Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5vcGVyYXRpb25hbGluc2lnaHRzL3dvcmtzcGFjZXMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5zZWN1cml0eWluc2lnaHRzL21ldGFkYXRhL3t9/2022-06-01-preview.xml

<?xml version='1.0' encoding='utf-8'?> <CodeGen plane="mgmt-plane"> <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.operationalinsights/workspaces/{}/providers/microsoft.securityinsights/metadata/{}" version="2022-06-01-preview" swagger="mgmt-plane/securityinsights/ResourceProviders/Microsoft.SecurityInsights/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuT3BlcmF0aW9uYWxJbnNpZ2h0cy93b3Jrc3BhY2VzL3t3b3Jrc3BhY2VOYW1lfS9wcm92aWRlcnMvTWljcm9zb2Z0LlNlY3VyaXR5SW5zaWdodHMvbWV0YWRhdGEve21ldGFkYXRhTmFtZX0=/V/MjAyMi0wNi0wMS1wcmV2aWV3"/> <commandGroup name="sentinel metadata"> <command name="show" version="2022-06-01-preview"> <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.operationalinsights/workspaces/{}/providers/microsoft.securityinsights/metadata/{}" version="2022-06-01-preview" swagger="mgmt-plane/securityinsights/ResourceProviders/Microsoft.SecurityInsights/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuT3BlcmF0aW9uYWxJbnNpZ2h0cy93b3Jrc3BhY2VzL3t3b3Jrc3BhY2VOYW1lfS9wcm92aWRlcnMvTWljcm9zb2Z0LlNlY3VyaXR5SW5zaWdodHMvbWV0YWRhdGEve21ldGFkYXRhTmFtZX0=/V/MjAyMi0wNi0wMS1wcmV2aWV3"/> <argGroup name=""> <arg type="string" var="$Path.metadataName" options="metadata-name name n" required="True" idPart="child_name_1"> <help short="The Metadata name."/> </arg> <arg type="ResourceGroupName" var="$Path.resourceGroupName" options="resource-group g" required="True" idPart="resource_group"/> <arg type="SubscriptionId" var="$Path.subscriptionId" options="subscription" required="True" idPart="subscription"/> <arg type="string" var="$Path.workspaceName" options="workspace-name w" required="True" stage="Experimental" idPart="name"> <help short="The name of the workspace."/> <format maxLength="90" minLength="1"/> </arg> </argGroup> <operation operationId="Metadata_Get"> <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/metadata/{metadataName}"> <request method="get"> <path> <param type="string" name="metadataName" arg="$Path.metadataName" required="True"/> <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True"> <format maxLength="90" minLength="1"/> </param> <param type="string" name="subscriptionId" arg="$Path.subscriptionId" required="True"> <format minLength="1"/> </param> <param type="string" name="workspaceName" arg="$Path.workspaceName" required="True"> <format maxLength="90" minLength="1"/> </param> </path> <query> <const readOnly="True" const="True" type="string" name="api-version" required="True"> <default value=""2022-06-01-preview""/> <format minLength="1"/> </const> </query> </request> <response statusCode="200"> <body> <json var="$Instance"> <schema type="object"> <prop type="string" name="etag"/> <prop readOnly="True" type="ResourceId" name="id"> <format template="/subscriptions/{}/resourceGroups/{}/providers/Microsoft.OperationalInsights/workspaces/{}/providers/Microsoft.SecurityInsights/metadata/{}"/> </prop> <prop readOnly="True" type="string" name="name"/> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="author"> <prop type="string" name="email"/> <prop type="string" name="link"/> <prop type="string" name="name"/> </prop> <prop type="object" name="categories"> <prop type="array<string>" name="domains"> <item type="string"/> </prop> <prop type="array<string>" name="verticals"> <item type="string"/> </prop> </prop> <prop type="string" name="contentId"/> <prop type="string" name="contentSchemaVersion"/> <prop type="string" name="customVersion"/> <prop type="object" name="dependencies" cls="MetadataDependencies_read"> <prop type="string" name="contentId"/> <prop type="array<@MetadataDependencies_read>" name="criteria"> <item type="@MetadataDependencies_read"/> </prop> <prop type="string" name="kind"> <enum> <item value=""AnalyticsRule""/> <item value=""AnalyticsRuleTemplate""/> <item value=""AutomationRule""/> <item value=""AzureFunction""/> <item value=""DataConnector""/> <item value=""DataType""/> <item value=""HuntingQuery""/> <item value=""InvestigationQuery""/> <item value=""LogicAppsCustomConnector""/> <item value=""Parser""/> <item value=""Playbook""/> <item value=""PlaybookTemplate""/> <item value=""Solution""/> <item value=""Watchlist""/> <item value=""WatchlistTemplate""/> <item value=""Workbook""/> <item value=""WorkbookTemplate""/> </enum> </prop> <prop type="string" name="name"/> <prop type="string" name="operator"> <enum> <item value=""AND""/> <item value=""OR""/> </enum> </prop> <prop type="string" name="version"/> </prop> <prop type="date" name="firstPublishDate"/> <prop type="string" name="icon"/> <prop type="string" name="kind" required="True"> <enum> <item value=""AnalyticsRule""/> <item value=""AnalyticsRuleTemplate""/> <item value=""AutomationRule""/> <item value=""AzureFunction""/> <item value=""DataConnector""/> <item value=""DataType""/> <item value=""HuntingQuery""/> <item value=""InvestigationQuery""/> <item value=""LogicAppsCustomConnector""/> <item value=""Parser""/> <item value=""Playbook""/> <item value=""PlaybookTemplate""/> <item value=""Solution""/> <item value=""Watchlist""/> <item value=""WatchlistTemplate""/> <item value=""Workbook""/> <item value=""WorkbookTemplate""/> </enum> </prop> <prop type="date" name="lastPublishDate"/> <prop type="string" name="parentId" required="True"/> <prop type="array<string>" name="previewImages"> <item type="string"/> </prop> <prop type="array<string>" name="previewImagesDark"> <item type="string"/> </prop> <prop type="array<string>" name="providers"> <item type="string"/> </prop> <prop type="object" name="source"> <prop type="string" name="kind" required="True"> <enum> <item value=""Community""/> <item value=""LocalWorkspace""/> <item value=""Solution""/> <item value=""SourceRepository""/> </enum> </prop> <prop type="string" name="name"/> <prop type="string" name="sourceId"/> </prop> <prop type="object" name="support"> <prop type="string" name="email"/> <prop type="string" name="link"/> <prop type="string" name="name"/> <prop type="string" name="tier" required="True"> <enum> <item value=""Community""/> <item value=""Microsoft""/> <item value=""Partner""/> </enum> </prop> </prop> <prop type="array<string>" name="threatAnalysisTactics"> <item type="string"/> </prop> <prop type="array<string>" name="threatAnalysisTechniques"> <item type="string"/> </prop> <prop type="string" name="version"/> </prop> <prop readOnly="True" type="object" name="systemData"> <prop readOnly="True" type="dateTime" name="createdAt"/> <prop readOnly="True" type="string" name="createdBy"/> <prop readOnly="True" type="string" name="createdByType"> <enum> <item value=""Application""/> <item value=""Key""/> <item value=""ManagedIdentity""/> <item value=""User""/> </enum> </prop> <prop readOnly="True" type="dateTime" name="lastModifiedAt"/> <prop readOnly="True" type="string" name="lastModifiedBy"/> <prop readOnly="True" type="string" name="lastModifiedByType"> <enum> <item value=""Application""/> <item value=""Key""/> <item value=""ManagedIdentity""/> <item value=""User""/> </enum> </prop> </prop> <prop readOnly="True" type="string" name="type"/> </schema> </json> </body> </response> <response isError="True"> <body> <json> <schema type="@ODataV4Format"/> </json> </body> </response> </http> </operation> <output type="object" ref="$Instance" clientFlatten="True"/> </command> <command name="delete" version="2022-06-01-preview" confirmation="Are you sure you want to perform this operation?"> <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.operationalinsights/workspaces/{}/providers/microsoft.securityinsights/metadata/{}" version="2022-06-01-preview" swagger="mgmt-plane/securityinsights/ResourceProviders/Microsoft.SecurityInsights/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuT3BlcmF0aW9uYWxJbnNpZ2h0cy93b3Jrc3BhY2VzL3t3b3Jrc3BhY2VOYW1lfS9wcm92aWRlcnMvTWljcm9zb2Z0LlNlY3VyaXR5SW5zaWdodHMvbWV0YWRhdGEve21ldGFkYXRhTmFtZX0=/V/MjAyMi0wNi0wMS1wcmV2aWV3"/> <argGroup name=""> <arg type="string" var="$Path.metadataName" options="metadata-name name n" required="True" idPart="child_name_1"> <help short="The Metadata name."/> </arg> <arg type="ResourceGroupName" var="$Path.resourceGroupName" options="resource-group g" required="True" idPart="resource_group"/> <arg type="SubscriptionId" var="$Path.subscriptionId" options="subscription" required="True" idPart="subscription"/> <arg type="string" var="$Path.workspaceName" options="workspace-name w" required="True" stage="Experimental" idPart="name"> <help short="The name of the workspace."/> <format maxLength="90" minLength="1"/> </arg> </argGroup> <operation operationId="Metadata_Delete"> <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/metadata/{metadataName}"> <request method="delete"> <path> <param type="string" name="metadataName" arg="$Path.metadataName" required="True"/> <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True"> <format maxLength="90" minLength="1"/> </param> <param type="string" name="subscriptionId" arg="$Path.subscriptionId" required="True"> <format minLength="1"/> </param> <param type="string" name="workspaceName" arg="$Path.workspaceName" required="True"> <format maxLength="90" minLength="1"/> </param> </path> <query> <const readOnly="True" const="True" type="string" name="api-version" required="True"> <default value=""2022-06-01-preview""/> <format minLength="1"/> </const> </query> </request> <response statusCode="200"/> <response statusCode="204"/> <response isError="True"> <body> <json> <schema type="@ODataV4Format"/> </json> </body> </response> </http> </operation> </command> <command name="create" version="2022-06-01-preview"> <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.operationalinsights/workspaces/{}/providers/microsoft.securityinsights/metadata/{}" version="2022-06-01-preview" swagger="mgmt-plane/securityinsights/ResourceProviders/Microsoft.SecurityInsights/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuT3BlcmF0aW9uYWxJbnNpZ2h0cy93b3Jrc3BhY2VzL3t3b3Jrc3BhY2VOYW1lfS9wcm92aWRlcnMvTWljcm9zb2Z0LlNlY3VyaXR5SW5zaWdodHMvbWV0YWRhdGEve21ldGFkYXRhTmFtZX0=/V/MjAyMi0wNi0wMS1wcmV2aWV3"/> <argGroup name=""> <arg type="string" var="$Path.metadataName" options="metadata-name name n" required="True" idPart="child_name_1"> <help short="The Metadata name."/> </arg> <arg type="ResourceGroupName" var="$Path.resourceGroupName" options="resource-group g" required="True" idPart="resource_group"/> <arg type="SubscriptionId" var="$Path.subscriptionId" options="subscription" required="True" idPart="subscription"/> <arg type="string" var="$Path.workspaceName" options="workspace-name w" required="True" stage="Experimental" idPart="name"> <help short="The name of the workspace."/> <format maxLength="90" minLength="1"/> </arg> </argGroup> <argGroup name="Metadata"> <arg type="string" var="$metadata.etag" options="etag" group="Metadata"> <help short="Etag of the azure resource"/> </arg> </argGroup> <argGroup name="Properties"> <arg type="object" var="$metadata.properties.author" options="author" group="Properties"> <help short="The creator of the content item."/> <arg type="string" var="$metadata.properties.author.email" options="email"> <help short="Email of author contact"/> </arg> <arg type="string" var="$metadata.properties.author.link" options="link"> <help short="Link for author/vendor page"/> </arg> <arg type="string" var="$metadata.properties.author.name" options="name"> <help short="Name of the author. Company or person."/> </arg> </arg> <arg type="object" var="$metadata.properties.categories" options="categories" group="Properties"> <help short="Categories for the solution content item"/> <arg type="array<string>" var="$metadata.properties.categories.domains" options="domains"> <help short="domain for the solution content item"/> <item type="string"/> </arg> <arg type="array<string>" var="$metadata.properties.categories.verticals" options="verticals"> <help short="Industry verticals for the solution content item"/> <item type="string"/> </arg> </arg> <arg type="string" var="$metadata.properties.contentId" options="content-id" group="Properties"> <help short="Static ID for the content. Used to identify dependencies and content from solutions or community. Hard-coded/static for out of the box content and solutions. Dynamic for user-created. This is the resource name"/> </arg> <arg type="string" var="$metadata.properties.contentSchemaVersion" options="content-schema-version" group="Properties"> <help short="Schema version of the content. Can be used to distinguish between different flow based on the schema version"/> </arg> <arg type="string" var="$metadata.properties.customVersion" options="custom-version" group="Properties"> <help short="The custom version of the content. A optional free text"/> </arg> <arg type="object" var="$metadata.properties.dependencies" options="dependencies" group="Properties" cls="MetadataDependencies_create"> <help short="Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats."/> <arg type="string" var="@MetadataDependencies_create.contentId" options="content-id"> <help short="Id of the content item we depend on"/> </arg> <arg type="array<@MetadataDependencies_create>" var="@MetadataDependencies_create.criteria" options="criteria"> <help short="This is the list of dependencies we must fulfill, according to the AND/OR operator"/> <item type="@MetadataDependencies_create"/> </arg> <arg type="string" var="@MetadataDependencies_create.kind" options="kind"> <help short="Type of the content item we depend on"/> <enum> <item name="AnalyticsRule" value=""AnalyticsRule""/> <item name="AnalyticsRuleTemplate" value=""AnalyticsRuleTemplate""/> <item name="AutomationRule" value=""AutomationRule""/> <item name="AzureFunction" value=""AzureFunction""/> <item name="DataConnector" value=""DataConnector""/> <item name="DataType" value=""DataType""/> <item name="HuntingQuery" value=""HuntingQuery""/> <item name="InvestigationQuery" value=""InvestigationQuery""/> <item name="LogicAppsCustomConnector" value=""LogicAppsCustomConnector""/> <item name="Parser" value=""Parser""/> <item name="Playbook" value=""Playbook""/> <item name="PlaybookTemplate" value=""PlaybookTemplate""/> <item name="Solution" value=""Solution""/> <item name="Watchlist" value=""Watchlist""/> <item name="WatchlistTemplate" value=""WatchlistTemplate""/> <item name="Workbook" value=""Workbook""/> <item name="WorkbookTemplate" value=""WorkbookTemplate""/> </enum> </arg> <arg type="string" var="@MetadataDependencies_create.name" options="name"> <help short="Name of the content item"/> </arg> <arg type="string" var="@MetadataDependencies_create.operator" options="operator"> <help short="Operator used for list of dependencies in criteria array."/> <enum> <item name="AND" value=""AND""/> <item name="OR" value=""OR""/> </enum> </arg> <arg type="string" var="@MetadataDependencies_create.version" options="version"> <help short="Version of the the content item we depend on. Can be blank, * or missing to indicate any version fulfills the dependency. If version does not match our defined numeric format then an exact match is required."/> </arg> </arg> <arg type="date" var="$metadata.properties.firstPublishDate" options="first-publish-date" group="Properties"> <help short="first publish date solution content item"/> </arg> <arg type="string" var="$metadata.properties.icon" options="icon" group="Properties"> <help short="the icon identifier. this id can later be fetched from the solution template"/> </arg> <arg type="string" var="$metadata.properties.kind" options="kind" group="Properties"> <help short="The kind of content the metadata is for."/> <enum> <item name="AnalyticsRule" value=""AnalyticsRule""/> <item name="AnalyticsRuleTemplate" value=""AnalyticsRuleTemplate""/> <item name="AutomationRule" value=""AutomationRule""/> <item name="AzureFunction" value=""AzureFunction""/> <item name="DataConnector" value=""DataConnector""/> <item name="DataType" value=""DataType""/> <item name="HuntingQuery" value=""HuntingQuery""/> <item name="InvestigationQuery" value=""InvestigationQuery""/> <item name="LogicAppsCustomConnector" value=""LogicAppsCustomConnector""/> <item name="Parser" value=""Parser""/> <item name="Playbook" value=""Playbook""/> <item name="PlaybookTemplate" value=""PlaybookTemplate""/> <item name="Solution" value=""Solution""/> <item name="Watchlist" value=""Watchlist""/> <item name="WatchlistTemplate" value=""WatchlistTemplate""/> <item name="Workbook" value=""Workbook""/> <item name="WorkbookTemplate" value=""WorkbookTemplate""/> </enum> </arg> <arg type="date" var="$metadata.properties.lastPublishDate" options="last-publish-date" group="Properties"> <help short="last publish date for the solution content item"/> </arg> <arg type="string" var="$metadata.properties.parentId" options="parent-id" group="Properties"> <help short="Full parent resource ID of the content item the metadata is for. This is the full resource ID including the scope (subscription and resource group)"/> </arg> <arg type="array<string>" var="$metadata.properties.previewImages" options="preview-images" group="Properties"> <help short="preview image file names. These will be taken from the solution artifacts"/> <item type="string"/> </arg> <arg type="array<string>" var="$metadata.properties.previewImagesDark" options="preview-images-dark" group="Properties"> <help short="preview image file names. These will be taken from the solution artifacts. used for dark theme support"/> <item type="string"/> </arg> <arg type="array<string>" var="$metadata.properties.providers" options="providers" group="Properties"> <help short="Providers for the solution content item"/> <item type="string"/> </arg> <arg type="object" var="$metadata.properties.source" options="source" group="Properties"> <help short="Source of the content. This is where/how it was created."/> <arg type="string" var="$metadata.properties.source.kind" options="kind" required="True"> <help short="Source type of the content"/> <enum> <item name="Community" value=""Community""/> <item name="LocalWorkspace" value=""LocalWorkspace""/> <item name="Solution" value=""Solution""/> <item name="SourceRepository" value=""SourceRepository""/> </enum> </arg> <arg type="string" var="$metadata.properties.source.name" options="name"> <help short="Name of the content source. The repo name, solution name, LA workspace name etc."/> </arg> <arg type="string" var="$metadata.properties.source.sourceId" options="source-id"> <help short="ID of the content source. The solution ID, workspace ID, etc"/> </arg> </arg> <arg type="object" var="$metadata.properties.support" options="support" group="Properties"> <help short="Support information for the metadata - type, name, contact information"/> <arg type="string" var="$metadata.properties.support.email" options="email"> <help short="Email of support contact"/> </arg> <arg type="string" var="$metadata.properties.support.link" options="link"> <help short="Link for support help, like to support page to open a ticket etc."/> </arg> <arg type="string" var="$metadata.properties.support.name" options="name"> <help short="Name of the support contact. Company or person."/> </arg> <arg type="string" var="$metadata.properties.support.tier" options="tier" required="True"> <help short="Type of support for content item"/> <enum> <item name="Community" value=""Community""/> <item name="Microsoft" value=""Microsoft""/> <item name="Partner" value=""Partner""/> </enum> </arg> </arg> <arg type="array<string>" var="$metadata.properties.threatAnalysisTactics" options="threat-tactics" group="Properties"> <help short="the tactics the resource covers"/> <item type="string"/> </arg> <arg type="array<string>" var="$metadata.properties.threatAnalysisTechniques" options="threat-techniques" group="Properties"> <help short="the techniques the resource covers, these have to be aligned with the tactics being used"/> <item type="string"/> </arg> <arg type="string" var="$metadata.properties.version" options="version" group="Properties"> <help short="Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM template best practices. Can also be any string, but then we cannot guarantee any version checks"/> </arg> </argGroup> <operation operationId="Metadata_Create"> <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/metadata/{metadataName}"> <request method="put"> <path> <param type="string" name="metadataName" arg="$Path.metadataName" required="True"/> <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True"> <format maxLength="90" minLength="1"/> </param> <param type="string" name="subscriptionId" arg="$Path.subscriptionId" required="True"> <format minLength="1"/> </param> <param type="string" name="workspaceName" arg="$Path.workspaceName" required="True"> <format maxLength="90" minLength="1"/> </param> </path> <query> <const readOnly="True" const="True" type="string" name="api-version" required="True"> <default value=""2022-06-01-preview""/> <format minLength="1"/> </const> </query> <body> <json> <schema type="object" name="metadata" required="True" clientFlatten="True"> <prop type="string" name="etag" arg="$metadata.etag"/> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="author" arg="$metadata.properties.author"> <prop type="string" name="email" arg="$metadata.properties.author.email"/> <prop type="string" name="link" arg="$metadata.properties.author.link"/> <prop type="string" name="name" arg="$metadata.properties.author.name"/> </prop> <prop type="object" name="categories" arg="$metadata.properties.categories"> <prop type="array<string>" name="domains" arg="$metadata.properties.categories.domains"> <item type="string"/> </prop> <prop type="array<string>" name="verticals" arg="$metadata.properties.categories.verticals"> <item type="string"/> </prop> </prop> <prop type="string" name="contentId" arg="$metadata.properties.contentId"/> <prop type="string" name="contentSchemaVersion" arg="$metadata.properties.contentSchemaVersion"/> <prop type="string" name="customVersion" arg="$metadata.properties.customVersion"/> <prop type="object" name="dependencies" arg="$metadata.properties.dependencies" cls="MetadataDependencies_create"> <prop type="string" name="contentId" arg="@MetadataDependencies_create.contentId"/> <prop type="array<@MetadataDependencies_create>" name="criteria" arg="@MetadataDependencies_create.criteria"> <item type="@MetadataDependencies_create"/> </prop> <prop type="string" name="kind" arg="@MetadataDependencies_create.kind"> <enum> <item value=""AnalyticsRule""/> <item value=""AnalyticsRuleTemplate""/> <item value=""AutomationRule""/> <item value=""AzureFunction""/> <item value=""DataConnector""/> <item value=""DataType""/> <item value=""HuntingQuery""/> <item value=""InvestigationQuery""/> <item value=""LogicAppsCustomConnector""/> <item value=""Parser""/> <item value=""Playbook""/> <item value=""PlaybookTemplate""/> <item value=""Solution""/> <item value=""Watchlist""/> <item value=""WatchlistTemplate""/> <item value=""Workbook""/> <item value=""WorkbookTemplate""/> </enum> </prop> <prop type="string" name="name" arg="@MetadataDependencies_create.name"/> <prop type="string" name="operator" arg="@MetadataDependencies_create.operator"> <enum> <item value=""AND""/> <item value=""OR""/> </enum> </prop> <prop type="string" name="version" arg="@MetadataDependencies_create.version"/> </prop> <prop type="date" name="firstPublishDate" arg="$metadata.properties.firstPublishDate"/> <prop type="string" name="icon" arg="$metadata.properties.icon"/> <prop type="string" name="kind" arg="$metadata.properties.kind" required="True"> <enum> <item value=""AnalyticsRule""/> <item value=""AnalyticsRuleTemplate""/> <item value=""AutomationRule""/> <item value=""AzureFunction""/> <item value=""DataConnector""/> <item value=""DataType""/> <item value=""HuntingQuery""/> <item value=""InvestigationQuery""/> <item value=""LogicAppsCustomConnector""/> <item value=""Parser""/> <item value=""Playbook""/> <item value=""PlaybookTemplate""/> <item value=""Solution""/> <item value=""Watchlist""/> <item value=""WatchlistTemplate""/> <item value=""Workbook""/> <item value=""WorkbookTemplate""/> </enum> </prop> <prop type="date" name="lastPublishDate" arg="$metadata.properties.lastPublishDate"/> <prop type="string" name="parentId" arg="$metadata.properties.parentId" required="True"/> <prop type="array<string>" name="previewImages" arg="$metadata.properties.previewImages"> <item type="string"/> </prop> <prop type="array<string>" name="previewImagesDark" arg="$metadata.properties.previewImagesDark"> <item type="string"/> </prop> <prop type="array<string>" name="providers" arg="$metadata.properties.providers"> <item type="string"/> </prop> <prop type="object" name="source" arg="$metadata.properties.source"> <prop type="string" name="kind" arg="$metadata.properties.source.kind" required="True"> <enum> <item value=""Community""/> <item value=""LocalWorkspace""/> <item value=""Solution""/> <item value=""SourceRepository""/> </enum> </prop> <prop type="string" name="name" arg="$metadata.properties.source.name"/> <prop type="string" name="sourceId" arg="$metadata.properties.source.sourceId"/> </prop> <prop type="object" name="support" arg="$metadata.properties.support"> <prop type="string" name="email" arg="$metadata.properties.support.email"/> <prop type="string" name="link" arg="$metadata.properties.support.link"/> <prop type="string" name="name" arg="$metadata.properties.support.name"/> <prop type="string" name="tier" arg="$metadata.properties.support.tier" required="True"> <enum> <item value=""Community""/> <item value=""Microsoft""/> <item value=""Partner""/> </enum> </prop> </prop> <prop type="array<string>" name="threatAnalysisTactics" arg="$metadata.properties.threatAnalysisTactics"> <item type="string"/> </prop> <prop type="array<string>" name="threatAnalysisTechniques" arg="$metadata.properties.threatAnalysisTechniques"> <item type="string"/> </prop> <prop type="string" name="version" arg="$metadata.properties.version"/> </prop> </schema> </json> </body> </request> <response statusCode="200 201"> <body> <json var="$Instance"> <schema type="object"> <prop type="string" name="etag"/> <prop readOnly="True" type="ResourceId" name="id"> <format template="/subscriptions/{}/resourceGroups/{}/providers/Microsoft.OperationalInsights/workspaces/{}/providers/Microsoft.SecurityInsights/metadata/{}"/> </prop> <prop readOnly="True" type="string" name="name"/> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="author"> <prop type="string" name="email"/> <prop type="string" name="link"/> <prop type="string" name="name"/> </prop> <prop type="object" name="categories"> <prop type="array<string>" name="domains"> <item type="string"/> </prop> <prop type="array<string>" name="verticals"> <item type="string"/> </prop> </prop> <prop type="string" name="contentId"/> <prop type="string" name="contentSchemaVersion"/> <prop type="string" name="customVersion"/> <prop type="object" name="dependencies" cls="MetadataDependencies_read"> <prop type="string" name="contentId"/> <prop type="array<@MetadataDependencies_read>" name="criteria"> <item type="@MetadataDependencies_read"/> </prop> <prop type="string" name="kind"> <enum> <item value=""AnalyticsRule""/> <item value=""AnalyticsRuleTemplate""/> <item value=""AutomationRule""/> <item value=""AzureFunction""/> <item value=""DataConnector""/> <item value=""DataType""/> <item value=""HuntingQuery""/> <item value=""InvestigationQuery""/> <item value=""LogicAppsCustomConnector""/> <item value=""Parser""/> <item value=""Playbook""/> <item value=""PlaybookTemplate""/> <item value=""Solution""/> <item value=""Watchlist""/> <item value=""WatchlistTemplate""/> <item value=""Workbook""/> <item value=""WorkbookTemplate""/> </enum> </prop> <prop type="string" name="name"/> <prop type="string" name="operator"> <enum> <item value=""AND""/> <item value=""OR""/> </enum> </prop> <prop type="string" name="version"/> </prop> <prop type="date" name="firstPublishDate"/> <prop type="string" name="icon"/> <prop type="string" name="kind" required="True"> <enum> <item value=""AnalyticsRule""/> <item value=""AnalyticsRuleTemplate""/> <item value=""AutomationRule""/> <item value=""AzureFunction""/> <item value=""DataConnector""/> <item value=""DataType""/> <item value=""HuntingQuery""/> <item value=""InvestigationQuery""/> <item value=""LogicAppsCustomConnector""/> <item value=""Parser""/> <item value=""Playbook""/> <item value=""PlaybookTemplate""/> <item value=""Solution""/> <item value=""Watchlist""/> <item value=""WatchlistTemplate""/> <item value=""Workbook""/> <item value=""WorkbookTemplate""/> </enum> </prop> <prop type="date" name="lastPublishDate"/> <prop type="string" name="parentId" required="True"/> <prop type="array<string>" name="previewImages"> <item type="string"/> </prop> <prop type="array<string>" name="previewImagesDark"> <item type="string"/> </prop> <prop type="array<string>" name="providers"> <item type="string"/> </prop> <prop type="object" name="source"> <prop type="string" name="kind" required="True"> <enum> <item value=""Community""/> <item value=""LocalWorkspace""/> <item value=""Solution""/> <item value=""SourceRepository""/> </enum> </prop> <prop type="string" name="name"/> <prop type="string" name="sourceId"/> </prop> <prop type="object" name="support"> <prop type="string" name="email"/> <prop type="string" name="link"/> <prop type="string" name="name"/> <prop type="string" name="tier" required="True"> <enum> <item value=""Community""/> <item value=""Microsoft""/> <item value=""Partner""/> </enum> </prop> </prop> <prop type="array<string>" name="threatAnalysisTactics"> <item type="string"/> </prop> <prop type="array<string>" name="threatAnalysisTechniques"> <item type="string"/> </prop> <prop type="string" name="version"/> </prop> <prop readOnly="True" type="object" name="systemData"> <prop readOnly="True" type="dateTime" name="createdAt"/> <prop readOnly="True" type="string" name="createdBy"/> <prop readOnly="True" type="string" name="createdByType"> <enum> <item value=""Application""/> <item value=""Key""/> <item value=""ManagedIdentity""/> <item value=""User""/> </enum> </prop> <prop readOnly="True" type="dateTime" name="lastModifiedAt"/> <prop readOnly="True" type="string" name="lastModifiedBy"/> <prop readOnly="True" type="string" name="lastModifiedByType"> <enum> <item value=""Application""/> <item value=""Key""/> <item value=""ManagedIdentity""/> <item value=""User""/> </enum> </prop> </prop> <prop readOnly="True" type="string" name="type"/> </schema> </json> </body> </response> <response isError="True"> <body> <json> <schema type="@ODataV4Format"/> </json> </body> </response> </http> </operation> <output type="object" ref="$Instance" clientFlatten="True"/> </command> <command name="update" version="2022-06-01-preview"> <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.operationalinsights/workspaces/{}/providers/microsoft.securityinsights/metadata/{}" version="2022-06-01-preview" swagger="mgmt-plane/securityinsights/ResourceProviders/Microsoft.SecurityInsights/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuT3BlcmF0aW9uYWxJbnNpZ2h0cy93b3Jrc3BhY2VzL3t3b3Jrc3BhY2VOYW1lfS9wcm92aWRlcnMvTWljcm9zb2Z0LlNlY3VyaXR5SW5zaWdodHMvbWV0YWRhdGEve21ldGFkYXRhTmFtZX0=/V/MjAyMi0wNi0wMS1wcmV2aWV3"/> <argGroup name=""> <arg type="string" var="$Path.metadataName" options="metadata-name name n" required="True" idPart="child_name_1"> <help short="The Metadata name."/> </arg> <arg type="ResourceGroupName" var="$Path.resourceGroupName" options="resource-group g" required="True" idPart="resource_group"/> <arg type="SubscriptionId" var="$Path.subscriptionId" options="subscription" required="True" idPart="subscription"/> <arg type="string" var="$Path.workspaceName" options="workspace-name w" required="True" stage="Experimental" idPart="name"> <help short="The name of the workspace."/> <format maxLength="90" minLength="1"/> </arg> </argGroup> <argGroup name="Metadata"> <arg nullable="True" type="string" var="$metadata.etag" options="etag" group="Metadata"> <help short="Etag of the azure resource"/> </arg> </argGroup> <argGroup name="Properties"> <arg nullable="True" type="object" var="$metadata.properties.author" options="author" group="Properties"> <help short="The creator of the content item."/> <arg nullable="True" type="string" var="$metadata.properties.author.email" options="email"> <help short="Email of author contact"/> </arg> <arg nullable="True" type="string" var="$metadata.properties.author.link" options="link"> <help short="Link for author/vendor page"/> </arg> <arg nullable="True" type="string" var="$metadata.properties.author.name" options="name"> <help short="Name of the author. Company or person."/> </arg> </arg> <arg nullable="True" type="object" var="$metadata.properties.categories" options="categories" group="Properties"> <help short="Categories for the solution content item"/> <arg nullable="True" type="array<string>" var="$metadata.properties.categories.domains" options="domains"> <help short="domain for the solution content item"/> <item type="string"/> </arg> <arg nullable="True" type="array<string>" var="$metadata.properties.categories.verticals" options="verticals"> <help short="Industry verticals for the solution content item"/> <item type="string"/> </arg> </arg> <arg nullable="True" type="string" var="$metadata.properties.contentId" options="content-id" group="Properties"> <help short="Static ID for the content. Used to identify dependencies and content from solutions or community. Hard-coded/static for out of the box content and solutions. Dynamic for user-created. This is the resource name"/> </arg> <arg nullable="True" type="string" var="$metadata.properties.contentSchemaVersion" options="content-schema-version" group="Properties"> <help short="Schema version of the content. Can be used to distinguish between different flow based on the schema version"/> </arg> <arg nullable="True" type="string" var="$metadata.properties.customVersion" options="custom-version" group="Properties"> <help short="The custom version of the content. A optional free text"/> </arg> <arg nullable="True" type="object" var="$metadata.properties.dependencies" options="dependencies" group="Properties" cls="MetadataDependencies_update"> <help short="Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats."/> <arg nullable="True" type="string" var="@MetadataDependencies_update.contentId" options="content-id"> <help short="Id of the content item we depend on"/> </arg> <arg nullable="True" type="array<@MetadataDependencies_update>" var="@MetadataDependencies_update.criteria" options="criteria"> <help short="This is the list of dependencies we must fulfill, according to the AND/OR operator"/> <item type="@MetadataDependencies_update"/> </arg> <arg nullable="True" type="string" var="@MetadataDependencies_update.kind" options="kind"> <help short="Type of the content item we depend on"/> <enum> <item name="AnalyticsRule" value=""AnalyticsRule""/> <item name="AnalyticsRuleTemplate" value=""AnalyticsRuleTemplate""/> <item name="AutomationRule" value=""AutomationRule""/> <item name="AzureFunction" value=""AzureFunction""/> <item name="DataConnector" value=""DataConnector""/> <item name="DataType" value=""DataType""/> <item name="HuntingQuery" value=""HuntingQuery""/> <item name="InvestigationQuery" value=""InvestigationQuery""/> <item name="LogicAppsCustomConnector" value=""LogicAppsCustomConnector""/> <item name="Parser" value=""Parser""/> <item name="Playbook" value=""Playbook""/> <item name="PlaybookTemplate" value=""PlaybookTemplate""/> <item name="Solution" value=""Solution""/> <item name="Watchlist" value=""Watchlist""/> <item name="WatchlistTemplate" value=""WatchlistTemplate""/> <item name="Workbook" value=""Workbook""/> <item name="WorkbookTemplate" value=""WorkbookTemplate""/> </enum> </arg> <arg nullable="True" type="string" var="@MetadataDependencies_update.name" options="name"> <help short="Name of the content item"/> </arg> <arg nullable="True" type="string" var="@MetadataDependencies_update.operator" options="operator"> <help short="Operator used for list of dependencies in criteria array."/> <enum> <item name="AND" value=""AND""/> <item name="OR" value=""OR""/> </enum> </arg> <arg nullable="True" type="string" var="@MetadataDependencies_update.version" options="version"> <help short="Version of the the content item we depend on. Can be blank, * or missing to indicate any version fulfills the dependency. If version does not match our defined numeric format then an exact match is required."/> </arg> </arg> <arg nullable="True" type="date" var="$metadata.properties.firstPublishDate" options="first-publish-date" group="Properties"> <help short="first publish date solution content item"/> </arg> <arg nullable="True" type="string" var="$metadata.properties.icon" options="icon" group="Properties"> <help short="the icon identifier. this id can later be fetched from the solution template"/> </arg> <arg type="string" var="$metadata.properties.kind" options="kind" group="Properties"> <help short="The kind of content the metadata is for."/> <enum> <item name="AnalyticsRule" value=""AnalyticsRule""/> <item name="AnalyticsRuleTemplate" value=""AnalyticsRuleTemplate""/> <item name="AutomationRule" value=""AutomationRule""/> <item name="AzureFunction" value=""AzureFunction""/> <item name="DataConnector" value=""DataConnector""/> <item name="DataType" value=""DataType""/> <item name="HuntingQuery" value=""HuntingQuery""/> <item name="InvestigationQuery" value=""InvestigationQuery""/> <item name="LogicAppsCustomConnector" value=""LogicAppsCustomConnector""/> <item name="Parser" value=""Parser""/> <item name="Playbook" value=""Playbook""/> <item name="PlaybookTemplate" value=""PlaybookTemplate""/> <item name="Solution" value=""Solution""/> <item name="Watchlist" value=""Watchlist""/> <item name="WatchlistTemplate" value=""WatchlistTemplate""/> <item name="Workbook" value=""Workbook""/> <item name="WorkbookTemplate" value=""WorkbookTemplate""/> </enum> </arg> <arg nullable="True" type="date" var="$metadata.properties.lastPublishDate" options="last-publish-date" group="Properties"> <help short="last publish date for the solution content item"/> </arg> <arg type="string" var="$metadata.properties.parentId" options="parent-id" group="Properties"> <help short="Full parent resource ID of the content item the metadata is for. This is the full resource ID including the scope (subscription and resource group)"/> </arg> <arg nullable="True" type="array<string>" var="$metadata.properties.previewImages" options="preview-images" group="Properties"> <help short="preview image file names. These will be taken from the solution artifacts"/> <item type="string"/> </arg> <arg nullable="True" type="array<string>" var="$metadata.properties.previewImagesDark" options="preview-images-dark" group="Properties"> <help short="preview image file names. These will be taken from the solution artifacts. used for dark theme support"/> <item type="string"/> </arg> <arg nullable="True" type="array<string>" var="$metadata.properties.providers" options="providers" group="Properties"> <help short="Providers for the solution content item"/> <item type="string"/> </arg> <arg nullable="True" type="object" var="$metadata.properties.source" options="source" group="Properties"> <help short="Source of the content. This is where/how it was created."/> <arg type="string" var="$metadata.properties.source.kind" options="kind"> <help short="Source type of the content"/> <enum> <item name="Community" value=""Community""/> <item name="LocalWorkspace" value=""LocalWorkspace""/> <item name="Solution" value=""Solution""/> <item name="SourceRepository" value=""SourceRepository""/> </enum> </arg> <arg nullable="True" type="string" var="$metadata.properties.source.name" options="name"> <help short="Name of the content source. The repo name, solution name, LA workspace name etc."/> </arg> <arg nullable="True" type="string" var="$metadata.properties.source.sourceId" options="source-id"> <help short="ID of the content source. The solution ID, workspace ID, etc"/> </arg> </arg> <arg nullable="True" type="object" var="$metadata.properties.support" options="support" group="Properties"> <help short="Support information for the metadata - type, name, contact information"/> <arg nullable="True" type="string" var="$metadata.properties.support.email" options="email"> <help short="Email of support contact"/> </arg> <arg nullable="True" type="string" var="$metadata.properties.support.link" options="link"> <help short="Link for support help, like to support page to open a ticket etc."/> </arg> <arg nullable="True" type="string" var="$metadata.properties.support.name" options="name"> <help short="Name of the support contact. Company or person."/> </arg> <arg type="string" var="$metadata.properties.support.tier" options="tier"> <help short="Type of support for content item"/> <enum> <item name="Community" value=""Community""/> <item name="Microsoft" value=""Microsoft""/> <item name="Partner" value=""Partner""/> </enum> </arg> </arg> <arg nullable="True" type="array<string>" var="$metadata.properties.threatAnalysisTactics" options="threat-tactics" group="Properties"> <help short="the tactics the resource covers"/> <item type="string"/> </arg> <arg nullable="True" type="array<string>" var="$metadata.properties.threatAnalysisTechniques" options="threat-techniques" group="Properties"> <help short="the techniques the resource covers, these have to be aligned with the tactics being used"/> <item type="string"/> </arg> <arg nullable="True" type="string" var="$metadata.properties.version" options="version" group="Properties"> <help short="Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM template best practices. Can also be any string, but then we cannot guarantee any version checks"/> </arg> </argGroup> <operation operationId="Metadata_Get"> <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/metadata/{metadataName}"> <request method="get"> <path> <param type="string" name="metadataName" arg="$Path.metadataName" required="True"/> <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True"> <format maxLength="90" minLength="1"/> </param> <param type="string" name="subscriptionId" arg="$Path.subscriptionId" required="True"> <format minLength="1"/> </param> <param type="string" name="workspaceName" arg="$Path.workspaceName" required="True"> <format maxLength="90" minLength="1"/> </param> </path> <query> <const readOnly="True" const="True" type="string" name="api-version" required="True"> <default value=""2022-06-01-preview""/> <format minLength="1"/> </const> </query> </request> <response statusCode="200"> <body> <json var="$Instance"> <schema type="object" cls="MetadataModel_read"> <prop type="string" name="etag"/> <prop readOnly="True" type="ResourceId" name="id"> <format template="/subscriptions/{}/resourceGroups/{}/providers/Microsoft.OperationalInsights/workspaces/{}/providers/Microsoft.SecurityInsights/metadata/{}"/> </prop> <prop readOnly="True" type="string" name="name"/> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="author"> <prop type="string" name="email"/> <prop type="string" name="link"/> <prop type="string" name="name"/> </prop> <prop type="object" name="categories"> <prop type="array<string>" name="domains"> <item type="string"/> </prop> <prop type="array<string>" name="verticals"> <item type="string"/> </prop> </prop> <prop type="string" name="contentId"/> <prop type="string" name="contentSchemaVersion"/> <prop type="string" name="customVersion"/> <prop type="object" name="dependencies" cls="MetadataDependencies_read"> <prop type="string" name="contentId"/> <prop type="array<@MetadataDependencies_read>" name="criteria"> <item type="@MetadataDependencies_read"/> </prop> <prop type="string" name="kind"> <enum> <item value=""AnalyticsRule""/> <item value=""AnalyticsRuleTemplate""/> <item value=""AutomationRule""/> <item value=""AzureFunction""/> <item value=""DataConnector""/> <item value=""DataType""/> <item value=""HuntingQuery""/> <item value=""InvestigationQuery""/> <item value=""LogicAppsCustomConnector""/> <item value=""Parser""/> <item value=""Playbook""/> <item value=""PlaybookTemplate""/> <item value=""Solution""/> <item value=""Watchlist""/> <item value=""WatchlistTemplate""/> <item value=""Workbook""/> <item value=""WorkbookTemplate""/> </enum> </prop> <prop type="string" name="name"/> <prop type="string" name="operator"> <enum> <item value=""AND""/> <item value=""OR""/> </enum> </prop> <prop type="string" name="version"/> </prop> <prop type="date" name="firstPublishDate"/> <prop type="string" name="icon"/> <prop type="string" name="kind" required="True"> <enum> <item value=""AnalyticsRule""/> <item value=""AnalyticsRuleTemplate""/> <item value=""AutomationRule""/> <item value=""AzureFunction""/> <item value=""DataConnector""/> <item value=""DataType""/> <item value=""HuntingQuery""/> <item value=""InvestigationQuery""/> <item value=""LogicAppsCustomConnector""/> <item value=""Parser""/> <item value=""Playbook""/> <item value=""PlaybookTemplate""/> <item value=""Solution""/> <item value=""Watchlist""/> <item value=""WatchlistTemplate""/> <item value=""Workbook""/> <item value=""WorkbookTemplate""/> </enum> </prop> <prop type="date" name="lastPublishDate"/> <prop type="string" name="parentId" required="True"/> <prop type="array<string>" name="previewImages"> <item type="string"/> </prop> <prop type="array<string>" name="previewImagesDark"> <item type="string"/> </prop> <prop type="array<string>" name="providers"> <item type="string"/> </prop> <prop type="object" name="source"> <prop type="string" name="kind" required="True"> <enum> <item value=""Community""/> <item value=""LocalWorkspace""/> <item value=""Solution""/> <item value=""SourceRepository""/> </enum> </prop> <prop type="string" name="name"/> <prop type="string" name="sourceId"/> </prop> <prop type="object" name="support"> <prop type="string" name="email"/> <prop type="string" name="link"/> <prop type="string" name="name"/> <prop type="string" name="tier" required="True"> <enum> <item value=""Community""/> <item value=""Microsoft""/> <item value=""Partner""/> </enum> </prop> </prop> <prop type="array<string>" name="threatAnalysisTactics"> <item type="string"/> </prop> <prop type="array<string>" name="threatAnalysisTechniques"> <item type="string"/> </prop> <prop type="string" name="version"/> </prop> <prop readOnly="True" type="object" name="systemData"> <prop readOnly="True" type="dateTime" name="createdAt"/> <prop readOnly="True" type="string" name="createdBy"/> <prop readOnly="True" type="string" name="createdByType"> <enum> <item value=""Application""/> <item value=""Key""/> <item value=""ManagedIdentity""/> <item value=""User""/> </enum> </prop> <prop readOnly="True" type="dateTime" name="lastModifiedAt"/> <prop readOnly="True" type="string" name="lastModifiedBy"/> <prop readOnly="True" type="string" name="lastModifiedByType"> <enum> <item value=""Application""/> <item value=""Key""/> <item value=""ManagedIdentity""/> <item value=""User""/> </enum> </prop> </prop> <prop readOnly="True" type="string" name="type"/> </schema> </json> </body> </response> <response isError="True"> <body> <json> <schema type="@ODataV4Format"/> </json> </body> </response> </http> </operation> <operation> <instanceUpdate instance="$Instance"> <json> <schema type="object" name="metadata" required="True" clientFlatten="True"> <prop type="string" name="etag" arg="$metadata.etag"/> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="author" arg="$metadata.properties.author"> <prop type="string" name="email" arg="$metadata.properties.author.email"/> <prop type="string" name="link" arg="$metadata.properties.author.link"/> <prop type="string" name="name" arg="$metadata.properties.author.name"/> </prop> <prop type="object" name="categories" arg="$metadata.properties.categories"> <prop type="array<string>" name="domains" arg="$metadata.properties.categories.domains"> <item type="string"/> </prop> <prop type="array<string>" name="verticals" arg="$metadata.properties.categories.verticals"> <item type="string"/> </prop> </prop> <prop type="string" name="contentId" arg="$metadata.properties.contentId"/> <prop type="string" name="contentSchemaVersion" arg="$metadata.properties.contentSchemaVersion"/> <prop type="string" name="customVersion" arg="$metadata.properties.customVersion"/> <prop type="object" name="dependencies" arg="$metadata.properties.dependencies" cls="MetadataDependencies_update"> <prop type="string" name="contentId" arg="@MetadataDependencies_update.contentId"/> <prop type="array<@MetadataDependencies_update>" name="criteria" arg="@MetadataDependencies_update.criteria"> <item type="@MetadataDependencies_update"/> </prop> <prop type="string" name="kind" arg="@MetadataDependencies_update.kind"> <enum> <item value=""AnalyticsRule""/> <item value=""AnalyticsRuleTemplate""/> <item value=""AutomationRule""/> <item value=""AzureFunction""/> <item value=""DataConnector""/> <item value=""DataType""/> <item value=""HuntingQuery""/> <item value=""InvestigationQuery""/> <item value=""LogicAppsCustomConnector""/> <item value=""Parser""/> <item value=""Playbook""/> <item value=""PlaybookTemplate""/> <item value=""Solution""/> <item value=""Watchlist""/> <item value=""WatchlistTemplate""/> <item value=""Workbook""/> <item value=""WorkbookTemplate""/> </enum> </prop> <prop type="string" name="name" arg="@MetadataDependencies_update.name"/> <prop type="string" name="operator" arg="@MetadataDependencies_update.operator"> <enum> <item value=""AND""/> <item value=""OR""/> </enum> </prop> <prop type="string" name="version" arg="@MetadataDependencies_update.version"/> </prop> <prop type="date" name="firstPublishDate" arg="$metadata.properties.firstPublishDate"/> <prop type="string" name="icon" arg="$metadata.properties.icon"/> <prop type="string" name="kind" arg="$metadata.properties.kind" required="True"> <enum> <item value=""AnalyticsRule""/> <item value=""AnalyticsRuleTemplate""/> <item value=""AutomationRule""/> <item value=""AzureFunction""/> <item value=""DataConnector""/> <item value=""DataType""/> <item value=""HuntingQuery""/> <item value=""InvestigationQuery""/> <item value=""LogicAppsCustomConnector""/> <item value=""Parser""/> <item value=""Playbook""/> <item value=""PlaybookTemplate""/> <item value=""Solution""/> <item value=""Watchlist""/> <item value=""WatchlistTemplate""/> <item value=""Workbook""/> <item value=""WorkbookTemplate""/> </enum> </prop> <prop type="date" name="lastPublishDate" arg="$metadata.properties.lastPublishDate"/> <prop type="string" name="parentId" arg="$metadata.properties.parentId" required="True"/> <prop type="array<string>" name="previewImages" arg="$metadata.properties.previewImages"> <item type="string"/> </prop> <prop type="array<string>" name="previewImagesDark" arg="$metadata.properties.previewImagesDark"> <item type="string"/> </prop> <prop type="array<string>" name="providers" arg="$metadata.properties.providers"> <item type="string"/> </prop> <prop type="object" name="source" arg="$metadata.properties.source"> <prop type="string" name="kind" arg="$metadata.properties.source.kind" required="True"> <enum> <item value=""Community""/> <item value=""LocalWorkspace""/> <item value=""Solution""/> <item value=""SourceRepository""/> </enum> </prop> <prop type="string" name="name" arg="$metadata.properties.source.name"/> <prop type="string" name="sourceId" arg="$metadata.properties.source.sourceId"/> </prop> <prop type="object" name="support" arg="$metadata.properties.support"> <prop type="string" name="email" arg="$metadata.properties.support.email"/> <prop type="string" name="link" arg="$metadata.properties.support.link"/> <prop type="string" name="name" arg="$metadata.properties.support.name"/> <prop type="string" name="tier" arg="$metadata.properties.support.tier" required="True"> <enum> <item value=""Community""/> <item value=""Microsoft""/> <item value=""Partner""/> </enum> </prop> </prop> <prop type="array<string>" name="threatAnalysisTactics" arg="$metadata.properties.threatAnalysisTactics"> <item type="string"/> </prop> <prop type="array<string>" name="threatAnalysisTechniques" arg="$metadata.properties.threatAnalysisTechniques"> <item type="string"/> </prop> <prop type="string" name="version" arg="$metadata.properties.version"/> </prop> </schema> </json> </instanceUpdate> </operation> <operation operationId="Metadata_Create"> <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/metadata/{metadataName}"> <request method="put"> <path> <param type="string" name="metadataName" arg="$Path.metadataName" required="True"/> <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True"> <format maxLength="90" minLength="1"/> </param> <param type="string" name="subscriptionId" arg="$Path.subscriptionId" required="True"> <format minLength="1"/> </param> <param type="string" name="workspaceName" arg="$Path.workspaceName" required="True"> <format maxLength="90" minLength="1"/> </param> </path> <query> <const readOnly="True" const="True" type="string" name="api-version" required="True"> <default value=""2022-06-01-preview""/> <format minLength="1"/> </const> </query> <body> <json ref="$Instance"/> </body> </request> <response statusCode="200 201"> <body> <json var="$Instance"> <schema type="@MetadataModel_read"/> </json> </body> </response> <response isError="True"> <body> <json> <schema type="@ODataV4Format"/> </json> </body> </response> </http> </operation> <output type="object" ref="$Instance" clientFlatten="True"/> </command> </commandGroup> </CodeGen>

Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5vcGVyYXRpb25hbGluc2lnaHRzL3dvcmtzcGFjZXMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5zZWN1cml0eWluc2lnaHRzL21ldGFkYXRhL3t9/2022-06-01-preview.xml (1,304 lines of code) (raw):