Union + + T = TypeVar('T') + ClsType = Optional[Callable[[PipelineResponse[HttpRequest, HttpResponse], T, Dict[str, Any]], Any]] + +class BookmarkOperations(object): + """BookmarkOperations operations. + + You should not instantiate this class directly. Instead, you should create a Client instance that + instantiates it for you and attaches it as an attribute. + + :ivar models: Alias to model classes used in this operation group. + :type models: ~azure.mgmt.securityinsight.models + :param client: Client for service requests. + :param config: Configuration of service client. + :param serializer: An object model serializer. + :param deserializer: An object model deserializer. + """ + + models = models + + def __init__(self, client, config, serializer, deserializer): + self._client = client + self._serialize = serializer + self._deserialize = deserializer + self._config = config + + def list( + self, + resource_group_name, # type: str + workspace_name, # type: str + **kwargs # type: Any + ): + # type: (...) -> "models.BookmarkList" + """Gets all bookmarks. + + :param resource_group_name: The name of the resource group within the user's subscription. The + name is case insensitive. + :type resource_group_name: str + :param workspace_name: The name of the workspace. + :type workspace_name: str + :keyword callable cls: A custom type or function that will be passed the direct response + :return: BookmarkList or the result of cls(response) + :rtype: ~azure.mgmt.securityinsight.models.BookmarkList + :raises: ~azure.core.exceptions.HttpResponseError + """ + cls = kwargs.pop('cls', None) # type: ClsType["models.BookmarkList"] + error_map = kwargs.pop('error_map', {404: ResourceNotFoundError, 409: ResourceExistsError}) + api_version = "2020-01-01" + + def prepare_request(next_link=None): + if not next_link: + # Construct URL + url = self.list.metadata['url'] + path_format_arguments = { + 'subscriptionId': self._serialize.url("self._config.subscription_id", self._config.subscription_id, 'str', pattern=r'^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$'), + 'resourceGroupName': self._serialize.url("resource_group_name", resource_group_name, 'str', max_length=90, min_length=1, pattern=r'^[-\w\._\(\)]+$'), + 'workspaceName': self._serialize.url("workspace_name", workspace_name, 'str', max_length=90, min_length=1), + } + url = self._client.format_url(url, **path_format_arguments) + else: + url = next_link + + # Construct parameters + query_parameters = {} # type: Dict[str, Any] + query_parameters['api-version'] = self._serialize.query("api_version", api_version, 'str') + + # Construct headers + header_parameters = {} # type: Dict[str, Any] + header_parameters['Accept'] = 'application/json' + + # Construct and send request + request = self._client.get(url, query_parameters, header_parameters) + return request + + def extract_data(pipeline_response): + deserialized = self._deserialize('BookmarkList', pipeline_response) + list_of_elem = deserialized.value + if cls: + list_of_elem = cls(list_of_elem) + return deserialized.next_link or None, iter(list_of_elem) + + def get_next(next_link=None): + request = prepare_request(next_link) + + pipeline_response = self._client._pipeline.run(request, stream=False, **kwargs) + response = pipeline_response.http_response + + if response.status_code not in [200]: + map_error(status_code=response.status_code, response=response, error_map=error_map) + raise HttpResponseError(response=response, error_format=ARMErrorFormat) + + return pipeline_response + + return ItemPaged( + get_next, extract_data + ) + list.metadata = {'url': '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/bookmarks'} + + def get( + self, + resource_group_name, # type: str + workspace_name, # type: str + bookmark_id, # type: str + **kwargs # type: Any + ): + # type: (...) -> "models.Bookmark" + """Gets a bookmark. + + :param resource_group_name: The name of the resource group within the user's subscription. The + name is case insensitive. + :type resource_group_name: str + :param workspace_name: The name of the workspace. + :type workspace_name: str + :param bookmark_id: Bookmark ID. + :type bookmark_id: str + :keyword callable cls: A custom type or function that will be passed the direct response + :return: Bookmark or the result of cls(response) + :rtype: ~azure.mgmt.securityinsight.models.Bookmark + :raises: ~azure.core.exceptions.HttpResponseError + """ + cls = kwargs.pop('cls', None) # type: ClsType["models.Bookmark"] + error_map = kwargs.pop('error_map', {404: ResourceNotFoundError, 409: ResourceExistsError}) + api_version = "2020-01-01" + + # Construct URL + url = self.get.metadata['url'] + path_format_arguments = { + 'subscriptionId': self._serialize.url("self._config.subscription_id", self._config.subscription_id, 'str', pattern=r'^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$'), + 'resourceGroupName': self._serialize.url("resource_group_name", resource_group_name, 'str', max_length=90, min_length=1, pattern=r'^[-\w\._\(\)]+$'), + 'workspaceName': self._serialize.url("workspace_name", workspace_name, 'str', max_length=90, min_length=1), + 'bookmarkId': self._serialize.url("bookmark_id", bookmark_id, 'str'), + } + url = self._client.format_url(url, **path_format_arguments) + + # Construct parameters + query_parameters = {} # type: Dict[str, Any] + query_parameters['api-version'] = self._serialize.query("api_version", api_version, 'str') + + # Construct headers + header_parameters = {} # type: Dict[str, Any] + header_parameters['Accept'] = 'application/json' + + # Construct and send request + request = self._client.get(url, query_parameters, header_parameters) + pipeline_response = self._client._pipeline.run(request, stream=False, **kwargs) + response = pipeline_response.http_response + + if response.status_code not in [200]: + map_error(status_code=response.status_code, response=response, error_map=error_map) + raise HttpResponseError(response=response, error_format=ARMErrorFormat) + + deserialized = self._deserialize('Bookmark', pipeline_response) + + if cls: + return cls(pipeline_response, deserialized, {}) + + return deserialized + get.metadata = {'url': '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/bookmarks/{bookmarkId}'} + + def create_or_update( + self, + resource_group_name, # type: str + workspace_name, # type: str + bookmark_id, # type: str + etag=None, # type: Optional[str] + created=None, # type: Optional[datetime.datetime] + created_by=None, # type: Optional["models.UserInfo"] + display_name=None, # type: Optional[str] + labels=None, # type: Optional[List[str]] + notes=None, # type: Optional[str] + query=None, # type: Optional[str] + query_result=None, # type: Optional[str] + updated=None, # type: Optional[datetime.datetime] + updated_by=None, # type: Optional["models.UserInfo"] + incident_info=None, # type: Optional["models.IncidentInfo"] + **kwargs # type: Any + ): + # type: (...) -> "models.Bookmark" + """Creates or updates the bookmark. + + :param resource_group_name: The name of the resource group within the user's subscription. The + name is case insensitive. + :type resource_group_name: str + :param workspace_name: The name of the workspace. + :type workspace_name: str + :param bookmark_id: Bookmark ID. + :type bookmark_id: str + :param etag: Etag of the azure resource. + :type etag: str + :param created: The time the bookmark was created. + :type created: ~datetime.datetime + :param created_by: Describes a user that created the bookmark. + :type created_by: ~azure.mgmt.securityinsight.models.UserInfo + :param display_name: The display name of the bookmark. + :type display_name: str + :param labels: List of labels relevant to this bookmark. + :type labels: list[str] + :param notes: The notes of the bookmark. + :type notes: str + :param query: The query of the bookmark. + :type query: str + :param query_result: The query result of the bookmark. + :type query_result: str + :param updated: The last time the bookmark was updated. + :type updated: ~datetime.datetime + :param updated_by: Describes a user that updated the bookmark. + :type updated_by: ~azure.mgmt.securityinsight.models.UserInfo + :param incident_info: Describes an incident that relates to bookmark. + :type incident_info: ~azure.mgmt.securityinsight.models.IncidentInfo + :keyword callable cls: A custom type or function that will be passed the direct response + :return: Bookmark or the result of cls(response) + :rtype: ~azure.mgmt.securityinsight.models.Bookmark or ~azure.mgmt.securityinsight.models.Bookmark + :raises: ~azure.core.exceptions.HttpResponseError + """ + cls = kwargs.pop('cls', None) # type: ClsType["models.Bookmark"] + error_map = kwargs.pop('error_map', {404: ResourceNotFoundError, 409: ResourceExistsError}) + + _bookmark = models.Bookmark(etag=etag, created=created, created_by=created_by, display_name=display_name, labels=labels, notes=notes, query=query, query_result=query_result, updated=updated, updated_by=updated_by, incident_info=incident_info) + api_version = "2020-01-01" + content_type = kwargs.pop("content_type", "application/json") + + # Construct URL + url = self.create_or_update.metadata['url'] + path_format_arguments = { + 'subscriptionId': self._serialize.url("self._config.subscription_id", self._config.subscription_id, 'str', pattern=r'^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$'), + 'resourceGroupName': self._serialize.url("resource_group_name", resource_group_name, 'str', max_length=90, min_length=1, pattern=r'^[-\w\._\(\)]+$'), + 'workspaceName': self._serialize.url("workspace_name", workspace_name, 'str', max_length=90, min_length=1), + 'bookmarkId': self._serialize.url("bookmark_id", bookmark_id, 'str'), + } + url = self._client.format_url(url, **path_format_arguments) + + # Construct parameters + query_parameters = {} # type: Dict[str, Any] + query_parameters['api-version'] = self._serialize.query("api_version", api_version, 'str') + + # Construct headers + header_parameters = {} # type: Dict[str, Any] + header_parameters['Content-Type'] = self._serialize.header("content_type", content_type, 'str') + header_parameters['Accept'] = 'application/json' + + # Construct and send request + body_content_kwargs = {} # type: Dict[str, Any] + body_content = self._serialize.body(_bookmark, 'Bookmark') + body_content_kwargs['content'] = body_content + request = self._client.put(url, query_parameters, header_parameters, **body_content_kwargs) + + pipeline_response = self._client._pipeline.run(request, stream=False, **kwargs) + response = pipeline_response.http_response + + if response.status_code not in [200, 201]: + map_error(status_code=response.status_code, response=response, error_map=error_map) + raise HttpResponseError(response=response, error_format=ARMErrorFormat) + + deserialized = None + if response.status_code == 200: + deserialized = self._deserialize('Bookmark', pipeline_response) + + if response.status_code == 201: + deserialized = self._deserialize('Bookmark', pipeline_response) + + if cls: + return cls(pipeline_response, deserialized, {}) + + return deserialized + create_or_update.metadata = {'url': '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/bookmarks/{bookmarkId}'} + + def delete( + self, + resource_group_name, # type: str + workspace_name, # type: str + bookmark_id, # type: str + **kwargs # type: Any + ): + # type: (...) -> None + """Delete the bookmark. + + :param resource_group_name: The name of the resource group within the user's subscription. The + name is case insensitive. + :type resource_group_name: str + :param workspace_name: The name of the workspace. + :type workspace_name: str + :param bookmark_id: Bookmark ID. + :type bookmark_id: str + :keyword callable cls: A custom type or function that will be passed the direct response + :return: None or the result of cls(response) + :rtype: None + :raises: ~azure.core.exceptions.HttpResponseError + """ + cls = kwargs.pop('cls', None) # type: ClsType[None] + error_map = kwargs.pop('error_map', {404: ResourceNotFoundError, 409: ResourceExistsError}) + api_version = "2020-01-01" + + # Construct URL + url = self.delete.metadata['url'] + path_format_arguments = { + 'subscriptionId': self._serialize.url("self._config.subscription_id", self._config.subscription_id, 'str', pattern=r'^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$'), + 'resourceGroupName': self._serialize.url("resource_group_name", resource_group_name, 'str', max_length=90, min_length=1, pattern=r'^[-\w\._\(\)]+$'), + 'workspaceName': self._serialize.url("workspace_name", workspace_name, 'str', max_length=90, min_length=1), + 'bookmarkId': self._serialize.url("bookmark_id", bookmark_id, 'str'), + } + url = self._client.format_url(url, **path_format_arguments) + + # Construct parameters + query_parameters = {} # type: Dict[str, Any] + query_parameters['api-version'] = self._serialize.query("api_version", api_version, 'str') + + # Construct headers + header_parameters = {} # type: Dict[str, Any] + + # Construct and send request + request = self._client.delete(url, query_parameters, header_parameters) + pipeline_response = self._client._pipeline.run(request, stream=False, **kwargs) + response = pipeline_response.http_response + + if response.status_code not in [200, 204]: + map_error(status_code=response.status_code, response=response, error_map=error_map) + raise HttpResponseError(response=response, error_format=ARMErrorFormat) + + if cls: + return cls(pipeline_response, None, {}) + + delete.metadata = {'url': '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/bookmarks/{bookmarkId}'} diff --git a/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/operations/_incident_comment_operations.py b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/operations/_incident_comment_operations.py new file mode 100644 index 00000000000..d87634a2530 --- /dev/null +++ b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/operations/_incident_comment_operations.py @@ -0,0 +1,285 @@ +# coding=utf-8 +# -------------------------------------------------------------------------- +# Copyright (c) Microsoft Corporation. All rights reserved. +# Licensed under the MIT License. See License.txt in the project root for license information. +# Code generated by Microsoft (R) AutoRest Code Generator. +# Changes may cause incorrect behavior and will be lost if the code is regenerated. +# -------------------------------------------------------------------------- +from typing import TYPE_CHECKING +import warnings + +from azure.core.exceptions import HttpResponseError, ResourceExistsError, ResourceNotFoundError, map_error +from azure.core.paging import ItemPaged +from azure.core.pipeline import PipelineResponse +from azure.core.pipeline.transport import HttpRequest, HttpResponse +from azure.mgmt.core.exceptions import ARMErrorFormat + +from .. import models + +if TYPE_CHECKING: + # pylint: disable=unused-import,ungrouped-imports + from typing import Any, Callable, Dict, Generic, Optional, TypeVar + + T = TypeVar('T') + ClsType = Optional[Callable[[PipelineResponse[HttpRequest, HttpResponse], T, Dict[str, Any]], Any]] + +class IncidentCommentOperations(object): + """IncidentCommentOperations operations. + + You should not instantiate this class directly. Instead, you should create a Client instance that + instantiates it for you and attaches it as an attribute. + + :ivar models: Alias to model classes used in this operation group. + :type models: ~azure.mgmt.securityinsight.models + :param client: Client for service requests. + :param config: Configuration of service client. + :param serializer: An object model serializer. + :param deserializer: An object model deserializer. + """ + + models = models + + def __init__(self, client, config, serializer, deserializer): + self._client = client + self._serialize = serializer + self._deserialize = deserializer + self._config = config + + def list_by_incident( + self, + resource_group_name, # type: str + workspace_name, # type: str + incident_id, # type: str + filter=None, # type: Optional[str] + orderby=None, # type: Optional[str] + top=None, # type: Optional[int] + skip_token=None, # type: Optional[str] + **kwargs # type: Any + ): + # type: (...) -> "models.IncidentCommentList" + """Gets all incident comments. + + :param resource_group_name: The name of the resource group within the user's subscription. The + name is case insensitive. + :type resource_group_name: str + :param workspace_name: The name of the workspace. + :type workspace_name: str + :param incident_id: Incident ID. + :type incident_id: str + :param filter: Filters the results, based on a Boolean condition. Optional. + :type filter: str + :param orderby: Sorts the results. Optional. + :type orderby: str + :param top: Returns only the first n results. Optional. + :type top: int + :param skip_token: Skiptoken is only used if a previous operation returned a partial result. If + a previous response contains a nextLink element, the value of the nextLink element will include + a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional. + :type skip_token: str + :keyword callable cls: A custom type or function that will be passed the direct response + :return: IncidentCommentList or the result of cls(response) + :rtype: ~azure.mgmt.securityinsight.models.IncidentCommentList + :raises: ~azure.core.exceptions.HttpResponseError + """ + cls = kwargs.pop('cls', None) # type: ClsType["models.IncidentCommentList"] + error_map = kwargs.pop('error_map', {404: ResourceNotFoundError, 409: ResourceExistsError}) + api_version = "2020-01-01" + + def prepare_request(next_link=None): + if not next_link: + # Construct URL + url = self.list_by_incident.metadata['url'] + path_format_arguments = { + 'subscriptionId': self._serialize.url("self._config.subscription_id", self._config.subscription_id, 'str', pattern=r'^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$'), + 'resourceGroupName': self._serialize.url("resource_group_name", resource_group_name, 'str', max_length=90, min_length=1, pattern=r'^[-\w\._\(\)]+$'), + 'workspaceName': self._serialize.url("workspace_name", workspace_name, 'str', max_length=90, min_length=1), + 'incidentId': self._serialize.url("incident_id", incident_id, 'str'), + } + url = self._client.format_url(url, **path_format_arguments) + else: + url = next_link + + # Construct parameters + query_parameters = {} # type: Dict[str, Any] + query_parameters['api-version'] = self._serialize.query("api_version", api_version, 'str') + if filter is not None: + query_parameters['$filter'] = self._serialize.query("filter", filter, 'str') + if orderby is not None: + query_parameters['$orderby'] = self._serialize.query("orderby", orderby, 'str') + if top is not None: + query_parameters['$top'] = self._serialize.query("top", top, 'int') + if skip_token is not None: + query_parameters['$skipToken'] = self._serialize.query("skip_token", skip_token, 'str') + + # Construct headers + header_parameters = {} # type: Dict[str, Any] + header_parameters['Accept'] = 'application/json' + + # Construct and send request + request = self._client.get(url, query_parameters, header_parameters) + return request + + def extract_data(pipeline_response): + deserialized = self._deserialize('IncidentCommentList', pipeline_response) + list_of_elem = deserialized.value + if cls: + list_of_elem = cls(list_of_elem) + return deserialized.next_link or None, iter(list_of_elem) + + def get_next(next_link=None): + request = prepare_request(next_link) + + pipeline_response = self._client._pipeline.run(request, stream=False, **kwargs) + response = pipeline_response.http_response + + if response.status_code not in [200]: + map_error(status_code=response.status_code, response=response, error_map=error_map) + raise HttpResponseError(response=response, error_format=ARMErrorFormat) + + return pipeline_response + + return ItemPaged( + get_next, extract_data + ) + list_by_incident.metadata = {'url': '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/comments'} + + def get_comment( + self, + resource_group_name, # type: str + workspace_name, # type: str + incident_id, # type: str + incident_comment_id, # type: str + **kwargs # type: Any + ): + # type: (...) -> "models.IncidentComment" + """Gets an incident comment. + + :param resource_group_name: The name of the resource group within the user's subscription. The + name is case insensitive. + :type resource_group_name: str + :param workspace_name: The name of the workspace. + :type workspace_name: str + :param incident_id: Incident ID. + :type incident_id: str + :param incident_comment_id: Incident comment ID. + :type incident_comment_id: str + :keyword callable cls: A custom type or function that will be passed the direct response + :return: IncidentComment or the result of cls(response) + :rtype: ~azure.mgmt.securityinsight.models.IncidentComment + :raises: ~azure.core.exceptions.HttpResponseError + """ + cls = kwargs.pop('cls', None) # type: ClsType["models.IncidentComment"] + error_map = kwargs.pop('error_map', {404: ResourceNotFoundError, 409: ResourceExistsError}) + api_version = "2020-01-01" + + # Construct URL + url = self.get_comment.metadata['url'] + path_format_arguments = { + 'subscriptionId': self._serialize.url("self._config.subscription_id", self._config.subscription_id, 'str', pattern=r'^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$'), + 'resourceGroupName': self._serialize.url("resource_group_name", resource_group_name, 'str', max_length=90, min_length=1, pattern=r'^[-\w\._\(\)]+$'), + 'workspaceName': self._serialize.url("workspace_name", workspace_name, 'str', max_length=90, min_length=1), + 'incidentId': self._serialize.url("incident_id", incident_id, 'str'), + 'incidentCommentId': self._serialize.url("incident_comment_id", incident_comment_id, 'str'), + } + url = self._client.format_url(url, **path_format_arguments) + + # Construct parameters + query_parameters = {} # type: Dict[str, Any] + query_parameters['api-version'] = self._serialize.query("api_version", api_version, 'str') + + # Construct headers + header_parameters = {} # type: Dict[str, Any] + header_parameters['Accept'] = 'application/json' + + # Construct and send request + request = self._client.get(url, query_parameters, header_parameters) + pipeline_response = self._client._pipeline.run(request, stream=False, **kwargs) + response = pipeline_response.http_response + + if response.status_code not in [200]: + map_error(status_code=response.status_code, response=response, error_map=error_map) + raise HttpResponseError(response=response, error_format=ARMErrorFormat) + + deserialized = self._deserialize('IncidentComment', pipeline_response) + + if cls: + return cls(pipeline_response, deserialized, {}) + + return deserialized + get_comment.metadata = {'url': '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/comments/{incidentCommentId}'} + + def create_comment( + self, + resource_group_name, # type: str + workspace_name, # type: str + incident_id, # type: str + incident_comment_id, # type: str + message=None, # type: Optional[str] + **kwargs # type: Any + ): + # type: (...) -> "models.IncidentComment" + """Creates the incident comment. + + :param resource_group_name: The name of the resource group within the user's subscription. The + name is case insensitive. + :type resource_group_name: str + :param workspace_name: The name of the workspace. + :type workspace_name: str + :param incident_id: Incident ID. + :type incident_id: str + :param incident_comment_id: Incident comment ID. + :type incident_comment_id: str + :param message: The comment message. + :type message: str + :keyword callable cls: A custom type or function that will be passed the direct response + :return: IncidentComment or the result of cls(response) + :rtype: ~azure.mgmt.securityinsight.models.IncidentComment + :raises: ~azure.core.exceptions.HttpResponseError + """ + cls = kwargs.pop('cls', None) # type: ClsType["models.IncidentComment"] + error_map = kwargs.pop('error_map', {404: ResourceNotFoundError, 409: ResourceExistsError}) + + _incident_comment = models.IncidentComment(message=message) + api_version = "2020-01-01" + content_type = kwargs.pop("content_type", "application/json") + + # Construct URL + url = self.create_comment.metadata['url'] + path_format_arguments = { + 'subscriptionId': self._serialize.url("self._config.subscription_id", self._config.subscription_id, 'str', pattern=r'^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$'), + 'resourceGroupName': self._serialize.url("resource_group_name", resource_group_name, 'str', max_length=90, min_length=1, pattern=r'^[-\w\._\(\)]+$'), + 'workspaceName': self._serialize.url("workspace_name", workspace_name, 'str', max_length=90, min_length=1), + 'incidentId': self._serialize.url("incident_id", incident_id, 'str'), + 'incidentCommentId': self._serialize.url("incident_comment_id", incident_comment_id, 'str'), + } + url = self._client.format_url(url, **path_format_arguments) + + # Construct parameters + query_parameters = {} # type: Dict[str, Any] + query_parameters['api-version'] = self._serialize.query("api_version", api_version, 'str') + + # Construct headers + header_parameters = {} # type: Dict[str, Any] + header_parameters['Content-Type'] = self._serialize.header("content_type", content_type, 'str') + header_parameters['Accept'] = 'application/json' + + # Construct and send request + body_content_kwargs = {} # type: Dict[str, Any] + body_content = self._serialize.body(_incident_comment, 'IncidentComment') + body_content_kwargs['content'] = body_content + request = self._client.put(url, query_parameters, header_parameters, **body_content_kwargs) + + pipeline_response = self._client._pipeline.run(request, stream=False, **kwargs) + response = pipeline_response.http_response + + if response.status_code not in [201]: + map_error(status_code=response.status_code, response=response, error_map=error_map) + raise HttpResponseError(response=response, error_format=ARMErrorFormat) + + deserialized = self._deserialize('IncidentComment', pipeline_response) + + if cls: + return cls(pipeline_response, deserialized, {}) + + return deserialized + create_comment.metadata = {'url': '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/comments/{incidentCommentId}'} diff --git a/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/operations/_incident_operations.py b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/operations/_incident_operations.py new file mode 100644 index 00000000000..93d9fdde994 --- /dev/null +++ b/src/securityinsight/azext_sentinel/vendored_sdks/securityinsight/operations/_incident_operations.py @@ -0,0 +1,369 @@ +# coding=utf-8 +# -------------------------------------------------------------------------- +# Copyright (c) Microsoft Corporation. All rights reserved. +# Licensed under the MIT License. See License.txt in the project root for license information. +# Code generated by Microsoft (R) AutoRest Code Generator. +# Changes may cause incorrect behavior and will be lost if the code is regenerated. +# -------------------------------------------------------------------------- +import datetime +from typing import TYPE_CHECKING +import warnings + +from azure.core.exceptions import HttpResponseError, ResourceExistsError, ResourceNotFoundError, map_error +from azure.core.paging import ItemPaged +from azure.core.pipeline import PipelineResponse +from azure.core.pipeline.transport import HttpRequest, HttpResponse +from azure.mgmt.core.exceptions import ARMErrorFormat + +from .. import models + +if TYPE_CHECKING: + # pylint: disable=unused-import,ungrouped-imports + from typing import Any, Callable, Dict, Generic, List, Optional, TypeVar, Union + + T = TypeVar('T') + ClsType = Optional[Callable[[PipelineResponse[HttpRequest, HttpResponse], T, Dict[str, Any]], Any]] + +class IncidentOperations(object): + """IncidentOperations operations. + + You should not instantiate this class directly. Instead, you should create a Client instance that + instantiates it for you and attaches it as an attribute. + + :ivar models: Alias to model classes used in this operation group. + :type models: ~azure.mgmt.securityinsight.models + :param client: Client for service requests. + :param config: Configuration of service client. + :param serializer: An object model serializer. + :param deserializer: An object model deserializer. + """ + + models = models + + def __init__(self, client, config, serializer, deserializer): + self._client = client + self._serialize = serializer + self._deserialize = deserializer + self._config = config + + def list( + self, + resource_group_name, # type: str + workspace_name, # type: str + filter=None, # type: Optional[str] + orderby=None, # type: Optional[str] + top=None, # type: Optional[int] + skip_token=None, # type: Optional[str] + **kwargs # type: Any + ): + # type: (...) -> "models.IncidentList" + """Gets all incidents. + + :param resource_group_name: The name of the resource group within the user's subscription. The + name is case insensitive. + :type resource_group_name: str + :param workspace_name: The name of the workspace. + :type workspace_name: str + :param filter: Filters the results, based on a Boolean condition. Optional. + :type filter: str + :param orderby: Sorts the results. Optional. + :type orderby: str + :param top: Returns only the first n results. Optional. + :type top: int + :param skip_token: Skiptoken is only used if a previous operation returned a partial result. If + a previous response contains a nextLink element, the value of the nextLink element will include + a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional. + :type skip_token: str + :keyword callable cls: A custom type or function that will be passed the direct response + :return: IncidentList or the result of cls(response) + :rtype: ~azure.mgmt.securityinsight.models.IncidentList + :raises: ~azure.core.exceptions.HttpResponseError + """ + cls = kwargs.pop('cls', None) # type: ClsType["models.IncidentList"] + error_map = kwargs.pop('error_map', {404: ResourceNotFoundError, 409: ResourceExistsError}) + api_version = "2020-01-01" + + def prepare_request(next_link=None): + if not next_link: + # Construct URL + url = self.list.metadata['url'] + path_format_arguments = { + 'subscriptionId': self._serialize.url("self._config.subscription_id", self._config.subscription_id, 'str', pattern=r'^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$'), + 'resourceGroupName': self._serialize.url("resource_group_name", resource_group_name, 'str', max_length=90, min_length=1, pattern=r'^[-\w\._\(\)]+$'), + 'workspaceName': self._serialize.url("workspace_name", workspace_name, 'str', max_length=90, min_length=1), + } + url = self._client.format_url(url, **path_format_arguments) + else: + url = next_link + + # Construct parameters + query_parameters = {} # type: Dict[str, Any] + query_parameters['api-version'] = self._serialize.query("api_version", api_version, 'str') + if filter is not None: + query_parameters['$filter'] = self._serialize.query("filter", filter, 'str') + if orderby is not None: + query_parameters['$orderby'] = self._serialize.query("orderby", orderby, 'str') + if top is not None: + query_parameters['$top'] = self._serialize.query("top", top, 'int') + if skip_token is not None: + query_parameters['$skipToken'] = self._serialize.query("skip_token", skip_token, 'str') + + # Construct headers + header_parameters = {} # type: Dict[str, Any] + header_parameters['Accept'] = 'application/json' + + # Construct and send request + request = self._client.get(url, query_parameters, header_parameters) + return request + + def extract_data(pipeline_response): + deserialized = self._deserialize('IncidentList', pipeline_response) + list_of_elem = deserialized.value + if cls: + list_of_elem = cls(list_of_elem) + return deserialized.next_link or None, iter(list_of_elem) + + def get_next(next_link=None): + request = prepare_request(next_link) + + pipeline_response = self._client._pipeline.run(request, stream=False, **kwargs) + response = pipeline_response.http_response + + if response.status_code not in [200]: + map_error(status_code=response.status_code, response=response, error_map=error_map) + raise HttpResponseError(response=response, error_format=ARMErrorFormat) + + return pipeline_response + + return ItemPaged( + get_next, extract_data + ) + list.metadata = {'url': '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents'} + + def get( + self, + resource_group_name, # type: str + workspace_name, # type: str + incident_id, # type: str + **kwargs # type: Any + ): + # type: (...) -> "models.Incident" + """Gets an incident. + + :param resource_group_name: The name of the resource group within the user's subscription. The + name is case insensitive. + :type resource_group_name: str + :param workspace_name: The name of the workspace. + :type workspace_name: str + :param incident_id: Incident ID. + :type incident_id: str + :keyword callable cls: A custom type or function that will be passed the direct response + :return: Incident or the result of cls(response) + :rtype: ~azure.mgmt.securityinsight.models.Incident + :raises: ~azure.core.exceptions.HttpResponseError + """ + cls = kwargs.pop('cls', None) # type: ClsType["models.Incident"] + error_map = kwargs.pop('error_map', {404: ResourceNotFoundError, 409: ResourceExistsError}) + api_version = "2020-01-01" + + # Construct URL + url = self.get.metadata['url'] + path_format_arguments = { + 'subscriptionId': self._serialize.url("self._config.subscription_id", self._config.subscription_id, 'str', pattern=r'^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$'), + 'resourceGroupName': self._serialize.url("resource_group_name", resource_group_name, 'str', max_length=90, min_length=1, pattern=r'^[-\w\._\(\)]+$'), + 'workspaceName': self._serialize.url("workspace_name", workspace_name, 'str', max_length=90, min_length=1), + 'incidentId': self._serialize.url("incident_id", incident_id, 'str'), + } + url = self._client.format_url(url, **path_format_arguments) + + # Construct parameters + query_parameters = {} # type: Dict[str, Any] + query_parameters['api-version'] = self._serialize.query("api_version", api_version, 'str') + + # Construct headers + header_parameters = {} # type: Dict[str, Any] + header_parameters['Accept'] = 'application/json' + + # Construct and send request + request = self._client.get(url, query_parameters, header_parameters) + pipeline_response = self._client._pipeline.run(request, stream=False, **kwargs) + response = pipeline_response.http_response + + if response.status_code not in [200]: + map_error(status_code=response.status_code, response=response, error_map=error_map) + raise HttpResponseError(response=response, error_format=ARMErrorFormat) + + deserialized = self._deserialize('Incident', pipeline_response) + + if cls: + return cls(pipeline_response, deserialized, {}) + + return deserialized + get.metadata = {'url': '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}'} + + def create_or_update( + self, + resource_group_name, # type: str + workspace_name, # type: str + incident_id, # type: str + etag=None, # type: Optional[str] + classification=None, # type: Optional[Union[str, "models.IncidentClassification"]] + classification_comment=None, # type: Optional[str] + classification_reason=None, # type: Optional[Union[str, "models.IncidentClassificationReason"]] + description=None, # type: Optional[str] + first_activity_time_utc=None, # type: Optional[datetime.datetime] + labels=None, # type: Optional[List["IncidentLabel"]] + last_activity_time_utc=None, # type: Optional[datetime.datetime] + owner=None, # type: Optional["models.IncidentOwnerInfo"] + severity=None, # type: Optional[Union[str, "models.IncidentSeverity"]] + status=None, # type: Optional[Union[str, "models.IncidentStatus"]] + title=None, # type: Optional[str] + **kwargs # type: Any + ): + # type: (...) -> "models.Incident" + """Creates or updates the incident. + + :param resource_group_name: The name of the resource group within the user's subscription. The + name is case insensitive. + :type resource_group_name: str + :param workspace_name: The name of the workspace. + :type workspace_name: str + :param incident_id: Incident ID. + :type incident_id: str + :param etag: Etag of the azure resource. + :type etag: str + :param classification: The reason the incident was closed. + :type classification: str or ~azure.mgmt.securityinsight.models.IncidentClassification + :param classification_comment: Describes the reason the incident was closed. + :type classification_comment: str + :param classification_reason: The classification reason the incident was closed with. + :type classification_reason: str or ~azure.mgmt.securityinsight.models.IncidentClassificationReason + :param description: The description of the incident. + :type description: str + :param first_activity_time_utc: The time of the first activity in the incident. + :type first_activity_time_utc: ~datetime.datetime + :param labels: List of labels relevant to this incident. + :type labels: list[~azure.mgmt.securityinsight.models.IncidentLabel] + :param last_activity_time_utc: The time of the last activity in the incident. + :type last_activity_time_utc: ~datetime.datetime + :param owner: Describes a user that the incident is assigned to. + :type owner: ~azure.mgmt.securityinsight.models.IncidentOwnerInfo + :param severity: The severity of the incident. + :type severity: str or ~azure.mgmt.securityinsight.models.IncidentSeverity + :param status: The status of the incident. + :type status: str or ~azure.mgmt.securityinsight.models.IncidentStatus + :param title: The title of the incident. + :type title: str + :keyword callable cls: A custom type or function that will be passed the direct response + :return: Incident or the result of cls(response) + :rtype: ~azure.mgmt.securityinsight.models.Incident or ~azure.mgmt.securityinsight.models.Incident + :raises: ~azure.core.exceptions.HttpResponseError + """ + cls = kwargs.pop('cls', None) # type: ClsType["models.Incident"] + error_map = kwargs.pop('error_map', {404: ResourceNotFoundError, 409: ResourceExistsError}) + + _incident = models.Incident(etag=etag, classification=classification, classification_comment=classification_comment, classification_reason=classification_reason, description=description, first_activity_time_utc=first_activity_time_utc, labels=labels, last_activity_time_utc=last_activity_time_utc, owner=owner, severity=severity, status=status, title=title) + api_version = "2020-01-01" + content_type = kwargs.pop("content_type", "application/json") + + # Construct URL + url = self.create_or_update.metadata['url'] + path_format_arguments = { + 'subscriptionId': self._serialize.url("self._config.subscription_id", self._config.subscription_id, 'str', pattern=r'^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$'), + 'resourceGroupName': self._serialize.url("resource_group_name", resource_group_name, 'str', max_length=90, min_length=1, pattern=r'^[-\w\._\(\)]+$'), + 'workspaceName': self._serialize.url("workspace_name", workspace_name, 'str', max_length=90, min_length=1), + 'incidentId': self._serialize.url("incident_id", incident_id, 'str'), + } + url = self._client.format_url(url, **path_format_arguments) + + # Construct parameters + query_parameters = {} # type: Dict[str, Any] + query_parameters['api-version'] = self._serialize.query("api_version", api_version, 'str') + + # Construct headers + header_parameters = {} # type: Dict[str, Any] + header_parameters['Content-Type'] = self._serialize.header("content_type", content_type, 'str') + header_parameters['Accept'] = 'application/json' + + # Construct and send request + body_content_kwargs = {} # type: Dict[str, Any] + body_content = self._serialize.body(_incident, 'Incident') + body_content_kwargs['content'] = body_content + request = self._client.put(url, query_parameters, header_parameters, **body_content_kwargs) + + pipeline_response = self._client._pipeline.run(request, stream=False, **kwargs) + response = pipeline_response.http_response + + if response.status_code not in [200, 201]: + map_error(status_code=response.status_code, response=response, error_map=error_map) + raise HttpResponseError(response=response, error_format=ARMErrorFormat) + + deserialized = None + if response.status_code == 200: + deserialized = self._deserialize('Incident', pipeline_response) + + if response.status_code == 201: + deserialized = self._deserialize('Incident', pipeline_response) + + if cls: + return cls(pipeline_response, deserialized, {}) + + return deserialized + create_or_update.metadata = {'url': '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}'} + + def delete( + self, + resource_group_name, # type: str + workspace_name, # type: str + incident_id, # type: str + **kwargs # type: Any + ): + # type: (...) -> None + """Delete the incident. + + :param resource_group_name: The name of the resource group within the user's subscription. The + name is case insensitive. + :type resource_group_name: str + :param workspace_name: The name of the workspace. + :type workspace_name: str + :param incident_id: Incident ID. + :type incident_id: str + :keyword callable cls: A custom type or function that will be passed the direct response + :return: None or the result of cls(response) + :rtype: None + :raises: ~azure.core.exceptions.HttpResponseError + """ + cls = kwargs.pop('cls', None) # type: ClsType[None] + error_map = kwargs.pop('error_map', {404: ResourceNotFoundError, 409: ResourceExistsError}) + api_version = "2020-01-01" + + # Construct URL + url = self.delete.metadata['url'] + path_format_arguments = { + 'subscriptionId': self._serialize.url("self._config.subscription_id", self._config.subscription_id, 'str', pattern=r'^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$'), + 'resourceGroupName': self._serialize.url("resource_group_name", resource_group_name, 'str', max_length=90, min_length=1, pattern=r'^[-\w\._\(\)]+$'), + 'workspaceName': self._serialize.url("workspace_name", workspace_name, 'str', max_length=90, min_length=1), + 'incidentId': self._serialize.url("incident_id", incident_id, 'str'), + } + url = self._client.format_url(url, **path_format_arguments) + + # Construct parameters + query_parameters = {} # type: Dict[str, Any] + query_parameters['api-version'] = self._serialize.query("api_version", api_version, 'str') + + # Construct headers + header_parameters = {} # type: Dict[str, Any] + + # Construct and send request + request = self._client.delete(url, query_parameters, header_parameters) + pipeline_response = self._client._pipeline.run(request, stream=False, **kwargs) + response = pipeline_response.http_response + + if response.status_code not in [200, 204]: + map_error(status_code=response.status_code, response=response, error_map=error_map) + raise HttpResponseError(response=response, error_format=ARMErrorFormat) + + if cls: + return cls(pipeline_response, None, {}) + + delete.metadata = {'url': '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}'} diff --git a/src/securityinsight/report.md b/src/securityinsight/report.md index 4b2207a9880..100d37e1906 100644 --- a/src/securityinsight/report.md +++ b/src/securityinsight/report.md @@ -21,7 +21,7 @@ create a sentinel alert-rule. |**--action-id**|string|Action ID|action_id| |**--kind**|choice|The kind of the alert rule|kind| |**--etag**|string|Etag of the azure resource|etag| -|**--logic-app-resource-id**|string|Logic App Resource Id, providers/Microsoft.Logic/workflows/{WorkflowID}.|logic_app_resource_id| +|**--logic-app-resource-id**|string|Logic App Resource Id, /subscriptions/{my-subscription}/resourceGroups/{my-resource-group}/providers/Microsoft.Logic/workflows/{my-workflow-id}.|logic_app_resource_id| |**--trigger-uri**|string|Logic App Callback URL for this specific workflow.|trigger_uri| ### sentinel alert-rule delete @@ -51,6 +51,89 @@ show a sentinel alert-rule. |**--workspace-name**|string|The name of the workspace.|workspace_name| |**--rule-id**|string|Alert rule ID|rule_id| |**--action-id**|string|Action ID|action_id| +### sentinel alert-rule-template list + +list a sentinel alert-rule-template. + +|Option|Type|Description|Path (SDK)|Path (swagger)| +|------|----|-----------|----------|--------------| +|**--resource-group-name**|string|The name of the resource group within the user's subscription. The name is case insensitive.|resource_group_name| +|**--workspace-name**|string|The name of the workspace.|workspace_name| +### sentinel alert-rule-template show + +show a sentinel alert-rule-template. + +|Option|Type|Description|Path (SDK)|Path (swagger)| +|------|----|-----------|----------|--------------| +|**--resource-group-name**|string|The name of the resource group within the user's subscription. The name is case insensitive.|resource_group_name| +|**--workspace-name**|string|The name of the workspace.|workspace_name| +|**--alert-rule-template-id**|string|Alert rule template ID|alert_rule_template_id| +### sentinel bookmark create + +create a sentinel bookmark. + +|Option|Type|Description|Path (SDK)|Path (swagger)| +|------|----|-----------|----------|--------------| +|**--resource-group-name**|string|The name of the resource group within the user's subscription. The name is case insensitive.|resource_group_name| +|**--workspace-name**|string|The name of the workspace.|workspace_name| +|**--bookmark-id**|string|Bookmark ID|bookmark_id| +|**--etag**|string|Etag of the azure resource|etag| +|**--created**|date-time|The time the bookmark was created|created| +|**--created-by**|object|Describes a user that created the bookmark|created_by| +|**--display-name**|string|The display name of the bookmark|display_name| +|**--labels**|array|List of labels relevant to this bookmark|labels| +|**--notes**|string|The notes of the bookmark|notes| +|**--query**|string|The query of the bookmark.|query| +|**--query-result**|string|The query result of the bookmark.|query_result| +|**--updated**|date-time|The last time the bookmark was updated|updated| +|**--updated-by**|object|Describes a user that updated the bookmark|updated_by| +|**--incident-info**|object|Describes an incident that relates to bookmark|incident_info| +### sentinel bookmark delete + +delete a sentinel bookmark. + +|Option|Type|Description|Path (SDK)|Path (swagger)| +|------|----|-----------|----------|--------------| +|**--resource-group-name**|string|The name of the resource group within the user's subscription. The name is case insensitive.|resource_group_name| +|**--workspace-name**|string|The name of the workspace.|workspace_name| +|**--bookmark-id**|string|Bookmark ID|bookmark_id| +### sentinel bookmark list + +list a sentinel bookmark. + +|Option|Type|Description|Path (SDK)|Path (swagger)| +|------|----|-----------|----------|--------------| +|**--resource-group-name**|string|The name of the resource group within the user's subscription. The name is case insensitive.|resource_group_name| +|**--workspace-name**|string|The name of the workspace.|workspace_name| +### sentinel bookmark show + +show a sentinel bookmark. + +|Option|Type|Description|Path (SDK)|Path (swagger)| +|------|----|-----------|----------|--------------| +|**--resource-group-name**|string|The name of the resource group within the user's subscription. The name is case insensitive.|resource_group_name| +|**--workspace-name**|string|The name of the workspace.|workspace_name| +|**--bookmark-id**|string|Bookmark ID|bookmark_id| +### sentinel bookmark update + +create a sentinel bookmark. + +|Option|Type|Description|Path (SDK)|Path (swagger)| +|------|----|-----------|----------|--------------| +|**--resource-group-name**|string|The name of the resource group within the user's subscription. The name is case insensitive.|resource_group_name| +|**--workspace-name**|string|The name of the workspace.|workspace_name| +|**--bookmark-id**|string|Bookmark ID|bookmark_id| +|**--etag**|string|Etag of the azure resource|etag| +|**--created**|date-time|The time the bookmark was created|created| +|**--created-by**|object|Describes a user that created the bookmark|created_by| +|**--display-name**|string|The display name of the bookmark|display_name| +|**--labels**|array|List of labels relevant to this bookmark|labels| +|**--notes**|string|The notes of the bookmark|notes| +|**--query**|string|The query of the bookmark.|query| +|**--query-result**|string|The query result of the bookmark.|query_result| +|**--updated**|date-time|The last time the bookmark was updated|updated| +|**--updated-by**|object|Describes a user that updated the bookmark|updated_by| +|**--incident-info**|object|Describes an incident that relates to bookmark|incident_info| ### sentinel data-connector create create a sentinel data-connector. @@ -98,4 +181,110 @@ create a sentinel data-connector. |**--workspace-name**|string|The name of the workspace.|workspace_name| |**--data-connector-id**|string|Connector ID|data_connector_id| |**--etag**|string|Etag of the azure resource|etag| -|**--kind**|choice|The kind of the data connector|kind| \ No newline at end of file +|**--kind**|choice|The kind of the data connector|kind| +### sentinel incident create + +create a sentinel incident. + +|Option|Type|Description|Path (SDK)|Path (swagger)| +|------|----|-----------|----------|--------------| +|**--resource-group-name**|string|The name of the resource group within the user's subscription. The name is case insensitive.|resource_group_name| +|**--workspace-name**|string|The name of the workspace.|workspace_name| +|**--incident-id**|string|Incident ID|incident_id| +|**--etag**|string|Etag of the azure resource|etag| +|**--classification**|choice|The reason the incident was closed|classification| +|**--classification-comment**|string|Describes the reason the incident was closed|classification_comment| +|**--classification-reason**|choice|The classification reason the incident was closed with|classification_reason| +|**--description**|string|The description of the incident|description| +|**--first-activity-time-utc**|date-time|The time of the first activity in the incident|first_activity_time_utc| +|**--labels**|array|List of labels relevant to this incident|labels| +|**--last-activity-time-utc**|date-time|The time of the last activity in the incident|last_activity_time_utc| +|**--owner**|object|Describes a user that the incident is assigned to|owner| +|**--severity**|choice|The severity of the incident|severity| +|**--status**|choice|The status of the incident|status| +|**--title**|string|The title of the incident|title| +### sentinel incident delete + +delete a sentinel incident. + +|Option|Type|Description|Path (SDK)|Path (swagger)| +|------|----|-----------|----------|--------------| +|**--resource-group-name**|string|The name of the resource group within the user's subscription. The name is case insensitive.|resource_group_name| +|**--workspace-name**|string|The name of the workspace.|workspace_name| +|**--incident-id**|string|Incident ID|incident_id| +### sentinel incident list + +list a sentinel incident. + +|Option|Type|Description|Path (SDK)|Path (swagger)| +|------|----|-----------|----------|--------------| +|**--resource-group-name**|string|The name of the resource group within the user's subscription. The name is case insensitive.|resource_group_name| +|**--workspace-name**|string|The name of the workspace.|workspace_name| +|**--filter**|string|Filters the results, based on a Boolean condition. Optional.|filter| +|**--orderby**|string|Sorts the results. Optional.|orderby| +|**--top**|integer|Returns only the first n results. Optional.|top| +|**--skip-token**|string|Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional.|skip_token| +### sentinel incident show + +show a sentinel incident. + +|Option|Type|Description|Path (SDK)|Path (swagger)| +|------|----|-----------|----------|--------------| +|**--resource-group-name**|string|The name of the resource group within the user's subscription. The name is case insensitive.|resource_group_name| +|**--workspace-name**|string|The name of the workspace.|workspace_name| +|**--incident-id**|string|Incident ID|incident_id| +### sentinel incident update + +create a sentinel incident. + +|Option|Type|Description|Path (SDK)|Path (swagger)| +|------|----|-----------|----------|--------------| +|**--resource-group-name**|string|The name of the resource group within the user's subscription. The name is case insensitive.|resource_group_name| +|**--workspace-name**|string|The name of the workspace.|workspace_name| +|**--incident-id**|string|Incident ID|incident_id| +|**--etag**|string|Etag of the azure resource|etag| +|**--classification**|choice|The reason the incident was closed|classification| +|**--classification-comment**|string|Describes the reason the incident was closed|classification_comment| +|**--classification-reason**|choice|The classification reason the incident was closed with|classification_reason| +|**--description**|string|The description of the incident|description| +|**--first-activity-time-utc**|date-time|The time of the first activity in the incident|first_activity_time_utc| +|**--labels**|array|List of labels relevant to this incident|labels| +|**--last-activity-time-utc**|date-time|The time of the last activity in the incident|last_activity_time_utc| +|**--owner**|object|Describes a user that the incident is assigned to|owner| +|**--severity**|choice|The severity of the incident|severity| +|**--status**|choice|The status of the incident|status| +|**--title**|string|The title of the incident|title| +### sentinel incident-comment create + +create a sentinel incident-comment. + +|Option|Type|Description|Path (SDK)|Path (swagger)| +|------|----|-----------|----------|--------------| +|**--resource-group-name**|string|The name of the resource group within the user's subscription. The name is case insensitive.|resource_group_name| +|**--workspace-name**|string|The name of the workspace.|workspace_name| +|**--incident-id**|string|Incident ID|incident_id| +|**--incident-comment-id**|string|Incident comment ID|incident_comment_id| +|**--message**|string|The comment message|message| +### sentinel incident-comment list + +list a sentinel incident-comment. + +|Option|Type|Description|Path (SDK)|Path (swagger)| +|------|----|-----------|----------|--------------| +|**--resource-group-name**|string|The name of the resource group within the user's subscription. The name is case insensitive.|resource_group_name| +|**--workspace-name**|string|The name of the workspace.|workspace_name| +|**--incident-id**|string|Incident ID|incident_id| +|**--filter**|string|Filters the results, based on a Boolean condition. Optional.|filter| +|**--orderby**|string|Sorts the results. Optional.|orderby| +|**--top**|integer|Returns only the first n results. Optional.|top| +|**--skip-token**|string|Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional.|skip_token| +### sentinel incident-comment show + +show a sentinel incident-comment. + +|Option|Type|Description|Path (SDK)|Path (swagger)| +|------|----|-----------|----------|--------------| +|**--resource-group-name**|string|The name of the resource group within the user's subscription. The name is case insensitive.|resource_group_name| +|**--workspace-name**|string|The name of the workspace.|workspace_name| +|**--incident-id**|string|Incident ID|incident_id| +|**--incident-comment-id**|string|Incident comment ID|incident_comment_id| \ No newline at end of file