Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5vcGVyYXRpb25hbGluc2lnaHRzL3dvcmtzcGFjZXMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5zZWN1cml0eWluc2lnaHRzL2RhdGFjb25uZWN0b3JzL3t9/2022-06-01-preview.xml

<?xml version='1.0' encoding='utf-8'?> <CodeGen plane="mgmt-plane"> <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.operationalinsights/workspaces/{}/providers/microsoft.securityinsights/dataconnectors/{}" version="2022-06-01-preview" swagger="mgmt-plane/securityinsights/ResourceProviders/Microsoft.SecurityInsights/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuT3BlcmF0aW9uYWxJbnNpZ2h0cy93b3Jrc3BhY2VzL3t3b3Jrc3BhY2VOYW1lfS9wcm92aWRlcnMvTWljcm9zb2Z0LlNlY3VyaXR5SW5zaWdodHMvZGF0YUNvbm5lY3RvcnMve2RhdGFDb25uZWN0b3JJZH0=/V/MjAyMi0wNi0wMS1wcmV2aWV3"/> <commandGroup name="sentinel data-connector"> <command name="show" version="2022-06-01-preview"> <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.operationalinsights/workspaces/{}/providers/microsoft.securityinsights/dataconnectors/{}" version="2022-06-01-preview" swagger="mgmt-plane/securityinsights/ResourceProviders/Microsoft.SecurityInsights/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuT3BlcmF0aW9uYWxJbnNpZ2h0cy93b3Jrc3BhY2VzL3t3b3Jrc3BhY2VOYW1lfS9wcm92aWRlcnMvTWljcm9zb2Z0LlNlY3VyaXR5SW5zaWdodHMvZGF0YUNvbm5lY3RvcnMve2RhdGFDb25uZWN0b3JJZH0=/V/MjAyMi0wNi0wMS1wcmV2aWV3"/> <argGroup name=""> <arg type="string" var="$Path.dataConnectorId" options="data-connector-id name n" required="True" idPart="child_name_1"> <help short="Connector ID"/> </arg> <arg type="ResourceGroupName" var="$Path.resourceGroupName" options="resource-group g" required="True" idPart="resource_group"/> <arg type="SubscriptionId" var="$Path.subscriptionId" options="subscription" required="True" idPart="subscription"/> <arg type="string" var="$Path.workspaceName" options="workspace-name w" required="True" stage="Experimental" idPart="name"> <help short="The name of the workspace."/> <format maxLength="90" minLength="1"/> </arg> </argGroup> <operation operationId="DataConnectors_Get"> <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors/{dataConnectorId}"> <request method="get"> <path> <param type="string" name="dataConnectorId" arg="$Path.dataConnectorId" required="True"/> <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True"> <format maxLength="90" minLength="1"/> </param> <param type="string" name="subscriptionId" arg="$Path.subscriptionId" required="True"> <format minLength="1"/> </param> <param type="string" name="workspaceName" arg="$Path.workspaceName" required="True"> <format maxLength="90" minLength="1"/> </param> </path> <query> <const readOnly="True" const="True" type="string" name="api-version" required="True"> <default value=""2022-06-01-preview""/> <format minLength="1"/> </const> </query> </request> <response statusCode="200"> <body> <json var="$Instance"> <schema type="object"> <prop type="string" name="etag"/> <prop readOnly="True" type="ResourceId" name="id"> <format template="/subscriptions/{}/resourceGroups/{}/providers/Microsoft.OperationalInsights/workspaces/{}/providers/Microsoft.SecurityInsights/dataConnectors/{}"/> </prop> <prop type="string" name="kind" required="True"> <enum> <item value=""APIPolling""/> <item value=""AmazonWebServicesCloudTrail""/> <item value=""AmazonWebServicesS3""/> <item value=""AzureActiveDirectory""/> <item value=""AzureAdvancedThreatProtection""/> <item value=""AzureSecurityCenter""/> <item value=""Dynamics365""/> <item value=""GenericUI""/> <item value=""IOT""/> <item value=""MicrosoftCloudAppSecurity""/> <item value=""MicrosoftDefenderAdvancedThreatProtection""/> <item value=""MicrosoftThreatIntelligence""/> <item value=""MicrosoftThreatProtection""/> <item value=""Office365""/> <item value=""Office365Project""/> <item value=""OfficeATP""/> <item value=""OfficeIRM""/> <item value=""OfficePowerBI""/> <item value=""ThreatIntelligence""/> <item value=""ThreatIntelligenceTaxii""/> </enum> </prop> <prop readOnly="True" type="string" name="name"/> <prop readOnly="True" type="object" name="systemData"> <prop readOnly="True" type="dateTime" name="createdAt"/> <prop readOnly="True" type="string" name="createdBy"/> <prop readOnly="True" type="string" name="createdByType"> <enum> <item value=""Application""/> <item value=""Key""/> <item value=""ManagedIdentity""/> <item value=""User""/> </enum> </prop> <prop readOnly="True" type="dateTime" name="lastModifiedAt"/> <prop readOnly="True" type="string" name="lastModifiedBy"/> <prop readOnly="True" type="string" name="lastModifiedByType"> <enum> <item value=""Application""/> <item value=""Key""/> <item value=""ManagedIdentity""/> <item value=""User""/> </enum> </prop> </prop> <prop readOnly="True" type="string" name="type"/> <discriminator property="kind" value="APIPolling"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@CodelessUiConnectorConfigProperties_read" name="connectorUiConfig"/> <prop type="object" name="pollingConfig"> <prop type="object" name="auth" required="True"> <prop type="string" name="apiKeyIdentifier"/> <prop type="string" name="apiKeyName"/> <prop type="string" name="authType" required="True"/> <prop type="string" name="authorizationEndpoint"/> <prop type="string" name="flowName"/> <prop type="string" name="isApiKeyInPostPayload"/> <prop type="boolean" name="isClientSecretInHeader"/> <prop type="string" name="redirectionEndpoint"/> <prop type="string" name="scope"/> <prop type="string" name="tokenEndpoint"/> </prop> <prop type="boolean" name="isActive"/> <prop type="object" name="paging"> <prop type="string" name="nextPageParaName"/> <prop type="string" name="nextPageTokenJsonPath"/> <prop type="string" name="pageCountAttributePath"/> <prop type="integer32" name="pageSize"/> <prop type="string" name="pageSizeParaName"/> <prop type="string" name="pageTimeStampAttributePath"/> <prop type="string" name="pageTotalCountAttributePath"/> <prop type="string" name="pagingType" required="True"/> <prop type="string" name="searchTheLatestTimeStampFromEventsList"/> </prop> <prop type="object" name="request" required="True"> <prop type="string" name="apiEndpoint" required="True"/> <prop type="string" name="endTimeAttributeName"/> <prop type="string" name="httpMethod" required="True"/> <prop type="string" name="queryParametersTemplate"/> <prop type="string" name="queryTimeFormat" required="True"/> <prop type="integer32" name="queryWindowInMin" required="True"/> <prop type="integer32" name="rateLimitQps"/> <prop type="integer32" name="retryCount"/> <prop type="string" name="startTimeAttributeName"/> <prop type="integer32" name="timeoutInSeconds"/> </prop> <prop type="object" name="response"> <prop type="array<string>" name="eventsJsonPaths" required="True"> <item type="string"/> </prop> <prop type="boolean" name="isGzipCompressed"/> <prop type="string" name="successStatusJsonPath"/> <prop type="string" name="successStatusValue"/> </prop> </prop> </prop> </discriminator> <discriminator property="kind" value="AmazonWebServicesCloudTrail"> <prop type="object" name="properties" clientFlatten="True"> <prop type="string" name="awsRoleArn"/> <prop type="object" name="dataTypes" required="True"> <prop type="object" name="logs" required="True"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> </prop> </discriminator> <discriminator property="kind" value="AmazonWebServicesS3"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" required="True"> <prop type="object" name="logs" required="True"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="destinationTable" required="True"/> <prop type="string" name="roleArn" required="True"/> <prop type="array<string>" name="sqsUrls" required="True"> <item type="string"/> </prop> </prop> </discriminator> <discriminator property="kind" value="AzureActiveDirectory"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" cls="AlertsDataTypeOfDataConnector_read"> <prop type="object" name="alerts" required="True" cls="DataConnectorDataTypeCommon_read"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="AzureAdvancedThreatProtection"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@AlertsDataTypeOfDataConnector_read" name="dataTypes"/> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="AzureSecurityCenter"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@AlertsDataTypeOfDataConnector_read" name="dataTypes"/> <prop type="string" name="subscriptionId"/> </prop> </discriminator> <discriminator property="kind" value="Dynamics365"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" required="True"> <prop type="object" name="dynamics365CdsActivities" required="True"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="GenericUI"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="connectorUiConfig" cls="CodelessUiConnectorConfigProperties_read"> <prop type="object" name="availability" required="True"> <prop type="boolean" name="isPreview"/> <prop type="integer32" name="status"> <enum> <item value="1"/> </enum> </prop> </prop> <prop type="array<object>" name="connectivityCriteria" required="True"> <item type="object"> <prop type="string" name="type"> <enum> <item value=""IsConnectedQuery""/> </enum> </prop> <prop type="array<string>" name="value"> <item type="string"/> </prop> </item> </prop> <prop type="string" name="customImage"/> <prop type="array<object>" name="dataTypes" required="True"> <item type="object"> <prop type="string" name="lastDataReceivedQuery"/> <prop type="string" name="name"/> </item> </prop> <prop type="string" name="descriptionMarkdown" required="True"/> <prop type="array<object>" name="graphQueries" required="True"> <item type="object"> <prop type="string" name="baseQuery"/> <prop type="string" name="legend"/> <prop type="string" name="metricName"/> </item> </prop> <prop type="string" name="graphQueriesTableName" required="True"/> <prop type="array<object>" name="instructionSteps" required="True"> <item type="object"> <prop type="string" name="description"/> <prop type="array<object>" name="instructions"> <item type="object"> <prop type="string" name="type" required="True"> <enum> <item value=""CopyableLabel""/> <item value=""InfoMessage""/> <item value=""InstructionStepsGroup""/> </enum> </prop> </item> </prop> <prop type="string" name="title"/> </item> </prop> <prop type="object" name="permissions" required="True"> <prop type="array<object>" name="customs"> <item type="object"> <prop type="string" name="description"/> <prop type="string" name="name"/> </item> </prop> <prop type="array<object>" name="resourceProvider"> <item type="object"> <prop type="string" name="permissionsDisplayText"/> <prop type="string" name="provider"> <enum> <item value=""Microsoft.Authorization/policyAssignments""/> <item value=""Microsoft.OperationalInsights/solutions""/> <item value=""Microsoft.OperationalInsights/workspaces""/> <item value=""Microsoft.OperationalInsights/workspaces/datasources""/> <item value=""Microsoft.OperationalInsights/workspaces/sharedKeys""/> <item value=""microsoft.aadiam/diagnosticSettings""/> </enum> </prop> <prop type="string" name="providerDisplayName"/> <prop type="object" name="requiredPermissions"> <prop type="boolean" name="action"/> <prop type="boolean" name="delete"/> <prop type="boolean" name="read"/> <prop type="boolean" name="write"/> </prop> <prop type="string" name="scope"> <enum> <item value=""ResourceGroup""/> <item value=""Subscription""/> <item value=""Workspace""/> </enum> </prop> </item> </prop> </prop> <prop type="string" name="publisher" required="True"/> <prop type="array<object>" name="sampleQueries" required="True"> <item type="object"> <prop type="string" name="description"/> <prop type="string" name="query"/> </item> </prop> <prop type="string" name="title" required="True"/> </prop> </prop> </discriminator> <discriminator property="kind" value="IOT"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@AlertsDataTypeOfDataConnector_read" name="dataTypes"/> <prop type="string" name="subscriptionId"/> </prop> </discriminator> <discriminator property="kind" value="MicrosoftCloudAppSecurity"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" required="True"> <prop type="@DataConnectorDataTypeCommon_read" name="alerts" required="True"/> <prop type="@DataConnectorDataTypeCommon_read" name="discoveryLogs"/> </prop> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="MicrosoftDefenderAdvancedThreatProtection"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@AlertsDataTypeOfDataConnector_read" name="dataTypes"/> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="MicrosoftThreatIntelligence"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" required="True"> <prop type="object" name="bingSafetyPhishingURL" required="True"> <prop type="string" name="lookbackPeriod" required="True"/> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> <prop type="object" name="microsoftEmergingThreatFeed" required="True"> <prop type="string" name="lookbackPeriod" required="True"/> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="MicrosoftThreatProtection"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" required="True"> <prop type="object" name="incidents" required="True"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="Office365"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" required="True"> <prop type="object" name="exchange" required="True"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> <prop type="object" name="sharePoint" required="True"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> <prop type="object" name="teams" required="True"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="Office365Project"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" required="True"> <prop type="object" name="logs" required="True"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="OfficeATP"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@AlertsDataTypeOfDataConnector_read" name="dataTypes"/> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="OfficeIRM"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@AlertsDataTypeOfDataConnector_read" name="dataTypes"/> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="OfficePowerBI"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" required="True"> <prop type="object" name="logs" required="True"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="ThreatIntelligence"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" required="True"> <prop type="object" name="indicators" required="True"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" required="True"/> <prop nullable="True" type="dateTime" name="tipLookbackPeriod"/> </prop> </discriminator> <discriminator property="kind" value="ThreatIntelligenceTaxii"> <prop type="object" name="properties" clientFlatten="True"> <prop type="string" name="collectionId"/> <prop type="object" name="dataTypes" required="True"> <prop type="object" name="taxiiClient" required="True"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="friendlyName"/> <prop type="string" name="password"/> <prop nullable="True" type="string" name="pollingFrequency" required="True"> <enum> <item value=""OnceADay""/> <item value=""OnceAMinute""/> <item value=""OnceAnHour""/> </enum> </prop> <prop nullable="True" type="dateTime" name="taxiiLookbackPeriod"/> <prop type="string" name="taxiiServer"/> <prop type="string" name="tenantId" required="True"/> <prop type="string" name="userName"/> <prop type="string" name="workspaceId"/> </prop> </discriminator> </schema> </json> </body> </response> <response isError="True"> <body> <json> <schema type="@ODataV4Format"/> </json> </body> </response> </http> </operation> <output type="object" ref="$Instance" clientFlatten="True"/> </command> <command name="delete" version="2022-06-01-preview" confirmation="Are you sure you want to perform this operation?"> <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.operationalinsights/workspaces/{}/providers/microsoft.securityinsights/dataconnectors/{}" version="2022-06-01-preview" swagger="mgmt-plane/securityinsights/ResourceProviders/Microsoft.SecurityInsights/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuT3BlcmF0aW9uYWxJbnNpZ2h0cy93b3Jrc3BhY2VzL3t3b3Jrc3BhY2VOYW1lfS9wcm92aWRlcnMvTWljcm9zb2Z0LlNlY3VyaXR5SW5zaWdodHMvZGF0YUNvbm5lY3RvcnMve2RhdGFDb25uZWN0b3JJZH0=/V/MjAyMi0wNi0wMS1wcmV2aWV3"/> <argGroup name=""> <arg type="string" var="$Path.dataConnectorId" options="data-connector-id name n" required="True" idPart="child_name_1"> <help short="Connector ID"/> </arg> <arg type="ResourceGroupName" var="$Path.resourceGroupName" options="resource-group g" required="True" idPart="resource_group"/> <arg type="SubscriptionId" var="$Path.subscriptionId" options="subscription" required="True" idPart="subscription"/> <arg type="string" var="$Path.workspaceName" options="workspace-name w" required="True" stage="Experimental" idPart="name"> <help short="The name of the workspace."/> <format maxLength="90" minLength="1"/> </arg> </argGroup> <operation operationId="DataConnectors_Delete"> <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors/{dataConnectorId}"> <request method="delete"> <path> <param type="string" name="dataConnectorId" arg="$Path.dataConnectorId" required="True"/> <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True"> <format maxLength="90" minLength="1"/> </param> <param type="string" name="subscriptionId" arg="$Path.subscriptionId" required="True"> <format minLength="1"/> </param> <param type="string" name="workspaceName" arg="$Path.workspaceName" required="True"> <format maxLength="90" minLength="1"/> </param> </path> <query> <const readOnly="True" const="True" type="string" name="api-version" required="True"> <default value=""2022-06-01-preview""/> <format minLength="1"/> </const> </query> </request> <response statusCode="200"/> <response statusCode="204"/> <response isError="True"> <body> <json> <schema type="@ODataV4Format"/> </json> </body> </response> </http> </operation> </command> <command name="create" version="2022-06-01-preview"> <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.operationalinsights/workspaces/{}/providers/microsoft.securityinsights/dataconnectors/{}" version="2022-06-01-preview" swagger="mgmt-plane/securityinsights/ResourceProviders/Microsoft.SecurityInsights/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuT3BlcmF0aW9uYWxJbnNpZ2h0cy93b3Jrc3BhY2VzL3t3b3Jrc3BhY2VOYW1lfS9wcm92aWRlcnMvTWljcm9zb2Z0LlNlY3VyaXR5SW5zaWdodHMvZGF0YUNvbm5lY3RvcnMve2RhdGFDb25uZWN0b3JJZH0=/V/MjAyMi0wNi0wMS1wcmV2aWV3"/> <argGroup name=""> <arg type="string" var="$Path.dataConnectorId" options="data-connector-id name n" required="True" idPart="child_name_1"> <help short="Connector ID"/> </arg> <arg type="ResourceGroupName" var="$Path.resourceGroupName" options="resource-group g" required="True" idPart="resource_group"/> <arg type="SubscriptionId" var="$Path.subscriptionId" options="subscription" required="True" idPart="subscription"/> <arg type="string" var="$Path.workspaceName" options="workspace-name w" required="True" stage="Experimental" idPart="name"> <help short="The name of the workspace."/> <format maxLength="90" minLength="1"/> </arg> </argGroup> <argGroup name="DataConnector"> <arg type="object" var="$dataConnector.APIPolling" options="api-polling" group="DataConnector"> <arg type="@CodelessUiConnectorConfigProperties_create" var="$dataConnector.APIPolling.properties.connectorUiConfig" options="connector-ui-config" group="Properties"> <help short="Config to describe the instructions blade"/> </arg> <arg type="object" var="$dataConnector.APIPolling.properties.pollingConfig" options="polling-config" group="Properties"> <help short="Config to describe the polling instructions"/> <arg type="object" var="$dataConnector.APIPolling.properties.pollingConfig.auth" options="auth" required="True"> <help short="Describe the authentication type of the poller"/> <arg type="string" var="$dataConnector.APIPolling.properties.pollingConfig.auth.apiKeyIdentifier" options="api-key-identifier"> <help short="A prefix send in the header before the actual token"/> </arg> <arg type="string" var="$dataConnector.APIPolling.properties.pollingConfig.auth.apiKeyName" options="api-key-name"> <help short="The header name which the token is sent with"/> </arg> <arg type="string" var="$dataConnector.APIPolling.properties.pollingConfig.auth.authType" options="auth-type" required="True"> <help short="The authentication type"/> </arg> <arg type="string" var="$dataConnector.APIPolling.properties.pollingConfig.auth.authorizationEndpoint" options="authorization-endpoint"> <help short="The endpoint used to authorize the user, used in Oauth 2.0 flow"/> </arg> <arg type="string" var="$dataConnector.APIPolling.properties.pollingConfig.auth.flowName" options="flow-name"> <help short="Describes the flow name, for example 'AuthCode' for Oauth 2.0"/> </arg> <arg type="string" var="$dataConnector.APIPolling.properties.pollingConfig.auth.isApiKeyInPostPayload" options="is-api-key-in-post-payload"> <help short="Marks if the key should sent in header"/> </arg> <arg type="boolean" var="$dataConnector.APIPolling.properties.pollingConfig.auth.isClientSecretInHeader" options="is-client-secret-in-header"> <help short="Marks if we should send the client secret in header or payload, used in Oauth 2.0 flow"/> </arg> <arg type="string" var="$dataConnector.APIPolling.properties.pollingConfig.auth.redirectionEndpoint" options="redirection-endpoint"> <help short="The redirect endpoint where we will get the authorization code, used in Oauth 2.0 flow"/> </arg> <arg type="string" var="$dataConnector.APIPolling.properties.pollingConfig.auth.scope" options="scope"> <help short="The OAuth token scope"/> </arg> <arg type="string" var="$dataConnector.APIPolling.properties.pollingConfig.auth.tokenEndpoint" options="token-endpoint"> <help short="The endpoint used to issue a token, used in Oauth 2.0 flow"/> </arg> </arg> <arg type="boolean" var="$dataConnector.APIPolling.properties.pollingConfig.isActive" options="is-active"> <help short="The poller active status"/> </arg> <arg type="object" var="$dataConnector.APIPolling.properties.pollingConfig.paging" options="paging"> <help short="Describe the poll request paging config of the poller"/> <arg type="string" var="$dataConnector.APIPolling.properties.pollingConfig.paging.nextPageParaName" options="next-page-para-name"> <help short="Defines the name of a next page attribute"/> </arg> <arg type="string" var="$dataConnector.APIPolling.properties.pollingConfig.paging.nextPageTokenJsonPath" options="next-page-token-json-path"> <help short="Defines the path to a next page token JSON"/> </arg> <arg type="string" var="$dataConnector.APIPolling.properties.pollingConfig.paging.pageCountAttributePath" options="page-count-attribute-path"> <help short="Defines the path to a page count attribute"/> </arg> <arg type="integer32" var="$dataConnector.APIPolling.properties.pollingConfig.paging.pageSize" options="page-size"> <help short="Defines the paging size"/> </arg> <arg type="string" var="$dataConnector.APIPolling.properties.pollingConfig.paging.pageSizeParaName" options="page-size-para-name"> <help short="Defines the name of the page size parameter"/> </arg> <arg type="string" var="$dataConnector.APIPolling.properties.pollingConfig.paging.pageTimeStampAttributePath" options="page-time-stamp-attribute-path"> <help short="Defines the path to a paging time stamp attribute"/> </arg> <arg type="string" var="$dataConnector.APIPolling.properties.pollingConfig.paging.pageTotalCountAttributePath" options="page-total-count-attribute-path"> <help short="Defines the path to a page total count attribute"/> </arg> <arg type="string" var="$dataConnector.APIPolling.properties.pollingConfig.paging.pagingType" options="paging-type" required="True"> <help short="Describes the type. could be 'None', 'PageToken', 'PageCount', 'TimeStamp'"/> </arg> <arg type="string" var="$dataConnector.APIPolling.properties.pollingConfig.paging.searchTheLatestTimeStampFromEventsList" options="search-the-latest-time-stamp-from-events-list"> <help short="Determines whether to search for the latest time stamp in the events list"/> </arg> </arg> <arg type="object" var="$dataConnector.APIPolling.properties.pollingConfig.request" options="request" required="True"> <help short="Describe the poll request config parameters of the poller"/> <arg type="string" var="$dataConnector.APIPolling.properties.pollingConfig.request.apiEndpoint" options="api-endpoint" required="True"> <help short="Describe the endpoint we should pull the data from"/> </arg> <arg type="string" var="$dataConnector.APIPolling.properties.pollingConfig.request.endTimeAttributeName" options="end-time-attribute-name"> <help short="This will be used the query events from the end of the time window"/> </arg> <arg type="string" var="$dataConnector.APIPolling.properties.pollingConfig.request.httpMethod" options="http-method" required="True"> <help short="The http method type we will use in the poll request, GET or POST"/> </arg> <arg type="string" var="$dataConnector.APIPolling.properties.pollingConfig.request.queryParametersTemplate" options="query-parameters-template"> <help short="For advanced scenarios for example user name/password embedded in nested JSON payload"/> </arg> <arg type="string" var="$dataConnector.APIPolling.properties.pollingConfig.request.queryTimeFormat" options="query-time-format" required="True"> <help short="The time format will be used the query events in a specific window"/> </arg> <arg type="integer32" var="$dataConnector.APIPolling.properties.pollingConfig.request.queryWindowInMin" options="query-window-in-min" required="True"> <help short="The window interval we will use the pull the data"/> </arg> <arg type="integer32" var="$dataConnector.APIPolling.properties.pollingConfig.request.rateLimitQps" options="rate-limit-qps"> <help short="Defines the rate limit QPS"/> </arg> <arg type="integer32" var="$dataConnector.APIPolling.properties.pollingConfig.request.retryCount" options="retry-count"> <help short="Describe the amount of time we should try and poll the data in case of failure"/> </arg> <arg type="string" var="$dataConnector.APIPolling.properties.pollingConfig.request.startTimeAttributeName" options="start-time-attribute-name"> <help short="This will be used the query events from a start of the time window"/> </arg> <arg type="integer32" var="$dataConnector.APIPolling.properties.pollingConfig.request.timeoutInSeconds" options="timeout-in-seconds"> <help short="The number of seconds we will consider as a request timeout"/> </arg> </arg> <arg type="object" var="$dataConnector.APIPolling.properties.pollingConfig.response" options="response"> <help short="Describe the response config parameters of the poller"/> <arg type="array<string>" var="$dataConnector.APIPolling.properties.pollingConfig.response.eventsJsonPaths" options="events-json-paths" required="True"> <help short="Describes the path we should extract the data in the response"/> <item type="string"/> </arg> <arg type="boolean" var="$dataConnector.APIPolling.properties.pollingConfig.response.isGzipCompressed" options="is-gzip-compressed"> <help short="Describes if the data in the response is Gzip"/> </arg> <arg type="string" var="$dataConnector.APIPolling.properties.pollingConfig.response.successStatusJsonPath" options="success-status-json-path"> <help short="Describes the path we should extract the status code in the response"/> </arg> <arg type="string" var="$dataConnector.APIPolling.properties.pollingConfig.response.successStatusValue" options="success-status-value"> <help short="Describes the path we should extract the status value in the response"/> </arg> </arg> </arg> </arg> <arg type="object" var="$dataConnector.AmazonWebServicesCloudTrail" options="aws-cloud-trail" group="DataConnector"> <help short="Amazon web services cloud trail."/> <arg type="string" var="$dataConnector.AmazonWebServicesCloudTrail.properties.awsRoleArn" options="aws-role-arn" group="Properties"> <help short="The Aws Role Arn (with CloudTrailReadOnly policy) that is used to access the Aws account."/> </arg> <arg type="object" var="$dataConnector.AmazonWebServicesCloudTrail.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for the connector."/> <arg type="object" var="$dataConnector.AmazonWebServicesCloudTrail.properties.dataTypes.logs" options="logs" required="True"> <help short="Logs data type."/> <arg type="string" var="$dataConnector.AmazonWebServicesCloudTrail.properties.dataTypes.logs.state" options="state" required="True"> <help short="Describe whether this data type connection is enabled or not."/> <enum> <item name="Disabled" value=""Disabled""/> <item name="Enabled" value=""Enabled""/> </enum> </arg> </arg> </arg> </arg> <arg type="object" var="$dataConnector.AmazonWebServicesS3" options="aws-s3" group="DataConnector"> <help short="Amazon web services s3."/> <arg type="object" var="$dataConnector.AmazonWebServicesS3.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for the connector."/> <arg type="object" var="$dataConnector.AmazonWebServicesS3.properties.dataTypes.logs" options="logs" required="True"> <help short="Logs data type."/> <arg type="string" var="$dataConnector.AmazonWebServicesS3.properties.dataTypes.logs.state" options="state" required="True"> <help short="Describe whether this data type connection is enabled or not."/> <enum> <item name="Disabled" value=""Disabled""/> <item name="Enabled" value=""Enabled""/> </enum> </arg> </arg> </arg> <arg type="string" var="$dataConnector.AmazonWebServicesS3.properties.destinationTable" options="destination-table" group="Properties"> <help short="The logs destination table name in LogAnalytics."/> </arg> <arg type="string" var="$dataConnector.AmazonWebServicesS3.properties.roleArn" options="role-arn" group="Properties"> <help short="The Aws Role Arn that is used to access the Aws account."/> </arg> <arg type="array<string>" var="$dataConnector.AmazonWebServicesS3.properties.sqsUrls" options="sqs-urls" group="Properties"> <help short="The AWS sqs urls for the connector."/> <item type="string"/> </arg> </arg> <arg type="object" var="$dataConnector.AzureActiveDirectory" options="azure-active-directory" group="DataConnector"> <arg type="object" var="$dataConnector.AzureActiveDirectory.properties.dataTypes" options="data-types" group="Properties" cls="AlertsDataTypeOfDataConnector_create"> <help short="The available data types for the connector."/> <arg type="object" var="@AlertsDataTypeOfDataConnector_create.alerts" options="alerts" required="True" cls="DataConnectorDataTypeCommon_create"> <help short="Alerts data type connection."/> <arg type="string" var="@DataConnectorDataTypeCommon_create.state" options="state" required="True"> <help short="Describe whether this data type connection is enabled or not."/> <enum> <item name="Disabled" value=""Disabled""/> <item name="Enabled" value=""Enabled""/> </enum> </arg> </arg> </arg> <arg type="string" var="$dataConnector.AzureActiveDirectory.properties.tenantId" options="tenant-id" group="Properties"> <help short="The tenant id to connect to, and get the data from."/> </arg> </arg> <arg type="object" var="$dataConnector.AzureAdvancedThreatProtection" options="azure-protection" group="DataConnector"> <help short="Azure advanced threat protection."/> <arg type="@AlertsDataTypeOfDataConnector_create" var="$dataConnector.AzureAdvancedThreatProtection.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for the connector."/> </arg> <arg type="string" var="$dataConnector.AzureAdvancedThreatProtection.properties.tenantId" options="tenant-id" group="Properties"> <help short="The tenant id to connect to, and get the data from."/> </arg> </arg> <arg type="object" var="$dataConnector.AzureSecurityCenter" options="azure-security-center" group="DataConnector"> <arg type="@AlertsDataTypeOfDataConnector_create" var="$dataConnector.AzureSecurityCenter.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for the connector."/> </arg> <arg type="string" var="$dataConnector.AzureSecurityCenter.properties.subscriptionId" options="subscription-id" group="Properties"> <help short="The subscription id to connect to, and get the data from."/> </arg> </arg> <arg type="object" var="$dataConnector.Dynamics365" options="dynamics365" group="DataConnector"> <arg type="object" var="$dataConnector.Dynamics365.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for the connector."/> <arg type="object" var="$dataConnector.Dynamics365.properties.dataTypes.dynamics365CdsActivities" options="dynamics365-cds-activities" required="True"> <help short="Common Data Service data type connection."/> <arg type="string" var="$dataConnector.Dynamics365.properties.dataTypes.dynamics365CdsActivities.state" options="state" required="True"> <help short="Describe whether this data type connection is enabled or not."/> <enum> <item name="Disabled" value=""Disabled""/> <item name="Enabled" value=""Enabled""/> </enum> </arg> </arg> </arg> <arg type="string" var="$dataConnector.Dynamics365.properties.tenantId" options="tenant-id" group="Properties"> <help short="The tenant id to connect to, and get the data from."/> </arg> </arg> <arg type="object" var="$dataConnector.GenericUI" options="generic-ui" group="DataConnector"> <arg type="object" var="$dataConnector.GenericUI.properties.connectorUiConfig" options="connector-ui-config" group="Properties" cls="CodelessUiConnectorConfigProperties_create"> <help short="Config to describe the instructions blade"/> <arg type="object" var="@CodelessUiConnectorConfigProperties_create.availability" options="availability" required="True"> <help short="Connector Availability Status"/> <arg type="boolean" var="@CodelessUiConnectorConfigProperties_create.availability.isPreview" options="is-preview"> <help short="Set connector as preview"/> </arg> <arg type="integer32" var="@CodelessUiConnectorConfigProperties_create.availability.status" options="status"> <help short="The connector Availability Status"/> <enum> <item name="1" value="1"/> </enum> </arg> </arg> <arg type="array<object>" var="@CodelessUiConnectorConfigProperties_create.connectivityCriteria" options="connectivity-criteria" required="True"> <help short="Define the way the connector check connectivity"/> <item type="object"> <arg type="string" var="@CodelessUiConnectorConfigProperties_create.connectivityCriteria[].type" options="type"> <help short="type of connectivity"/> <enum> <item name="IsConnectedQuery" value=""IsConnectedQuery""/> </enum> </arg> <arg type="array<string>" var="@CodelessUiConnectorConfigProperties_create.connectivityCriteria[].value" options="value"> <help short="Queries for checking connectivity"/> <item type="string"/> </arg> </item> </arg> <arg type="string" var="@CodelessUiConnectorConfigProperties_create.customImage" options="custom-image"> <help short="An optional custom image to be used when displaying the connector within Azure Sentinel's connector's gallery"/> </arg> <arg type="array<object>" var="@CodelessUiConnectorConfigProperties_create.dataTypes" options="data-types" required="True"> <help short="Data types to check for last data received"/> <item type="object"> <arg type="string" var="@CodelessUiConnectorConfigProperties_create.dataTypes[].lastDataReceivedQuery" options="last-data-received-query"> <help short="Query for indicate last data received"/> </arg> <arg type="string" var="@CodelessUiConnectorConfigProperties_create.dataTypes[].name" options="name"> <help short="Name of the data type to show in the graph. can be use with {{graphQueriesTableName}} placeholder"/> </arg> </item> </arg> <arg type="string" var="@CodelessUiConnectorConfigProperties_create.descriptionMarkdown" options="description-markdown" required="True"> <help short="Connector description"/> </arg> <arg type="array<object>" var="@CodelessUiConnectorConfigProperties_create.graphQueries" options="graph-queries" required="True"> <help short="The graph query to show the current data status"/> <item type="object"> <arg type="string" var="@CodelessUiConnectorConfigProperties_create.graphQueries[].baseQuery" options="base-query"> <help short="The base query for the graph"/> </arg> <arg type="string" var="@CodelessUiConnectorConfigProperties_create.graphQueries[].legend" options="legend"> <help short="The legend for the graph"/> </arg> <arg type="string" var="@CodelessUiConnectorConfigProperties_create.graphQueries[].metricName" options="metric-name"> <help short="the metric that the query is checking"/> </arg> </item> </arg> <arg type="string" var="@CodelessUiConnectorConfigProperties_create.graphQueriesTableName" options="graph-queries-table-name" required="True"> <help short="Name of the table the connector will insert the data to"/> </arg> <arg type="array<object>" var="@CodelessUiConnectorConfigProperties_create.instructionSteps" options="instruction-steps" required="True"> <help short="Instruction steps to enable the connector"/> <item type="object"> <arg type="string" var="@CodelessUiConnectorConfigProperties_create.instructionSteps[].description" options="description"> <help short="Instruction step description"/> </arg> <arg type="array<object>" var="@CodelessUiConnectorConfigProperties_create.instructionSteps[].instructions" options="instructions"> <help short="Instruction step details"/> <item type="object"> <arg type="string" var="@CodelessUiConnectorConfigProperties_create.instructionSteps[].instructions[].type" options="type" required="True"> <help short="The kind of the setting"/> <enum> <item name="CopyableLabel" value=""CopyableLabel""/> <item name="InfoMessage" value=""InfoMessage""/> <item name="InstructionStepsGroup" value=""InstructionStepsGroup""/> </enum> </arg> </item> </arg> <arg type="string" var="@CodelessUiConnectorConfigProperties_create.instructionSteps[].title" options="title"> <help short="Instruction step title"/> </arg> </item> </arg> <arg type="object" var="@CodelessUiConnectorConfigProperties_create.permissions" options="permissions" required="True"> <help short="Permissions required for the connector"/> <arg type="array<object>" var="@CodelessUiConnectorConfigProperties_create.permissions.customs" options="customs"> <help short="Customs permissions required for the connector"/> <item type="object"> <arg type="string" var="@CodelessUiConnectorConfigProperties_create.permissions.customs[].description" options="description"> <help short="Customs permissions description"/> </arg> <arg type="string" var="@CodelessUiConnectorConfigProperties_create.permissions.customs[].name" options="name"> <help short="Customs permissions name"/> </arg> </item> </arg> <arg type="array<object>" var="@CodelessUiConnectorConfigProperties_create.permissions.resourceProvider" options="resource-provider"> <help short="Resource provider permissions required for the connector"/> <item type="object"> <arg type="string" var="@CodelessUiConnectorConfigProperties_create.permissions.resourceProvider[].permissionsDisplayText" options="permissions-display-text"> <help short="Permission description text"/> </arg> <arg type="string" var="@CodelessUiConnectorConfigProperties_create.permissions.resourceProvider[].provider" options="provider"> <help short="Provider name"/> <enum> <item name="Microsoft.Authorization/policyAssignments" value=""Microsoft.Authorization/policyAssignments""/> <item name="Microsoft.OperationalInsights/solutions" value=""Microsoft.OperationalInsights/solutions""/> <item name="Microsoft.OperationalInsights/workspaces" value=""Microsoft.OperationalInsights/workspaces""/> <item name="Microsoft.OperationalInsights/workspaces/datasources" value=""Microsoft.OperationalInsights/workspaces/datasources""/> <item name="Microsoft.OperationalInsights/workspaces/sharedKeys" value=""Microsoft.OperationalInsights/workspaces/sharedKeys""/> <item name="microsoft.aadiam/diagnosticSettings" value=""microsoft.aadiam/diagnosticSettings""/> </enum> </arg> <arg type="string" var="@CodelessUiConnectorConfigProperties_create.permissions.resourceProvider[].providerDisplayName" options="provider-display-name"> <help short="Permission provider display name"/> </arg> <arg type="object" var="@CodelessUiConnectorConfigProperties_create.permissions.resourceProvider[].requiredPermissions" options="required-permissions"> <help short="Required permissions for the connector"/> <arg type="boolean" var="@CodelessUiConnectorConfigProperties_create.permissions.resourceProvider[].requiredPermissions.action" options="action"> <help short="action permission"/> </arg> <arg type="boolean" var="@CodelessUiConnectorConfigProperties_create.permissions.resourceProvider[].requiredPermissions.delete" options="delete"> <help short="delete permission"/> </arg> <arg type="boolean" var="@CodelessUiConnectorConfigProperties_create.permissions.resourceProvider[].requiredPermissions.read" options="read"> <help short="read permission"/> </arg> <arg type="boolean" var="@CodelessUiConnectorConfigProperties_create.permissions.resourceProvider[].requiredPermissions.write" options="write"> <help short="write permission"/> </arg> </arg> <arg type="string" var="@CodelessUiConnectorConfigProperties_create.permissions.resourceProvider[].scope" options="scope"> <help short="Permission provider scope"/> <enum> <item name="ResourceGroup" value=""ResourceGroup""/> <item name="Subscription" value=""Subscription""/> <item name="Workspace" value=""Workspace""/> </enum> </arg> </item> </arg> </arg> <arg type="string" var="@CodelessUiConnectorConfigProperties_create.publisher" options="publisher" required="True"> <help short="Connector publisher name"/> </arg> <arg type="array<object>" var="@CodelessUiConnectorConfigProperties_create.sampleQueries" options="sample-queries" required="True"> <help short="The sample queries for the connector"/> <item type="object"> <arg type="string" var="@CodelessUiConnectorConfigProperties_create.sampleQueries[].description" options="description"> <help short="The sample query description"/> </arg> <arg type="string" var="@CodelessUiConnectorConfigProperties_create.sampleQueries[].query" options="query"> <help short="the sample query"/> </arg> </item> </arg> <arg type="string" var="@CodelessUiConnectorConfigProperties_create.title" options="title" required="True"> <help short="Connector blade title"/> </arg> </arg> </arg> <arg type="object" var="$dataConnector.IOT" options="iot" group="DataConnector"> <arg type="@AlertsDataTypeOfDataConnector_create" var="$dataConnector.IOT.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for the connector."/> </arg> <arg type="string" var="$dataConnector.IOT.properties.subscriptionId" options="subscription-id" group="Properties"> <help short="The subscription id to connect to, and get the data from."/> </arg> </arg> <arg type="object" var="$dataConnector.MicrosoftCloudAppSecurity" options="cloud-app-security" group="DataConnector"> <help short="Microsoft cloud app security."/> <arg type="object" var="$dataConnector.MicrosoftCloudAppSecurity.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for the connector."/> <arg type="@DataConnectorDataTypeCommon_create" var="$dataConnector.MicrosoftCloudAppSecurity.properties.dataTypes.alerts" options="alerts" required="True"> <help short="Alerts data type connection."/> </arg> <arg type="@DataConnectorDataTypeCommon_create" var="$dataConnector.MicrosoftCloudAppSecurity.properties.dataTypes.discoveryLogs" options="discovery-logs"> <help short="Discovery log data type connection."/> </arg> </arg> <arg type="string" var="$dataConnector.MicrosoftCloudAppSecurity.properties.tenantId" options="tenant-id" group="Properties"> <help short="The tenant id to connect to, and get the data from."/> </arg> </arg> <arg type="object" var="$dataConnector.MicrosoftDefenderAdvancedThreatProtection" options="defender-protection" group="DataConnector"> <help short="Microsoft defender advanced threat protection."/> <arg type="@AlertsDataTypeOfDataConnector_create" var="$dataConnector.MicrosoftDefenderAdvancedThreatProtection.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for the connector."/> </arg> <arg type="string" var="$dataConnector.MicrosoftDefenderAdvancedThreatProtection.properties.tenantId" options="tenant-id" group="Properties"> <help short="The tenant id to connect to, and get the data from."/> </arg> </arg> <arg type="object" var="$dataConnector.MicrosoftThreatIntelligence" options="microsoft-intelligence" group="DataConnector"> <help short="Microsoft threat intelligence."/> <arg type="object" var="$dataConnector.MicrosoftThreatIntelligence.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for the connector."/> <arg type="object" var="$dataConnector.MicrosoftThreatIntelligence.properties.dataTypes.bingSafetyPhishingURL" options="bing-safety-phishing-url" required="True"> <help short="Data type for Microsoft Threat Intelligence Platforms data connector."/> <arg type="string" var="$dataConnector.MicrosoftThreatIntelligence.properties.dataTypes.bingSafetyPhishingURL.lookbackPeriod" options="lookback-period" required="True"> <help short="lookback period"/> </arg> <arg type="string" var="$dataConnector.MicrosoftThreatIntelligence.properties.dataTypes.bingSafetyPhishingURL.state" options="state" required="True"> <help short="Describe whether this data type connection is enabled or not."/> <enum> <item name="Disabled" value=""Disabled""/> <item name="Enabled" value=""Enabled""/> </enum> </arg> </arg> <arg type="object" var="$dataConnector.MicrosoftThreatIntelligence.properties.dataTypes.microsoftEmergingThreatFeed" options="microsoft-emerging-threat-feed" required="True"> <help short="Data type for Microsoft Threat Intelligence Platforms data connector."/> <arg type="string" var="$dataConnector.MicrosoftThreatIntelligence.properties.dataTypes.microsoftEmergingThreatFeed.lookbackPeriod" options="lookback-period" required="True"> <help short="lookback period"/> </arg> <arg type="string" var="$dataConnector.MicrosoftThreatIntelligence.properties.dataTypes.microsoftEmergingThreatFeed.state" options="state" required="True"> <help short="Describe whether this data type connection is enabled or not."/> <enum> <item name="Disabled" value=""Disabled""/> <item name="Enabled" value=""Enabled""/> </enum> </arg> </arg> </arg> <arg type="string" var="$dataConnector.MicrosoftThreatIntelligence.properties.tenantId" options="tenant-id" group="Properties"> <help short="The tenant id to connect to, and get the data from."/> </arg> </arg> <arg type="object" var="$dataConnector.MicrosoftThreatProtection" options="microsoft-protection" group="DataConnector"> <help short="Microsoft threat protection."/> <arg type="object" var="$dataConnector.MicrosoftThreatProtection.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for the connector."/> <arg type="object" var="$dataConnector.MicrosoftThreatProtection.properties.dataTypes.incidents" options="incidents" required="True"> <help short="Data type for Microsoft Threat Protection Platforms data connector."/> <arg type="string" var="$dataConnector.MicrosoftThreatProtection.properties.dataTypes.incidents.state" options="state" required="True"> <help short="Describe whether this data type connection is enabled or not."/> <enum> <item name="Disabled" value=""Disabled""/> <item name="Enabled" value=""Enabled""/> </enum> </arg> </arg> </arg> <arg type="string" var="$dataConnector.MicrosoftThreatProtection.properties.tenantId" options="tenant-id" group="Properties"> <help short="The tenant id to connect to, and get the data from."/> </arg> </arg> <arg type="object" var="$dataConnector.Office365" options="office365" group="DataConnector"> <arg type="object" var="$dataConnector.Office365.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for the connector."/> <arg type="object" var="$dataConnector.Office365.properties.dataTypes.exchange" options="exchange" required="True"> <help short="Exchange data type connection."/> <arg type="string" var="$dataConnector.Office365.properties.dataTypes.exchange.state" options="state" required="True"> <help short="Describe whether this data type connection is enabled or not."/> <enum> <item name="Disabled" value=""Disabled""/> <item name="Enabled" value=""Enabled""/> </enum> </arg> </arg> <arg type="object" var="$dataConnector.Office365.properties.dataTypes.sharePoint" options="share-point" required="True"> <help short="SharePoint data type connection."/> <arg type="string" var="$dataConnector.Office365.properties.dataTypes.sharePoint.state" options="state" required="True"> <help short="Describe whether this data type connection is enabled or not."/> <enum> <item name="Disabled" value=""Disabled""/> <item name="Enabled" value=""Enabled""/> </enum> </arg> </arg> <arg type="object" var="$dataConnector.Office365.properties.dataTypes.teams" options="teams" required="True"> <help short="Teams data type connection."/> <arg type="string" var="$dataConnector.Office365.properties.dataTypes.teams.state" options="state" required="True"> <help short="Describe whether this data type connection is enabled or not."/> <enum> <item name="Disabled" value=""Disabled""/> <item name="Enabled" value=""Enabled""/> </enum> </arg> </arg> </arg> <arg type="string" var="$dataConnector.Office365.properties.tenantId" options="tenant-id" group="Properties"> <help short="The tenant id to connect to, and get the data from."/> </arg> </arg> <arg type="object" var="$dataConnector.Office365Project" options="office365-project" group="DataConnector"> <arg type="object" var="$dataConnector.Office365Project.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for the connector."/> <arg type="object" var="$dataConnector.Office365Project.properties.dataTypes.logs" options="logs" required="True"> <help short="Logs data type."/> <arg type="string" var="$dataConnector.Office365Project.properties.dataTypes.logs.state" options="state" required="True"> <help short="Describe whether this data type connection is enabled or not."/> <enum> <item name="Disabled" value=""Disabled""/> <item name="Enabled" value=""Enabled""/> </enum> </arg> </arg> </arg> <arg type="string" var="$dataConnector.Office365Project.properties.tenantId" options="tenant-id" group="Properties"> <help short="The tenant id to connect to, and get the data from."/> </arg> </arg> <arg type="object" var="$dataConnector.OfficeATP" options="office-atp" group="DataConnector"> <arg type="@AlertsDataTypeOfDataConnector_create" var="$dataConnector.OfficeATP.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for the connector."/> </arg> <arg type="string" var="$dataConnector.OfficeATP.properties.tenantId" options="tenant-id" group="Properties"> <help short="The tenant id to connect to, and get the data from."/> </arg> </arg> <arg type="object" var="$dataConnector.OfficeIRM" options="office-irm" group="DataConnector"> <arg type="@AlertsDataTypeOfDataConnector_create" var="$dataConnector.OfficeIRM.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for the connector."/> </arg> <arg type="string" var="$dataConnector.OfficeIRM.properties.tenantId" options="tenant-id" group="Properties"> <help short="The tenant id to connect to, and get the data from."/> </arg> </arg> <arg type="object" var="$dataConnector.OfficePowerBI" options="office-power-bi" group="DataConnector"> <arg type="object" var="$dataConnector.OfficePowerBI.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for the connector."/> <arg type="object" var="$dataConnector.OfficePowerBI.properties.dataTypes.logs" options="logs" required="True"> <help short="Logs data type."/> <arg type="string" var="$dataConnector.OfficePowerBI.properties.dataTypes.logs.state" options="state" required="True"> <help short="Describe whether this data type connection is enabled or not."/> <enum> <item name="Disabled" value=""Disabled""/> <item name="Enabled" value=""Enabled""/> </enum> </arg> </arg> </arg> <arg type="string" var="$dataConnector.OfficePowerBI.properties.tenantId" options="tenant-id" group="Properties"> <help short="The tenant id to connect to, and get the data from."/> </arg> </arg> <arg type="object" var="$dataConnector.ThreatIntelligence" options="threat-intelligence" group="DataConnector"> <arg type="object" var="$dataConnector.ThreatIntelligence.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for the connector."/> <arg type="object" var="$dataConnector.ThreatIntelligence.properties.dataTypes.indicators" options="indicators" required="True"> <help short="Data type for indicators connection."/> <arg type="string" var="$dataConnector.ThreatIntelligence.properties.dataTypes.indicators.state" options="state" required="True"> <help short="Describe whether this data type connection is enabled or not."/> <enum> <item name="Disabled" value=""Disabled""/> <item name="Enabled" value=""Enabled""/> </enum> </arg> </arg> </arg> <arg type="string" var="$dataConnector.ThreatIntelligence.properties.tenantId" options="tenant-id" group="Properties"> <help short="The tenant id to connect to, and get the data from."/> </arg> <arg nullable="True" type="dateTime" var="$dataConnector.ThreatIntelligence.properties.tipLookbackPeriod" options="tip-lookback-period" group="Properties"> <help short="The lookback period for the feed to be imported."/> </arg> </arg> <arg type="object" var="$dataConnector.ThreatIntelligenceTaxii" options="intelligence-taxii" group="DataConnector"> <help short="Threat intelligence taxii."/> <arg type="string" var="$dataConnector.ThreatIntelligenceTaxii.properties.collectionId" options="collection-id" group="Properties"> <help short="The collection id of the TAXII server."/> </arg> <arg type="object" var="$dataConnector.ThreatIntelligenceTaxii.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for Threat Intelligence TAXII data connector."/> <arg type="object" var="$dataConnector.ThreatIntelligenceTaxii.properties.dataTypes.taxiiClient" options="taxii-client" required="True"> <help short="Data type for TAXII connector."/> <arg type="string" var="$dataConnector.ThreatIntelligenceTaxii.properties.dataTypes.taxiiClient.state" options="state" required="True"> <help short="Describe whether this data type connection is enabled or not."/> <enum> <item name="Disabled" value=""Disabled""/> <item name="Enabled" value=""Enabled""/> </enum> </arg> </arg> </arg> <arg type="string" var="$dataConnector.ThreatIntelligenceTaxii.properties.friendlyName" options="friendly-name" group="Properties"> <help short="The friendly name for the TAXII server."/> </arg> <arg type="string" var="$dataConnector.ThreatIntelligenceTaxii.properties.password" options="password" group="Properties"> <help short="The password for the TAXII server."/> </arg> <arg nullable="True" type="string" var="$dataConnector.ThreatIntelligenceTaxii.properties.pollingFrequency" options="polling-frequency" group="Properties"> <help short="The polling frequency for the TAXII server."/> <enum> <item name="OnceADay" value=""OnceADay""/> <item name="OnceAMinute" value=""OnceAMinute""/> <item name="OnceAnHour" value=""OnceAnHour""/> </enum> </arg> <arg nullable="True" type="dateTime" var="$dataConnector.ThreatIntelligenceTaxii.properties.taxiiLookbackPeriod" options="taxii-lookback-period" group="Properties"> <help short="The lookback period for the TAXII server."/> </arg> <arg type="string" var="$dataConnector.ThreatIntelligenceTaxii.properties.taxiiServer" options="taxii-server" group="Properties"> <help short="The API root for the TAXII server."/> </arg> <arg type="string" var="$dataConnector.ThreatIntelligenceTaxii.properties.tenantId" options="tenant-id" group="Properties"> <help short="The tenant id to connect to, and get the data from."/> </arg> <arg type="string" var="$dataConnector.ThreatIntelligenceTaxii.properties.userName" options="user-name" group="Properties"> <help short="The userName for the TAXII server."/> </arg> <arg type="string" var="$dataConnector.ThreatIntelligenceTaxii.properties.workspaceId" options="workspace-id" group="Properties"> <help short="The workspace id."/> </arg> </arg> <arg type="string" var="$dataConnector.etag" options="etag" group="DataConnector"> <help short="Etag of the azure resource"/> </arg> </argGroup> <operation operationId="DataConnectors_CreateOrUpdate"> <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors/{dataConnectorId}"> <request method="put"> <path> <param type="string" name="dataConnectorId" arg="$Path.dataConnectorId" required="True"/> <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True"> <format maxLength="90" minLength="1"/> </param> <param type="string" name="subscriptionId" arg="$Path.subscriptionId" required="True"> <format minLength="1"/> </param> <param type="string" name="workspaceName" arg="$Path.workspaceName" required="True"> <format maxLength="90" minLength="1"/> </param> </path> <query> <const readOnly="True" const="True" type="string" name="api-version" required="True"> <default value=""2022-06-01-preview""/> <format minLength="1"/> </const> </query> <body> <json> <schema type="object" name="dataConnector" required="True" clientFlatten="True"> <prop type="string" name="etag" arg="$dataConnector.etag"/> <prop type="string" name="kind" required="True"> <enum> <item arg="$dataConnector.APIPolling" value=""APIPolling""/> <item arg="$dataConnector.AmazonWebServicesCloudTrail" value=""AmazonWebServicesCloudTrail""/> <item arg="$dataConnector.AmazonWebServicesS3" value=""AmazonWebServicesS3""/> <item arg="$dataConnector.AzureActiveDirectory" value=""AzureActiveDirectory""/> <item arg="$dataConnector.AzureAdvancedThreatProtection" value=""AzureAdvancedThreatProtection""/> <item arg="$dataConnector.AzureSecurityCenter" value=""AzureSecurityCenter""/> <item arg="$dataConnector.Dynamics365" value=""Dynamics365""/> <item arg="$dataConnector.GenericUI" value=""GenericUI""/> <item arg="$dataConnector.IOT" value=""IOT""/> <item arg="$dataConnector.MicrosoftCloudAppSecurity" value=""MicrosoftCloudAppSecurity""/> <item arg="$dataConnector.MicrosoftDefenderAdvancedThreatProtection" value=""MicrosoftDefenderAdvancedThreatProtection""/> <item arg="$dataConnector.MicrosoftThreatIntelligence" value=""MicrosoftThreatIntelligence""/> <item arg="$dataConnector.MicrosoftThreatProtection" value=""MicrosoftThreatProtection""/> <item arg="$dataConnector.Office365" value=""Office365""/> <item arg="$dataConnector.Office365Project" value=""Office365Project""/> <item arg="$dataConnector.OfficeATP" value=""OfficeATP""/> <item arg="$dataConnector.OfficeIRM" value=""OfficeIRM""/> <item arg="$dataConnector.OfficePowerBI" value=""OfficePowerBI""/> <item arg="$dataConnector.ThreatIntelligence" value=""ThreatIntelligence""/> <item arg="$dataConnector.ThreatIntelligenceTaxii" value=""ThreatIntelligenceTaxii""/> </enum> </prop> <discriminator property="kind" value="APIPolling"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@CodelessUiConnectorConfigProperties_create" name="connectorUiConfig" arg="$dataConnector.APIPolling.properties.connectorUiConfig"/> <prop type="object" name="pollingConfig" arg="$dataConnector.APIPolling.properties.pollingConfig"> <prop type="object" name="auth" arg="$dataConnector.APIPolling.properties.pollingConfig.auth" required="True"> <prop type="string" name="apiKeyIdentifier" arg="$dataConnector.APIPolling.properties.pollingConfig.auth.apiKeyIdentifier"/> <prop type="string" name="apiKeyName" arg="$dataConnector.APIPolling.properties.pollingConfig.auth.apiKeyName"/> <prop type="string" name="authType" arg="$dataConnector.APIPolling.properties.pollingConfig.auth.authType" required="True"/> <prop type="string" name="authorizationEndpoint" arg="$dataConnector.APIPolling.properties.pollingConfig.auth.authorizationEndpoint"/> <prop type="string" name="flowName" arg="$dataConnector.APIPolling.properties.pollingConfig.auth.flowName"/> <prop type="string" name="isApiKeyInPostPayload" arg="$dataConnector.APIPolling.properties.pollingConfig.auth.isApiKeyInPostPayload"/> <prop type="boolean" name="isClientSecretInHeader" arg="$dataConnector.APIPolling.properties.pollingConfig.auth.isClientSecretInHeader"/> <prop type="string" name="redirectionEndpoint" arg="$dataConnector.APIPolling.properties.pollingConfig.auth.redirectionEndpoint"/> <prop type="string" name="scope" arg="$dataConnector.APIPolling.properties.pollingConfig.auth.scope"/> <prop type="string" name="tokenEndpoint" arg="$dataConnector.APIPolling.properties.pollingConfig.auth.tokenEndpoint"/> </prop> <prop type="boolean" name="isActive" arg="$dataConnector.APIPolling.properties.pollingConfig.isActive"/> <prop type="object" name="paging" arg="$dataConnector.APIPolling.properties.pollingConfig.paging"> <prop type="string" name="nextPageParaName" arg="$dataConnector.APIPolling.properties.pollingConfig.paging.nextPageParaName"/> <prop type="string" name="nextPageTokenJsonPath" arg="$dataConnector.APIPolling.properties.pollingConfig.paging.nextPageTokenJsonPath"/> <prop type="string" name="pageCountAttributePath" arg="$dataConnector.APIPolling.properties.pollingConfig.paging.pageCountAttributePath"/> <prop type="integer32" name="pageSize" arg="$dataConnector.APIPolling.properties.pollingConfig.paging.pageSize"/> <prop type="string" name="pageSizeParaName" arg="$dataConnector.APIPolling.properties.pollingConfig.paging.pageSizeParaName"/> <prop type="string" name="pageTimeStampAttributePath" arg="$dataConnector.APIPolling.properties.pollingConfig.paging.pageTimeStampAttributePath"/> <prop type="string" name="pageTotalCountAttributePath" arg="$dataConnector.APIPolling.properties.pollingConfig.paging.pageTotalCountAttributePath"/> <prop type="string" name="pagingType" arg="$dataConnector.APIPolling.properties.pollingConfig.paging.pagingType" required="True"/> <prop type="string" name="searchTheLatestTimeStampFromEventsList" arg="$dataConnector.APIPolling.properties.pollingConfig.paging.searchTheLatestTimeStampFromEventsList"/> </prop> <prop type="object" name="request" arg="$dataConnector.APIPolling.properties.pollingConfig.request" required="True"> <prop type="string" name="apiEndpoint" arg="$dataConnector.APIPolling.properties.pollingConfig.request.apiEndpoint" required="True"/> <prop type="string" name="endTimeAttributeName" arg="$dataConnector.APIPolling.properties.pollingConfig.request.endTimeAttributeName"/> <prop type="string" name="httpMethod" arg="$dataConnector.APIPolling.properties.pollingConfig.request.httpMethod" required="True"/> <prop type="string" name="queryParametersTemplate" arg="$dataConnector.APIPolling.properties.pollingConfig.request.queryParametersTemplate"/> <prop type="string" name="queryTimeFormat" arg="$dataConnector.APIPolling.properties.pollingConfig.request.queryTimeFormat" required="True"/> <prop type="integer32" name="queryWindowInMin" arg="$dataConnector.APIPolling.properties.pollingConfig.request.queryWindowInMin" required="True"/> <prop type="integer32" name="rateLimitQps" arg="$dataConnector.APIPolling.properties.pollingConfig.request.rateLimitQps"/> <prop type="integer32" name="retryCount" arg="$dataConnector.APIPolling.properties.pollingConfig.request.retryCount"/> <prop type="string" name="startTimeAttributeName" arg="$dataConnector.APIPolling.properties.pollingConfig.request.startTimeAttributeName"/> <prop type="integer32" name="timeoutInSeconds" arg="$dataConnector.APIPolling.properties.pollingConfig.request.timeoutInSeconds"/> </prop> <prop type="object" name="response" arg="$dataConnector.APIPolling.properties.pollingConfig.response"> <prop type="array<string>" name="eventsJsonPaths" arg="$dataConnector.APIPolling.properties.pollingConfig.response.eventsJsonPaths" required="True"> <item type="string"/> </prop> <prop type="boolean" name="isGzipCompressed" arg="$dataConnector.APIPolling.properties.pollingConfig.response.isGzipCompressed"/> <prop type="string" name="successStatusJsonPath" arg="$dataConnector.APIPolling.properties.pollingConfig.response.successStatusJsonPath"/> <prop type="string" name="successStatusValue" arg="$dataConnector.APIPolling.properties.pollingConfig.response.successStatusValue"/> </prop> </prop> </prop> </discriminator> <discriminator property="kind" value="AmazonWebServicesCloudTrail"> <prop type="object" name="properties" clientFlatten="True"> <prop type="string" name="awsRoleArn" arg="$dataConnector.AmazonWebServicesCloudTrail.properties.awsRoleArn"/> <prop type="object" name="dataTypes" arg="$dataConnector.AmazonWebServicesCloudTrail.properties.dataTypes" required="True"> <prop type="object" name="logs" arg="$dataConnector.AmazonWebServicesCloudTrail.properties.dataTypes.logs" required="True"> <prop type="string" name="state" arg="$dataConnector.AmazonWebServicesCloudTrail.properties.dataTypes.logs.state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> </prop> </discriminator> <discriminator property="kind" value="AmazonWebServicesS3"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" arg="$dataConnector.AmazonWebServicesS3.properties.dataTypes" required="True"> <prop type="object" name="logs" arg="$dataConnector.AmazonWebServicesS3.properties.dataTypes.logs" required="True"> <prop type="string" name="state" arg="$dataConnector.AmazonWebServicesS3.properties.dataTypes.logs.state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="destinationTable" arg="$dataConnector.AmazonWebServicesS3.properties.destinationTable" required="True"/> <prop type="string" name="roleArn" arg="$dataConnector.AmazonWebServicesS3.properties.roleArn" required="True"/> <prop type="array<string>" name="sqsUrls" arg="$dataConnector.AmazonWebServicesS3.properties.sqsUrls" required="True"> <item type="string"/> </prop> </prop> </discriminator> <discriminator property="kind" value="AzureActiveDirectory"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" arg="$dataConnector.AzureActiveDirectory.properties.dataTypes" cls="AlertsDataTypeOfDataConnector_create"> <prop type="object" name="alerts" arg="@AlertsDataTypeOfDataConnector_create.alerts" required="True" cls="DataConnectorDataTypeCommon_create"> <prop type="string" name="state" arg="@DataConnectorDataTypeCommon_create.state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" arg="$dataConnector.AzureActiveDirectory.properties.tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="AzureAdvancedThreatProtection"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@AlertsDataTypeOfDataConnector_create" name="dataTypes" arg="$dataConnector.AzureAdvancedThreatProtection.properties.dataTypes"/> <prop type="string" name="tenantId" arg="$dataConnector.AzureAdvancedThreatProtection.properties.tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="AzureSecurityCenter"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@AlertsDataTypeOfDataConnector_create" name="dataTypes" arg="$dataConnector.AzureSecurityCenter.properties.dataTypes"/> <prop type="string" name="subscriptionId" arg="$dataConnector.AzureSecurityCenter.properties.subscriptionId"/> </prop> </discriminator> <discriminator property="kind" value="Dynamics365"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" arg="$dataConnector.Dynamics365.properties.dataTypes" required="True"> <prop type="object" name="dynamics365CdsActivities" arg="$dataConnector.Dynamics365.properties.dataTypes.dynamics365CdsActivities" required="True"> <prop type="string" name="state" arg="$dataConnector.Dynamics365.properties.dataTypes.dynamics365CdsActivities.state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" arg="$dataConnector.Dynamics365.properties.tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="GenericUI"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="connectorUiConfig" arg="$dataConnector.GenericUI.properties.connectorUiConfig" cls="CodelessUiConnectorConfigProperties_create"> <prop type="object" name="availability" arg="@CodelessUiConnectorConfigProperties_create.availability" required="True"> <prop type="boolean" name="isPreview" arg="@CodelessUiConnectorConfigProperties_create.availability.isPreview"/> <prop type="integer32" name="status" arg="@CodelessUiConnectorConfigProperties_create.availability.status"> <enum> <item value="1"/> </enum> </prop> </prop> <prop type="array<object>" name="connectivityCriteria" arg="@CodelessUiConnectorConfigProperties_create.connectivityCriteria" required="True"> <item type="object"> <prop type="string" name="type" arg="@CodelessUiConnectorConfigProperties_create.connectivityCriteria[].type"> <enum> <item value=""IsConnectedQuery""/> </enum> </prop> <prop type="array<string>" name="value" arg="@CodelessUiConnectorConfigProperties_create.connectivityCriteria[].value"> <item type="string"/> </prop> </item> </prop> <prop type="string" name="customImage" arg="@CodelessUiConnectorConfigProperties_create.customImage"/> <prop type="array<object>" name="dataTypes" arg="@CodelessUiConnectorConfigProperties_create.dataTypes" required="True"> <item type="object"> <prop type="string" name="lastDataReceivedQuery" arg="@CodelessUiConnectorConfigProperties_create.dataTypes[].lastDataReceivedQuery"/> <prop type="string" name="name" arg="@CodelessUiConnectorConfigProperties_create.dataTypes[].name"/> </item> </prop> <prop type="string" name="descriptionMarkdown" arg="@CodelessUiConnectorConfigProperties_create.descriptionMarkdown" required="True"/> <prop type="array<object>" name="graphQueries" arg="@CodelessUiConnectorConfigProperties_create.graphQueries" required="True"> <item type="object"> <prop type="string" name="baseQuery" arg="@CodelessUiConnectorConfigProperties_create.graphQueries[].baseQuery"/> <prop type="string" name="legend" arg="@CodelessUiConnectorConfigProperties_create.graphQueries[].legend"/> <prop type="string" name="metricName" arg="@CodelessUiConnectorConfigProperties_create.graphQueries[].metricName"/> </item> </prop> <prop type="string" name="graphQueriesTableName" arg="@CodelessUiConnectorConfigProperties_create.graphQueriesTableName" required="True"/> <prop type="array<object>" name="instructionSteps" arg="@CodelessUiConnectorConfigProperties_create.instructionSteps" required="True"> <item type="object"> <prop type="string" name="description" arg="@CodelessUiConnectorConfigProperties_create.instructionSteps[].description"/> <prop type="array<object>" name="instructions" arg="@CodelessUiConnectorConfigProperties_create.instructionSteps[].instructions"> <item type="object"> <prop type="string" name="type" arg="@CodelessUiConnectorConfigProperties_create.instructionSteps[].instructions[].type" required="True"> <enum> <item value=""CopyableLabel""/> <item value=""InfoMessage""/> <item value=""InstructionStepsGroup""/> </enum> </prop> </item> </prop> <prop type="string" name="title" arg="@CodelessUiConnectorConfigProperties_create.instructionSteps[].title"/> </item> </prop> <prop type="object" name="permissions" arg="@CodelessUiConnectorConfigProperties_create.permissions" required="True"> <prop type="array<object>" name="customs" arg="@CodelessUiConnectorConfigProperties_create.permissions.customs"> <item type="object"> <prop type="string" name="description" arg="@CodelessUiConnectorConfigProperties_create.permissions.customs[].description"/> <prop type="string" name="name" arg="@CodelessUiConnectorConfigProperties_create.permissions.customs[].name"/> </item> </prop> <prop type="array<object>" name="resourceProvider" arg="@CodelessUiConnectorConfigProperties_create.permissions.resourceProvider"> <item type="object"> <prop type="string" name="permissionsDisplayText" arg="@CodelessUiConnectorConfigProperties_create.permissions.resourceProvider[].permissionsDisplayText"/> <prop type="string" name="provider" arg="@CodelessUiConnectorConfigProperties_create.permissions.resourceProvider[].provider"> <enum> <item value=""Microsoft.Authorization/policyAssignments""/> <item value=""Microsoft.OperationalInsights/solutions""/> <item value=""Microsoft.OperationalInsights/workspaces""/> <item value=""Microsoft.OperationalInsights/workspaces/datasources""/> <item value=""Microsoft.OperationalInsights/workspaces/sharedKeys""/> <item value=""microsoft.aadiam/diagnosticSettings""/> </enum> </prop> <prop type="string" name="providerDisplayName" arg="@CodelessUiConnectorConfigProperties_create.permissions.resourceProvider[].providerDisplayName"/> <prop type="object" name="requiredPermissions" arg="@CodelessUiConnectorConfigProperties_create.permissions.resourceProvider[].requiredPermissions"> <prop type="boolean" name="action" arg="@CodelessUiConnectorConfigProperties_create.permissions.resourceProvider[].requiredPermissions.action"/> <prop type="boolean" name="delete" arg="@CodelessUiConnectorConfigProperties_create.permissions.resourceProvider[].requiredPermissions.delete"/> <prop type="boolean" name="read" arg="@CodelessUiConnectorConfigProperties_create.permissions.resourceProvider[].requiredPermissions.read"/> <prop type="boolean" name="write" arg="@CodelessUiConnectorConfigProperties_create.permissions.resourceProvider[].requiredPermissions.write"/> </prop> <prop type="string" name="scope" arg="@CodelessUiConnectorConfigProperties_create.permissions.resourceProvider[].scope"> <enum> <item value=""ResourceGroup""/> <item value=""Subscription""/> <item value=""Workspace""/> </enum> </prop> </item> </prop> </prop> <prop type="string" name="publisher" arg="@CodelessUiConnectorConfigProperties_create.publisher" required="True"/> <prop type="array<object>" name="sampleQueries" arg="@CodelessUiConnectorConfigProperties_create.sampleQueries" required="True"> <item type="object"> <prop type="string" name="description" arg="@CodelessUiConnectorConfigProperties_create.sampleQueries[].description"/> <prop type="string" name="query" arg="@CodelessUiConnectorConfigProperties_create.sampleQueries[].query"/> </item> </prop> <prop type="string" name="title" arg="@CodelessUiConnectorConfigProperties_create.title" required="True"/> </prop> </prop> </discriminator> <discriminator property="kind" value="IOT"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@AlertsDataTypeOfDataConnector_create" name="dataTypes" arg="$dataConnector.IOT.properties.dataTypes"/> <prop type="string" name="subscriptionId" arg="$dataConnector.IOT.properties.subscriptionId"/> </prop> </discriminator> <discriminator property="kind" value="MicrosoftCloudAppSecurity"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" arg="$dataConnector.MicrosoftCloudAppSecurity.properties.dataTypes" required="True"> <prop type="@DataConnectorDataTypeCommon_create" name="alerts" arg="$dataConnector.MicrosoftCloudAppSecurity.properties.dataTypes.alerts" required="True"/> <prop type="@DataConnectorDataTypeCommon_create" name="discoveryLogs" arg="$dataConnector.MicrosoftCloudAppSecurity.properties.dataTypes.discoveryLogs"/> </prop> <prop type="string" name="tenantId" arg="$dataConnector.MicrosoftCloudAppSecurity.properties.tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="MicrosoftDefenderAdvancedThreatProtection"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@AlertsDataTypeOfDataConnector_create" name="dataTypes" arg="$dataConnector.MicrosoftDefenderAdvancedThreatProtection.properties.dataTypes"/> <prop type="string" name="tenantId" arg="$dataConnector.MicrosoftDefenderAdvancedThreatProtection.properties.tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="MicrosoftThreatIntelligence"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" arg="$dataConnector.MicrosoftThreatIntelligence.properties.dataTypes" required="True"> <prop type="object" name="bingSafetyPhishingURL" arg="$dataConnector.MicrosoftThreatIntelligence.properties.dataTypes.bingSafetyPhishingURL" required="True"> <prop type="string" name="lookbackPeriod" arg="$dataConnector.MicrosoftThreatIntelligence.properties.dataTypes.bingSafetyPhishingURL.lookbackPeriod" required="True"/> <prop type="string" name="state" arg="$dataConnector.MicrosoftThreatIntelligence.properties.dataTypes.bingSafetyPhishingURL.state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> <prop type="object" name="microsoftEmergingThreatFeed" arg="$dataConnector.MicrosoftThreatIntelligence.properties.dataTypes.microsoftEmergingThreatFeed" required="True"> <prop type="string" name="lookbackPeriod" arg="$dataConnector.MicrosoftThreatIntelligence.properties.dataTypes.microsoftEmergingThreatFeed.lookbackPeriod" required="True"/> <prop type="string" name="state" arg="$dataConnector.MicrosoftThreatIntelligence.properties.dataTypes.microsoftEmergingThreatFeed.state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" arg="$dataConnector.MicrosoftThreatIntelligence.properties.tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="MicrosoftThreatProtection"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" arg="$dataConnector.MicrosoftThreatProtection.properties.dataTypes" required="True"> <prop type="object" name="incidents" arg="$dataConnector.MicrosoftThreatProtection.properties.dataTypes.incidents" required="True"> <prop type="string" name="state" arg="$dataConnector.MicrosoftThreatProtection.properties.dataTypes.incidents.state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" arg="$dataConnector.MicrosoftThreatProtection.properties.tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="Office365"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" arg="$dataConnector.Office365.properties.dataTypes" required="True"> <prop type="object" name="exchange" arg="$dataConnector.Office365.properties.dataTypes.exchange" required="True"> <prop type="string" name="state" arg="$dataConnector.Office365.properties.dataTypes.exchange.state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> <prop type="object" name="sharePoint" arg="$dataConnector.Office365.properties.dataTypes.sharePoint" required="True"> <prop type="string" name="state" arg="$dataConnector.Office365.properties.dataTypes.sharePoint.state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> <prop type="object" name="teams" arg="$dataConnector.Office365.properties.dataTypes.teams" required="True"> <prop type="string" name="state" arg="$dataConnector.Office365.properties.dataTypes.teams.state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" arg="$dataConnector.Office365.properties.tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="Office365Project"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" arg="$dataConnector.Office365Project.properties.dataTypes" required="True"> <prop type="object" name="logs" arg="$dataConnector.Office365Project.properties.dataTypes.logs" required="True"> <prop type="string" name="state" arg="$dataConnector.Office365Project.properties.dataTypes.logs.state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" arg="$dataConnector.Office365Project.properties.tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="OfficeATP"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@AlertsDataTypeOfDataConnector_create" name="dataTypes" arg="$dataConnector.OfficeATP.properties.dataTypes"/> <prop type="string" name="tenantId" arg="$dataConnector.OfficeATP.properties.tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="OfficeIRM"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@AlertsDataTypeOfDataConnector_create" name="dataTypes" arg="$dataConnector.OfficeIRM.properties.dataTypes"/> <prop type="string" name="tenantId" arg="$dataConnector.OfficeIRM.properties.tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="OfficePowerBI"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" arg="$dataConnector.OfficePowerBI.properties.dataTypes" required="True"> <prop type="object" name="logs" arg="$dataConnector.OfficePowerBI.properties.dataTypes.logs" required="True"> <prop type="string" name="state" arg="$dataConnector.OfficePowerBI.properties.dataTypes.logs.state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" arg="$dataConnector.OfficePowerBI.properties.tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="ThreatIntelligence"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" arg="$dataConnector.ThreatIntelligence.properties.dataTypes" required="True"> <prop type="object" name="indicators" arg="$dataConnector.ThreatIntelligence.properties.dataTypes.indicators" required="True"> <prop type="string" name="state" arg="$dataConnector.ThreatIntelligence.properties.dataTypes.indicators.state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" arg="$dataConnector.ThreatIntelligence.properties.tenantId" required="True"/> <prop nullable="True" type="dateTime" name="tipLookbackPeriod" arg="$dataConnector.ThreatIntelligence.properties.tipLookbackPeriod"/> </prop> </discriminator> <discriminator property="kind" value="ThreatIntelligenceTaxii"> <prop type="object" name="properties" clientFlatten="True"> <prop type="string" name="collectionId" arg="$dataConnector.ThreatIntelligenceTaxii.properties.collectionId"/> <prop type="object" name="dataTypes" arg="$dataConnector.ThreatIntelligenceTaxii.properties.dataTypes" required="True"> <prop type="object" name="taxiiClient" arg="$dataConnector.ThreatIntelligenceTaxii.properties.dataTypes.taxiiClient" required="True"> <prop type="string" name="state" arg="$dataConnector.ThreatIntelligenceTaxii.properties.dataTypes.taxiiClient.state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="friendlyName" arg="$dataConnector.ThreatIntelligenceTaxii.properties.friendlyName"/> <prop type="string" name="password" arg="$dataConnector.ThreatIntelligenceTaxii.properties.password"/> <prop nullable="True" type="string" name="pollingFrequency" arg="$dataConnector.ThreatIntelligenceTaxii.properties.pollingFrequency" required="True"> <enum> <item value=""OnceADay""/> <item value=""OnceAMinute""/> <item value=""OnceAnHour""/> </enum> </prop> <prop nullable="True" type="dateTime" name="taxiiLookbackPeriod" arg="$dataConnector.ThreatIntelligenceTaxii.properties.taxiiLookbackPeriod"/> <prop type="string" name="taxiiServer" arg="$dataConnector.ThreatIntelligenceTaxii.properties.taxiiServer"/> <prop type="string" name="tenantId" arg="$dataConnector.ThreatIntelligenceTaxii.properties.tenantId" required="True"/> <prop type="string" name="userName" arg="$dataConnector.ThreatIntelligenceTaxii.properties.userName"/> <prop type="string" name="workspaceId" arg="$dataConnector.ThreatIntelligenceTaxii.properties.workspaceId"/> </prop> </discriminator> </schema> </json> </body> </request> <response statusCode="200 201"> <body> <json var="$Instance"> <schema type="object"> <prop type="string" name="etag"/> <prop readOnly="True" type="ResourceId" name="id"> <format template="/subscriptions/{}/resourceGroups/{}/providers/Microsoft.OperationalInsights/workspaces/{}/providers/Microsoft.SecurityInsights/dataConnectors/{}"/> </prop> <prop type="string" name="kind" required="True"> <enum> <item value=""APIPolling""/> <item value=""AmazonWebServicesCloudTrail""/> <item value=""AmazonWebServicesS3""/> <item value=""AzureActiveDirectory""/> <item value=""AzureAdvancedThreatProtection""/> <item value=""AzureSecurityCenter""/> <item value=""Dynamics365""/> <item value=""GenericUI""/> <item value=""IOT""/> <item value=""MicrosoftCloudAppSecurity""/> <item value=""MicrosoftDefenderAdvancedThreatProtection""/> <item value=""MicrosoftThreatIntelligence""/> <item value=""MicrosoftThreatProtection""/> <item value=""Office365""/> <item value=""Office365Project""/> <item value=""OfficeATP""/> <item value=""OfficeIRM""/> <item value=""OfficePowerBI""/> <item value=""ThreatIntelligence""/> <item value=""ThreatIntelligenceTaxii""/> </enum> </prop> <prop readOnly="True" type="string" name="name"/> <prop readOnly="True" type="object" name="systemData"> <prop readOnly="True" type="dateTime" name="createdAt"/> <prop readOnly="True" type="string" name="createdBy"/> <prop readOnly="True" type="string" name="createdByType"> <enum> <item value=""Application""/> <item value=""Key""/> <item value=""ManagedIdentity""/> <item value=""User""/> </enum> </prop> <prop readOnly="True" type="dateTime" name="lastModifiedAt"/> <prop readOnly="True" type="string" name="lastModifiedBy"/> <prop readOnly="True" type="string" name="lastModifiedByType"> <enum> <item value=""Application""/> <item value=""Key""/> <item value=""ManagedIdentity""/> <item value=""User""/> </enum> </prop> </prop> <prop readOnly="True" type="string" name="type"/> <discriminator property="kind" value="APIPolling"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@CodelessUiConnectorConfigProperties_read" name="connectorUiConfig"/> <prop type="object" name="pollingConfig"> <prop type="object" name="auth" required="True"> <prop type="string" name="apiKeyIdentifier"/> <prop type="string" name="apiKeyName"/> <prop type="string" name="authType" required="True"/> <prop type="string" name="authorizationEndpoint"/> <prop type="string" name="flowName"/> <prop type="string" name="isApiKeyInPostPayload"/> <prop type="boolean" name="isClientSecretInHeader"/> <prop type="string" name="redirectionEndpoint"/> <prop type="string" name="scope"/> <prop type="string" name="tokenEndpoint"/> </prop> <prop type="boolean" name="isActive"/> <prop type="object" name="paging"> <prop type="string" name="nextPageParaName"/> <prop type="string" name="nextPageTokenJsonPath"/> <prop type="string" name="pageCountAttributePath"/> <prop type="integer32" name="pageSize"/> <prop type="string" name="pageSizeParaName"/> <prop type="string" name="pageTimeStampAttributePath"/> <prop type="string" name="pageTotalCountAttributePath"/> <prop type="string" name="pagingType" required="True"/> <prop type="string" name="searchTheLatestTimeStampFromEventsList"/> </prop> <prop type="object" name="request" required="True"> <prop type="string" name="apiEndpoint" required="True"/> <prop type="string" name="endTimeAttributeName"/> <prop type="string" name="httpMethod" required="True"/> <prop type="string" name="queryParametersTemplate"/> <prop type="string" name="queryTimeFormat" required="True"/> <prop type="integer32" name="queryWindowInMin" required="True"/> <prop type="integer32" name="rateLimitQps"/> <prop type="integer32" name="retryCount"/> <prop type="string" name="startTimeAttributeName"/> <prop type="integer32" name="timeoutInSeconds"/> </prop> <prop type="object" name="response"> <prop type="array<string>" name="eventsJsonPaths" required="True"> <item type="string"/> </prop> <prop type="boolean" name="isGzipCompressed"/> <prop type="string" name="successStatusJsonPath"/> <prop type="string" name="successStatusValue"/> </prop> </prop> </prop> </discriminator> <discriminator property="kind" value="AmazonWebServicesCloudTrail"> <prop type="object" name="properties" clientFlatten="True"> <prop type="string" name="awsRoleArn"/> <prop type="object" name="dataTypes" required="True"> <prop type="object" name="logs" required="True"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> </prop> </discriminator> <discriminator property="kind" value="AmazonWebServicesS3"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" required="True"> <prop type="object" name="logs" required="True"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="destinationTable" required="True"/> <prop type="string" name="roleArn" required="True"/> <prop type="array<string>" name="sqsUrls" required="True"> <item type="string"/> </prop> </prop> </discriminator> <discriminator property="kind" value="AzureActiveDirectory"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" cls="AlertsDataTypeOfDataConnector_read"> <prop type="object" name="alerts" required="True" cls="DataConnectorDataTypeCommon_read"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="AzureAdvancedThreatProtection"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@AlertsDataTypeOfDataConnector_read" name="dataTypes"/> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="AzureSecurityCenter"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@AlertsDataTypeOfDataConnector_read" name="dataTypes"/> <prop type="string" name="subscriptionId"/> </prop> </discriminator> <discriminator property="kind" value="Dynamics365"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" required="True"> <prop type="object" name="dynamics365CdsActivities" required="True"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="GenericUI"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="connectorUiConfig" cls="CodelessUiConnectorConfigProperties_read"> <prop type="object" name="availability" required="True"> <prop type="boolean" name="isPreview"/> <prop type="integer32" name="status"> <enum> <item value="1"/> </enum> </prop> </prop> <prop type="array<object>" name="connectivityCriteria" required="True"> <item type="object"> <prop type="string" name="type"> <enum> <item value=""IsConnectedQuery""/> </enum> </prop> <prop type="array<string>" name="value"> <item type="string"/> </prop> </item> </prop> <prop type="string" name="customImage"/> <prop type="array<object>" name="dataTypes" required="True"> <item type="object"> <prop type="string" name="lastDataReceivedQuery"/> <prop type="string" name="name"/> </item> </prop> <prop type="string" name="descriptionMarkdown" required="True"/> <prop type="array<object>" name="graphQueries" required="True"> <item type="object"> <prop type="string" name="baseQuery"/> <prop type="string" name="legend"/> <prop type="string" name="metricName"/> </item> </prop> <prop type="string" name="graphQueriesTableName" required="True"/> <prop type="array<object>" name="instructionSteps" required="True"> <item type="object"> <prop type="string" name="description"/> <prop type="array<object>" name="instructions"> <item type="object"> <prop type="string" name="type" required="True"> <enum> <item value=""CopyableLabel""/> <item value=""InfoMessage""/> <item value=""InstructionStepsGroup""/> </enum> </prop> </item> </prop> <prop type="string" name="title"/> </item> </prop> <prop type="object" name="permissions" required="True"> <prop type="array<object>" name="customs"> <item type="object"> <prop type="string" name="description"/> <prop type="string" name="name"/> </item> </prop> <prop type="array<object>" name="resourceProvider"> <item type="object"> <prop type="string" name="permissionsDisplayText"/> <prop type="string" name="provider"> <enum> <item value=""Microsoft.Authorization/policyAssignments""/> <item value=""Microsoft.OperationalInsights/solutions""/> <item value=""Microsoft.OperationalInsights/workspaces""/> <item value=""Microsoft.OperationalInsights/workspaces/datasources""/> <item value=""Microsoft.OperationalInsights/workspaces/sharedKeys""/> <item value=""microsoft.aadiam/diagnosticSettings""/> </enum> </prop> <prop type="string" name="providerDisplayName"/> <prop type="object" name="requiredPermissions"> <prop type="boolean" name="action"/> <prop type="boolean" name="delete"/> <prop type="boolean" name="read"/> <prop type="boolean" name="write"/> </prop> <prop type="string" name="scope"> <enum> <item value=""ResourceGroup""/> <item value=""Subscription""/> <item value=""Workspace""/> </enum> </prop> </item> </prop> </prop> <prop type="string" name="publisher" required="True"/> <prop type="array<object>" name="sampleQueries" required="True"> <item type="object"> <prop type="string" name="description"/> <prop type="string" name="query"/> </item> </prop> <prop type="string" name="title" required="True"/> </prop> </prop> </discriminator> <discriminator property="kind" value="IOT"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@AlertsDataTypeOfDataConnector_read" name="dataTypes"/> <prop type="string" name="subscriptionId"/> </prop> </discriminator> <discriminator property="kind" value="MicrosoftCloudAppSecurity"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" required="True"> <prop type="@DataConnectorDataTypeCommon_read" name="alerts" required="True"/> <prop type="@DataConnectorDataTypeCommon_read" name="discoveryLogs"/> </prop> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="MicrosoftDefenderAdvancedThreatProtection"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@AlertsDataTypeOfDataConnector_read" name="dataTypes"/> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="MicrosoftThreatIntelligence"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" required="True"> <prop type="object" name="bingSafetyPhishingURL" required="True"> <prop type="string" name="lookbackPeriod" required="True"/> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> <prop type="object" name="microsoftEmergingThreatFeed" required="True"> <prop type="string" name="lookbackPeriod" required="True"/> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="MicrosoftThreatProtection"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" required="True"> <prop type="object" name="incidents" required="True"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="Office365"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" required="True"> <prop type="object" name="exchange" required="True"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> <prop type="object" name="sharePoint" required="True"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> <prop type="object" name="teams" required="True"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="Office365Project"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" required="True"> <prop type="object" name="logs" required="True"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="OfficeATP"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@AlertsDataTypeOfDataConnector_read" name="dataTypes"/> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="OfficeIRM"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@AlertsDataTypeOfDataConnector_read" name="dataTypes"/> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="OfficePowerBI"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" required="True"> <prop type="object" name="logs" required="True"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="ThreatIntelligence"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" required="True"> <prop type="object" name="indicators" required="True"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" required="True"/> <prop nullable="True" type="dateTime" name="tipLookbackPeriod"/> </prop> </discriminator> <discriminator property="kind" value="ThreatIntelligenceTaxii"> <prop type="object" name="properties" clientFlatten="True"> <prop type="string" name="collectionId"/> <prop type="object" name="dataTypes" required="True"> <prop type="object" name="taxiiClient" required="True"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="friendlyName"/> <prop type="string" name="password"/> <prop nullable="True" type="string" name="pollingFrequency" required="True"> <enum> <item value=""OnceADay""/> <item value=""OnceAMinute""/> <item value=""OnceAnHour""/> </enum> </prop> <prop nullable="True" type="dateTime" name="taxiiLookbackPeriod"/> <prop type="string" name="taxiiServer"/> <prop type="string" name="tenantId" required="True"/> <prop type="string" name="userName"/> <prop type="string" name="workspaceId"/> </prop> </discriminator> </schema> </json> </body> </response> <response isError="True"> <body> <json> <schema type="@ODataV4Format"/> </json> </body> </response> </http> </operation> <output type="object" ref="$Instance" clientFlatten="True"/> </command> <command name="update" version="2022-06-01-preview"> <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.operationalinsights/workspaces/{}/providers/microsoft.securityinsights/dataconnectors/{}" version="2022-06-01-preview" swagger="mgmt-plane/securityinsights/ResourceProviders/Microsoft.SecurityInsights/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuT3BlcmF0aW9uYWxJbnNpZ2h0cy93b3Jrc3BhY2VzL3t3b3Jrc3BhY2VOYW1lfS9wcm92aWRlcnMvTWljcm9zb2Z0LlNlY3VyaXR5SW5zaWdodHMvZGF0YUNvbm5lY3RvcnMve2RhdGFDb25uZWN0b3JJZH0=/V/MjAyMi0wNi0wMS1wcmV2aWV3"/> <argGroup name=""> <arg type="string" var="$Path.dataConnectorId" options="data-connector-id name n" required="True" idPart="child_name_1"> <help short="Connector ID"/> </arg> <arg type="ResourceGroupName" var="$Path.resourceGroupName" options="resource-group g" required="True" idPart="resource_group"/> <arg type="SubscriptionId" var="$Path.subscriptionId" options="subscription" required="True" idPart="subscription"/> <arg type="string" var="$Path.workspaceName" options="workspace-name w" required="True" stage="Experimental" idPart="name"> <help short="The name of the workspace."/> <format maxLength="90" minLength="1"/> </arg> </argGroup> <argGroup name="DataConnector"> <arg type="object" var="$dataConnector.APIPolling" options="api-polling" group="DataConnector"> <arg nullable="True" type="@CodelessUiConnectorConfigProperties_update" var="$dataConnector.APIPolling.properties.connectorUiConfig" options="connector-ui-config" group="Properties"> <help short="Config to describe the instructions blade"/> </arg> <arg nullable="True" type="object" var="$dataConnector.APIPolling.properties.pollingConfig" options="polling-config" group="Properties"> <help short="Config to describe the polling instructions"/> <arg type="object" var="$dataConnector.APIPolling.properties.pollingConfig.auth" options="auth"> <help short="Describe the authentication type of the poller"/> <arg nullable="True" type="string" var="$dataConnector.APIPolling.properties.pollingConfig.auth.apiKeyIdentifier" options="api-key-identifier"> <help short="A prefix send in the header before the actual token"/> </arg> <arg nullable="True" type="string" var="$dataConnector.APIPolling.properties.pollingConfig.auth.apiKeyName" options="api-key-name"> <help short="The header name which the token is sent with"/> </arg> <arg type="string" var="$dataConnector.APIPolling.properties.pollingConfig.auth.authType" options="auth-type"> <help short="The authentication type"/> </arg> <arg nullable="True" type="string" var="$dataConnector.APIPolling.properties.pollingConfig.auth.authorizationEndpoint" options="authorization-endpoint"> <help short="The endpoint used to authorize the user, used in Oauth 2.0 flow"/> </arg> <arg nullable="True" type="string" var="$dataConnector.APIPolling.properties.pollingConfig.auth.flowName" options="flow-name"> <help short="Describes the flow name, for example 'AuthCode' for Oauth 2.0"/> </arg> <arg nullable="True" type="string" var="$dataConnector.APIPolling.properties.pollingConfig.auth.isApiKeyInPostPayload" options="is-api-key-in-post-payload"> <help short="Marks if the key should sent in header"/> </arg> <arg nullable="True" type="boolean" var="$dataConnector.APIPolling.properties.pollingConfig.auth.isClientSecretInHeader" options="is-client-secret-in-header"> <help short="Marks if we should send the client secret in header or payload, used in Oauth 2.0 flow"/> </arg> <arg nullable="True" type="string" var="$dataConnector.APIPolling.properties.pollingConfig.auth.redirectionEndpoint" options="redirection-endpoint"> <help short="The redirect endpoint where we will get the authorization code, used in Oauth 2.0 flow"/> </arg> <arg nullable="True" type="string" var="$dataConnector.APIPolling.properties.pollingConfig.auth.scope" options="scope"> <help short="The OAuth token scope"/> </arg> <arg nullable="True" type="string" var="$dataConnector.APIPolling.properties.pollingConfig.auth.tokenEndpoint" options="token-endpoint"> <help short="The endpoint used to issue a token, used in Oauth 2.0 flow"/> </arg> </arg> <arg nullable="True" type="boolean" var="$dataConnector.APIPolling.properties.pollingConfig.isActive" options="is-active"> <help short="The poller active status"/> </arg> <arg nullable="True" type="object" var="$dataConnector.APIPolling.properties.pollingConfig.paging" options="paging"> <help short="Describe the poll request paging config of the poller"/> <arg nullable="True" type="string" var="$dataConnector.APIPolling.properties.pollingConfig.paging.nextPageParaName" options="next-page-para-name"> <help short="Defines the name of a next page attribute"/> </arg> <arg nullable="True" type="string" var="$dataConnector.APIPolling.properties.pollingConfig.paging.nextPageTokenJsonPath" options="next-page-token-json-path"> <help short="Defines the path to a next page token JSON"/> </arg> <arg nullable="True" type="string" var="$dataConnector.APIPolling.properties.pollingConfig.paging.pageCountAttributePath" options="page-count-attribute-path"> <help short="Defines the path to a page count attribute"/> </arg> <arg nullable="True" type="integer32" var="$dataConnector.APIPolling.properties.pollingConfig.paging.pageSize" options="page-size"> <help short="Defines the paging size"/> </arg> <arg nullable="True" type="string" var="$dataConnector.APIPolling.properties.pollingConfig.paging.pageSizeParaName" options="page-size-para-name"> <help short="Defines the name of the page size parameter"/> </arg> <arg nullable="True" type="string" var="$dataConnector.APIPolling.properties.pollingConfig.paging.pageTimeStampAttributePath" options="page-time-stamp-attribute-path"> <help short="Defines the path to a paging time stamp attribute"/> </arg> <arg nullable="True" type="string" var="$dataConnector.APIPolling.properties.pollingConfig.paging.pageTotalCountAttributePath" options="page-total-count-attribute-path"> <help short="Defines the path to a page total count attribute"/> </arg> <arg type="string" var="$dataConnector.APIPolling.properties.pollingConfig.paging.pagingType" options="paging-type"> <help short="Describes the type. could be 'None', 'PageToken', 'PageCount', 'TimeStamp'"/> </arg> <arg nullable="True" type="string" var="$dataConnector.APIPolling.properties.pollingConfig.paging.searchTheLatestTimeStampFromEventsList" options="search-the-latest-time-stamp-from-events-list"> <help short="Determines whether to search for the latest time stamp in the events list"/> </arg> </arg> <arg type="object" var="$dataConnector.APIPolling.properties.pollingConfig.request" options="request"> <help short="Describe the poll request config parameters of the poller"/> <arg type="string" var="$dataConnector.APIPolling.properties.pollingConfig.request.apiEndpoint" options="api-endpoint"> <help short="Describe the endpoint we should pull the data from"/> </arg> <arg nullable="True" type="string" var="$dataConnector.APIPolling.properties.pollingConfig.request.endTimeAttributeName" options="end-time-attribute-name"> <help short="This will be used the query events from the end of the time window"/> </arg> <arg type="string" var="$dataConnector.APIPolling.properties.pollingConfig.request.httpMethod" options="http-method"> <help short="The http method type we will use in the poll request, GET or POST"/> </arg> <arg nullable="True" type="string" var="$dataConnector.APIPolling.properties.pollingConfig.request.queryParametersTemplate" options="query-parameters-template"> <help short="For advanced scenarios for example user name/password embedded in nested JSON payload"/> </arg> <arg type="string" var="$dataConnector.APIPolling.properties.pollingConfig.request.queryTimeFormat" options="query-time-format"> <help short="The time format will be used the query events in a specific window"/> </arg> <arg type="integer32" var="$dataConnector.APIPolling.properties.pollingConfig.request.queryWindowInMin" options="query-window-in-min"> <help short="The window interval we will use the pull the data"/> </arg> <arg nullable="True" type="integer32" var="$dataConnector.APIPolling.properties.pollingConfig.request.rateLimitQps" options="rate-limit-qps"> <help short="Defines the rate limit QPS"/> </arg> <arg nullable="True" type="integer32" var="$dataConnector.APIPolling.properties.pollingConfig.request.retryCount" options="retry-count"> <help short="Describe the amount of time we should try and poll the data in case of failure"/> </arg> <arg nullable="True" type="string" var="$dataConnector.APIPolling.properties.pollingConfig.request.startTimeAttributeName" options="start-time-attribute-name"> <help short="This will be used the query events from a start of the time window"/> </arg> <arg nullable="True" type="integer32" var="$dataConnector.APIPolling.properties.pollingConfig.request.timeoutInSeconds" options="timeout-in-seconds"> <help short="The number of seconds we will consider as a request timeout"/> </arg> </arg> <arg nullable="True" type="object" var="$dataConnector.APIPolling.properties.pollingConfig.response" options="response"> <help short="Describe the response config parameters of the poller"/> <arg type="array<string>" var="$dataConnector.APIPolling.properties.pollingConfig.response.eventsJsonPaths" options="events-json-paths"> <help short="Describes the path we should extract the data in the response"/> <item type="string"/> </arg> <arg nullable="True" type="boolean" var="$dataConnector.APIPolling.properties.pollingConfig.response.isGzipCompressed" options="is-gzip-compressed"> <help short="Describes if the data in the response is Gzip"/> </arg> <arg nullable="True" type="string" var="$dataConnector.APIPolling.properties.pollingConfig.response.successStatusJsonPath" options="success-status-json-path"> <help short="Describes the path we should extract the status code in the response"/> </arg> <arg nullable="True" type="string" var="$dataConnector.APIPolling.properties.pollingConfig.response.successStatusValue" options="success-status-value"> <help short="Describes the path we should extract the status value in the response"/> </arg> </arg> </arg> </arg> <arg type="object" var="$dataConnector.AmazonWebServicesCloudTrail" options="aws-cloud-trail" group="DataConnector"> <help short="Amazon web services cloud trail."/> <arg nullable="True" type="string" var="$dataConnector.AmazonWebServicesCloudTrail.properties.awsRoleArn" options="aws-role-arn" group="Properties"> <help short="The Aws Role Arn (with CloudTrailReadOnly policy) that is used to access the Aws account."/> </arg> <arg type="object" var="$dataConnector.AmazonWebServicesCloudTrail.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for the connector."/> <arg type="object" var="$dataConnector.AmazonWebServicesCloudTrail.properties.dataTypes.logs" options="logs"> <help short="Logs data type."/> <arg type="string" var="$dataConnector.AmazonWebServicesCloudTrail.properties.dataTypes.logs.state" options="state"> <help short="Describe whether this data type connection is enabled or not."/> <enum> <item name="Disabled" value=""Disabled""/> <item name="Enabled" value=""Enabled""/> </enum> </arg> </arg> </arg> </arg> <arg type="object" var="$dataConnector.AmazonWebServicesS3" options="aws-s3" group="DataConnector"> <help short="Amazon web services s3."/> <arg type="object" var="$dataConnector.AmazonWebServicesS3.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for the connector."/> <arg type="object" var="$dataConnector.AmazonWebServicesS3.properties.dataTypes.logs" options="logs"> <help short="Logs data type."/> <arg type="string" var="$dataConnector.AmazonWebServicesS3.properties.dataTypes.logs.state" options="state"> <help short="Describe whether this data type connection is enabled or not."/> <enum> <item name="Disabled" value=""Disabled""/> <item name="Enabled" value=""Enabled""/> </enum> </arg> </arg> </arg> <arg type="string" var="$dataConnector.AmazonWebServicesS3.properties.destinationTable" options="destination-table" group="Properties"> <help short="The logs destination table name in LogAnalytics."/> </arg> <arg type="string" var="$dataConnector.AmazonWebServicesS3.properties.roleArn" options="role-arn" group="Properties"> <help short="The Aws Role Arn that is used to access the Aws account."/> </arg> <arg type="array<string>" var="$dataConnector.AmazonWebServicesS3.properties.sqsUrls" options="sqs-urls" group="Properties"> <help short="The AWS sqs urls for the connector."/> <item type="string"/> </arg> </arg> <arg type="object" var="$dataConnector.AzureActiveDirectory" options="azure-active-directory" group="DataConnector"> <arg nullable="True" type="object" var="$dataConnector.AzureActiveDirectory.properties.dataTypes" options="data-types" group="Properties" cls="AlertsDataTypeOfDataConnector_update"> <help short="The available data types for the connector."/> <arg type="object" var="@AlertsDataTypeOfDataConnector_update.alerts" options="alerts" cls="DataConnectorDataTypeCommon_update"> <help short="Alerts data type connection."/> <arg type="string" var="@DataConnectorDataTypeCommon_update.state" options="state"> <help short="Describe whether this data type connection is enabled or not."/> <enum> <item name="Disabled" value=""Disabled""/> <item name="Enabled" value=""Enabled""/> </enum> </arg> </arg> </arg> <arg type="string" var="$dataConnector.AzureActiveDirectory.properties.tenantId" options="tenant-id" group="Properties"> <help short="The tenant id to connect to, and get the data from."/> </arg> </arg> <arg type="object" var="$dataConnector.AzureAdvancedThreatProtection" options="azure-protection" group="DataConnector"> <help short="Azure advanced threat protection."/> <arg nullable="True" type="@AlertsDataTypeOfDataConnector_update" var="$dataConnector.AzureAdvancedThreatProtection.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for the connector."/> </arg> <arg type="string" var="$dataConnector.AzureAdvancedThreatProtection.properties.tenantId" options="tenant-id" group="Properties"> <help short="The tenant id to connect to, and get the data from."/> </arg> </arg> <arg type="object" var="$dataConnector.AzureSecurityCenter" options="azure-security-center" group="DataConnector"> <arg nullable="True" type="@AlertsDataTypeOfDataConnector_update" var="$dataConnector.AzureSecurityCenter.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for the connector."/> </arg> <arg nullable="True" type="string" var="$dataConnector.AzureSecurityCenter.properties.subscriptionId" options="subscription-id" group="Properties"> <help short="The subscription id to connect to, and get the data from."/> </arg> </arg> <arg type="object" var="$dataConnector.Dynamics365" options="dynamics365" group="DataConnector"> <arg type="object" var="$dataConnector.Dynamics365.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for the connector."/> <arg type="object" var="$dataConnector.Dynamics365.properties.dataTypes.dynamics365CdsActivities" options="dynamics365-cds-activities"> <help short="Common Data Service data type connection."/> <arg type="string" var="$dataConnector.Dynamics365.properties.dataTypes.dynamics365CdsActivities.state" options="state"> <help short="Describe whether this data type connection is enabled or not."/> <enum> <item name="Disabled" value=""Disabled""/> <item name="Enabled" value=""Enabled""/> </enum> </arg> </arg> </arg> <arg type="string" var="$dataConnector.Dynamics365.properties.tenantId" options="tenant-id" group="Properties"> <help short="The tenant id to connect to, and get the data from."/> </arg> </arg> <arg type="object" var="$dataConnector.GenericUI" options="generic-ui" group="DataConnector"> <arg nullable="True" type="object" var="$dataConnector.GenericUI.properties.connectorUiConfig" options="connector-ui-config" group="Properties" cls="CodelessUiConnectorConfigProperties_update"> <help short="Config to describe the instructions blade"/> <arg type="object" var="@CodelessUiConnectorConfigProperties_update.availability" options="availability"> <help short="Connector Availability Status"/> <arg nullable="True" type="boolean" var="@CodelessUiConnectorConfigProperties_update.availability.isPreview" options="is-preview"> <help short="Set connector as preview"/> </arg> <arg nullable="True" type="integer32" var="@CodelessUiConnectorConfigProperties_update.availability.status" options="status"> <help short="The connector Availability Status"/> <enum> <item name="1" value="1"/> </enum> </arg> </arg> <arg type="array<object>" var="@CodelessUiConnectorConfigProperties_update.connectivityCriteria" options="connectivity-criteria"> <help short="Define the way the connector check connectivity"/> <item type="object"> <arg nullable="True" type="string" var="@CodelessUiConnectorConfigProperties_update.connectivityCriteria[].type" options="type"> <help short="type of connectivity"/> <enum> <item name="IsConnectedQuery" value=""IsConnectedQuery""/> </enum> </arg> <arg nullable="True" type="array<string>" var="@CodelessUiConnectorConfigProperties_update.connectivityCriteria[].value" options="value"> <help short="Queries for checking connectivity"/> <item type="string"/> </arg> </item> </arg> <arg nullable="True" type="string" var="@CodelessUiConnectorConfigProperties_update.customImage" options="custom-image"> <help short="An optional custom image to be used when displaying the connector within Azure Sentinel's connector's gallery"/> </arg> <arg type="array<object>" var="@CodelessUiConnectorConfigProperties_update.dataTypes" options="data-types"> <help short="Data types to check for last data received"/> <item type="object"> <arg nullable="True" type="string" var="@CodelessUiConnectorConfigProperties_update.dataTypes[].lastDataReceivedQuery" options="last-data-received-query"> <help short="Query for indicate last data received"/> </arg> <arg nullable="True" type="string" var="@CodelessUiConnectorConfigProperties_update.dataTypes[].name" options="name"> <help short="Name of the data type to show in the graph. can be use with {{graphQueriesTableName}} placeholder"/> </arg> </item> </arg> <arg type="string" var="@CodelessUiConnectorConfigProperties_update.descriptionMarkdown" options="description-markdown"> <help short="Connector description"/> </arg> <arg type="array<object>" var="@CodelessUiConnectorConfigProperties_update.graphQueries" options="graph-queries"> <help short="The graph query to show the current data status"/> <item type="object"> <arg nullable="True" type="string" var="@CodelessUiConnectorConfigProperties_update.graphQueries[].baseQuery" options="base-query"> <help short="The base query for the graph"/> </arg> <arg nullable="True" type="string" var="@CodelessUiConnectorConfigProperties_update.graphQueries[].legend" options="legend"> <help short="The legend for the graph"/> </arg> <arg nullable="True" type="string" var="@CodelessUiConnectorConfigProperties_update.graphQueries[].metricName" options="metric-name"> <help short="the metric that the query is checking"/> </arg> </item> </arg> <arg type="string" var="@CodelessUiConnectorConfigProperties_update.graphQueriesTableName" options="graph-queries-table-name"> <help short="Name of the table the connector will insert the data to"/> </arg> <arg type="array<object>" var="@CodelessUiConnectorConfigProperties_update.instructionSteps" options="instruction-steps"> <help short="Instruction steps to enable the connector"/> <item type="object"> <arg nullable="True" type="string" var="@CodelessUiConnectorConfigProperties_update.instructionSteps[].description" options="description"> <help short="Instruction step description"/> </arg> <arg nullable="True" type="array<object>" var="@CodelessUiConnectorConfigProperties_update.instructionSteps[].instructions" options="instructions"> <help short="Instruction step details"/> <item type="object"> <arg type="string" var="@CodelessUiConnectorConfigProperties_update.instructionSteps[].instructions[].type" options="type"> <help short="The kind of the setting"/> <enum> <item name="CopyableLabel" value=""CopyableLabel""/> <item name="InfoMessage" value=""InfoMessage""/> <item name="InstructionStepsGroup" value=""InstructionStepsGroup""/> </enum> </arg> </item> </arg> <arg nullable="True" type="string" var="@CodelessUiConnectorConfigProperties_update.instructionSteps[].title" options="title"> <help short="Instruction step title"/> </arg> </item> </arg> <arg type="object" var="@CodelessUiConnectorConfigProperties_update.permissions" options="permissions"> <help short="Permissions required for the connector"/> <arg nullable="True" type="array<object>" var="@CodelessUiConnectorConfigProperties_update.permissions.customs" options="customs"> <help short="Customs permissions required for the connector"/> <item type="object"> <arg nullable="True" type="string" var="@CodelessUiConnectorConfigProperties_update.permissions.customs[].description" options="description"> <help short="Customs permissions description"/> </arg> <arg nullable="True" type="string" var="@CodelessUiConnectorConfigProperties_update.permissions.customs[].name" options="name"> <help short="Customs permissions name"/> </arg> </item> </arg> <arg nullable="True" type="array<object>" var="@CodelessUiConnectorConfigProperties_update.permissions.resourceProvider" options="resource-provider"> <help short="Resource provider permissions required for the connector"/> <item type="object"> <arg nullable="True" type="string" var="@CodelessUiConnectorConfigProperties_update.permissions.resourceProvider[].permissionsDisplayText" options="permissions-display-text"> <help short="Permission description text"/> </arg> <arg nullable="True" type="string" var="@CodelessUiConnectorConfigProperties_update.permissions.resourceProvider[].provider" options="provider"> <help short="Provider name"/> <enum> <item name="Microsoft.Authorization/policyAssignments" value=""Microsoft.Authorization/policyAssignments""/> <item name="Microsoft.OperationalInsights/solutions" value=""Microsoft.OperationalInsights/solutions""/> <item name="Microsoft.OperationalInsights/workspaces" value=""Microsoft.OperationalInsights/workspaces""/> <item name="Microsoft.OperationalInsights/workspaces/datasources" value=""Microsoft.OperationalInsights/workspaces/datasources""/> <item name="Microsoft.OperationalInsights/workspaces/sharedKeys" value=""Microsoft.OperationalInsights/workspaces/sharedKeys""/> <item name="microsoft.aadiam/diagnosticSettings" value=""microsoft.aadiam/diagnosticSettings""/> </enum> </arg> <arg nullable="True" type="string" var="@CodelessUiConnectorConfigProperties_update.permissions.resourceProvider[].providerDisplayName" options="provider-display-name"> <help short="Permission provider display name"/> </arg> <arg nullable="True" type="object" var="@CodelessUiConnectorConfigProperties_update.permissions.resourceProvider[].requiredPermissions" options="required-permissions"> <help short="Required permissions for the connector"/> <arg nullable="True" type="boolean" var="@CodelessUiConnectorConfigProperties_update.permissions.resourceProvider[].requiredPermissions.action" options="action"> <help short="action permission"/> </arg> <arg nullable="True" type="boolean" var="@CodelessUiConnectorConfigProperties_update.permissions.resourceProvider[].requiredPermissions.delete" options="delete"> <help short="delete permission"/> </arg> <arg nullable="True" type="boolean" var="@CodelessUiConnectorConfigProperties_update.permissions.resourceProvider[].requiredPermissions.read" options="read"> <help short="read permission"/> </arg> <arg nullable="True" type="boolean" var="@CodelessUiConnectorConfigProperties_update.permissions.resourceProvider[].requiredPermissions.write" options="write"> <help short="write permission"/> </arg> </arg> <arg nullable="True" type="string" var="@CodelessUiConnectorConfigProperties_update.permissions.resourceProvider[].scope" options="scope"> <help short="Permission provider scope"/> <enum> <item name="ResourceGroup" value=""ResourceGroup""/> <item name="Subscription" value=""Subscription""/> <item name="Workspace" value=""Workspace""/> </enum> </arg> </item> </arg> </arg> <arg type="string" var="@CodelessUiConnectorConfigProperties_update.publisher" options="publisher"> <help short="Connector publisher name"/> </arg> <arg type="array<object>" var="@CodelessUiConnectorConfigProperties_update.sampleQueries" options="sample-queries"> <help short="The sample queries for the connector"/> <item type="object"> <arg nullable="True" type="string" var="@CodelessUiConnectorConfigProperties_update.sampleQueries[].description" options="description"> <help short="The sample query description"/> </arg> <arg nullable="True" type="string" var="@CodelessUiConnectorConfigProperties_update.sampleQueries[].query" options="query"> <help short="the sample query"/> </arg> </item> </arg> <arg type="string" var="@CodelessUiConnectorConfigProperties_update.title" options="title"> <help short="Connector blade title"/> </arg> </arg> </arg> <arg type="object" var="$dataConnector.IOT" options="iot" group="DataConnector"> <arg nullable="True" type="@AlertsDataTypeOfDataConnector_update" var="$dataConnector.IOT.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for the connector."/> </arg> <arg nullable="True" type="string" var="$dataConnector.IOT.properties.subscriptionId" options="subscription-id" group="Properties"> <help short="The subscription id to connect to, and get the data from."/> </arg> </arg> <arg type="object" var="$dataConnector.MicrosoftCloudAppSecurity" options="cloud-app-security" group="DataConnector"> <help short="Microsoft cloud app security."/> <arg type="object" var="$dataConnector.MicrosoftCloudAppSecurity.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for the connector."/> <arg type="@DataConnectorDataTypeCommon_update" var="$dataConnector.MicrosoftCloudAppSecurity.properties.dataTypes.alerts" options="alerts"> <help short="Alerts data type connection."/> </arg> <arg nullable="True" type="@DataConnectorDataTypeCommon_update" var="$dataConnector.MicrosoftCloudAppSecurity.properties.dataTypes.discoveryLogs" options="discovery-logs"> <help short="Discovery log data type connection."/> </arg> </arg> <arg type="string" var="$dataConnector.MicrosoftCloudAppSecurity.properties.tenantId" options="tenant-id" group="Properties"> <help short="The tenant id to connect to, and get the data from."/> </arg> </arg> <arg type="object" var="$dataConnector.MicrosoftDefenderAdvancedThreatProtection" options="defender-protection" group="DataConnector"> <help short="Microsoft defender advanced threat protection."/> <arg nullable="True" type="@AlertsDataTypeOfDataConnector_update" var="$dataConnector.MicrosoftDefenderAdvancedThreatProtection.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for the connector."/> </arg> <arg type="string" var="$dataConnector.MicrosoftDefenderAdvancedThreatProtection.properties.tenantId" options="tenant-id" group="Properties"> <help short="The tenant id to connect to, and get the data from."/> </arg> </arg> <arg type="object" var="$dataConnector.MicrosoftThreatIntelligence" options="microsoft-intelligence" group="DataConnector"> <help short="Microsoft threat intelligence."/> <arg type="object" var="$dataConnector.MicrosoftThreatIntelligence.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for the connector."/> <arg type="object" var="$dataConnector.MicrosoftThreatIntelligence.properties.dataTypes.bingSafetyPhishingURL" options="bing-safety-phishing-url"> <help short="Data type for Microsoft Threat Intelligence Platforms data connector."/> <arg type="string" var="$dataConnector.MicrosoftThreatIntelligence.properties.dataTypes.bingSafetyPhishingURL.lookbackPeriod" options="lookback-period"> <help short="lookback period"/> </arg> <arg type="string" var="$dataConnector.MicrosoftThreatIntelligence.properties.dataTypes.bingSafetyPhishingURL.state" options="state"> <help short="Describe whether this data type connection is enabled or not."/> <enum> <item name="Disabled" value=""Disabled""/> <item name="Enabled" value=""Enabled""/> </enum> </arg> </arg> <arg type="object" var="$dataConnector.MicrosoftThreatIntelligence.properties.dataTypes.microsoftEmergingThreatFeed" options="microsoft-emerging-threat-feed"> <help short="Data type for Microsoft Threat Intelligence Platforms data connector."/> <arg type="string" var="$dataConnector.MicrosoftThreatIntelligence.properties.dataTypes.microsoftEmergingThreatFeed.lookbackPeriod" options="lookback-period"> <help short="lookback period"/> </arg> <arg type="string" var="$dataConnector.MicrosoftThreatIntelligence.properties.dataTypes.microsoftEmergingThreatFeed.state" options="state"> <help short="Describe whether this data type connection is enabled or not."/> <enum> <item name="Disabled" value=""Disabled""/> <item name="Enabled" value=""Enabled""/> </enum> </arg> </arg> </arg> <arg type="string" var="$dataConnector.MicrosoftThreatIntelligence.properties.tenantId" options="tenant-id" group="Properties"> <help short="The tenant id to connect to, and get the data from."/> </arg> </arg> <arg type="object" var="$dataConnector.MicrosoftThreatProtection" options="microsoft-protection" group="DataConnector"> <help short="Microsoft threat protection."/> <arg type="object" var="$dataConnector.MicrosoftThreatProtection.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for the connector."/> <arg type="object" var="$dataConnector.MicrosoftThreatProtection.properties.dataTypes.incidents" options="incidents"> <help short="Data type for Microsoft Threat Protection Platforms data connector."/> <arg type="string" var="$dataConnector.MicrosoftThreatProtection.properties.dataTypes.incidents.state" options="state"> <help short="Describe whether this data type connection is enabled or not."/> <enum> <item name="Disabled" value=""Disabled""/> <item name="Enabled" value=""Enabled""/> </enum> </arg> </arg> </arg> <arg type="string" var="$dataConnector.MicrosoftThreatProtection.properties.tenantId" options="tenant-id" group="Properties"> <help short="The tenant id to connect to, and get the data from."/> </arg> </arg> <arg type="object" var="$dataConnector.Office365" options="office365" group="DataConnector"> <arg type="object" var="$dataConnector.Office365.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for the connector."/> <arg type="object" var="$dataConnector.Office365.properties.dataTypes.exchange" options="exchange"> <help short="Exchange data type connection."/> <arg type="string" var="$dataConnector.Office365.properties.dataTypes.exchange.state" options="state"> <help short="Describe whether this data type connection is enabled or not."/> <enum> <item name="Disabled" value=""Disabled""/> <item name="Enabled" value=""Enabled""/> </enum> </arg> </arg> <arg type="object" var="$dataConnector.Office365.properties.dataTypes.sharePoint" options="share-point"> <help short="SharePoint data type connection."/> <arg type="string" var="$dataConnector.Office365.properties.dataTypes.sharePoint.state" options="state"> <help short="Describe whether this data type connection is enabled or not."/> <enum> <item name="Disabled" value=""Disabled""/> <item name="Enabled" value=""Enabled""/> </enum> </arg> </arg> <arg type="object" var="$dataConnector.Office365.properties.dataTypes.teams" options="teams"> <help short="Teams data type connection."/> <arg type="string" var="$dataConnector.Office365.properties.dataTypes.teams.state" options="state"> <help short="Describe whether this data type connection is enabled or not."/> <enum> <item name="Disabled" value=""Disabled""/> <item name="Enabled" value=""Enabled""/> </enum> </arg> </arg> </arg> <arg type="string" var="$dataConnector.Office365.properties.tenantId" options="tenant-id" group="Properties"> <help short="The tenant id to connect to, and get the data from."/> </arg> </arg> <arg type="object" var="$dataConnector.Office365Project" options="office365-project" group="DataConnector"> <arg type="object" var="$dataConnector.Office365Project.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for the connector."/> <arg type="object" var="$dataConnector.Office365Project.properties.dataTypes.logs" options="logs"> <help short="Logs data type."/> <arg type="string" var="$dataConnector.Office365Project.properties.dataTypes.logs.state" options="state"> <help short="Describe whether this data type connection is enabled or not."/> <enum> <item name="Disabled" value=""Disabled""/> <item name="Enabled" value=""Enabled""/> </enum> </arg> </arg> </arg> <arg type="string" var="$dataConnector.Office365Project.properties.tenantId" options="tenant-id" group="Properties"> <help short="The tenant id to connect to, and get the data from."/> </arg> </arg> <arg type="object" var="$dataConnector.OfficeATP" options="office-atp" group="DataConnector"> <arg nullable="True" type="@AlertsDataTypeOfDataConnector_update" var="$dataConnector.OfficeATP.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for the connector."/> </arg> <arg type="string" var="$dataConnector.OfficeATP.properties.tenantId" options="tenant-id" group="Properties"> <help short="The tenant id to connect to, and get the data from."/> </arg> </arg> <arg type="object" var="$dataConnector.OfficeIRM" options="office-irm" group="DataConnector"> <arg nullable="True" type="@AlertsDataTypeOfDataConnector_update" var="$dataConnector.OfficeIRM.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for the connector."/> </arg> <arg type="string" var="$dataConnector.OfficeIRM.properties.tenantId" options="tenant-id" group="Properties"> <help short="The tenant id to connect to, and get the data from."/> </arg> </arg> <arg type="object" var="$dataConnector.OfficePowerBI" options="office-power-bi" group="DataConnector"> <arg type="object" var="$dataConnector.OfficePowerBI.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for the connector."/> <arg type="object" var="$dataConnector.OfficePowerBI.properties.dataTypes.logs" options="logs"> <help short="Logs data type."/> <arg type="string" var="$dataConnector.OfficePowerBI.properties.dataTypes.logs.state" options="state"> <help short="Describe whether this data type connection is enabled or not."/> <enum> <item name="Disabled" value=""Disabled""/> <item name="Enabled" value=""Enabled""/> </enum> </arg> </arg> </arg> <arg type="string" var="$dataConnector.OfficePowerBI.properties.tenantId" options="tenant-id" group="Properties"> <help short="The tenant id to connect to, and get the data from."/> </arg> </arg> <arg type="object" var="$dataConnector.ThreatIntelligence" options="threat-intelligence" group="DataConnector"> <arg type="object" var="$dataConnector.ThreatIntelligence.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for the connector."/> <arg type="object" var="$dataConnector.ThreatIntelligence.properties.dataTypes.indicators" options="indicators"> <help short="Data type for indicators connection."/> <arg type="string" var="$dataConnector.ThreatIntelligence.properties.dataTypes.indicators.state" options="state"> <help short="Describe whether this data type connection is enabled or not."/> <enum> <item name="Disabled" value=""Disabled""/> <item name="Enabled" value=""Enabled""/> </enum> </arg> </arg> </arg> <arg type="string" var="$dataConnector.ThreatIntelligence.properties.tenantId" options="tenant-id" group="Properties"> <help short="The tenant id to connect to, and get the data from."/> </arg> <arg nullable="True" type="dateTime" var="$dataConnector.ThreatIntelligence.properties.tipLookbackPeriod" options="tip-lookback-period" group="Properties"> <help short="The lookback period for the feed to be imported."/> </arg> </arg> <arg type="object" var="$dataConnector.ThreatIntelligenceTaxii" options="intelligence-taxii" group="DataConnector"> <help short="Threat intelligence taxii."/> <arg nullable="True" type="string" var="$dataConnector.ThreatIntelligenceTaxii.properties.collectionId" options="collection-id" group="Properties"> <help short="The collection id of the TAXII server."/> </arg> <arg type="object" var="$dataConnector.ThreatIntelligenceTaxii.properties.dataTypes" options="data-types" group="Properties"> <help short="The available data types for Threat Intelligence TAXII data connector."/> <arg type="object" var="$dataConnector.ThreatIntelligenceTaxii.properties.dataTypes.taxiiClient" options="taxii-client"> <help short="Data type for TAXII connector."/> <arg type="string" var="$dataConnector.ThreatIntelligenceTaxii.properties.dataTypes.taxiiClient.state" options="state"> <help short="Describe whether this data type connection is enabled or not."/> <enum> <item name="Disabled" value=""Disabled""/> <item name="Enabled" value=""Enabled""/> </enum> </arg> </arg> </arg> <arg nullable="True" type="string" var="$dataConnector.ThreatIntelligenceTaxii.properties.friendlyName" options="friendly-name" group="Properties"> <help short="The friendly name for the TAXII server."/> </arg> <arg nullable="True" type="string" var="$dataConnector.ThreatIntelligenceTaxii.properties.password" options="password" group="Properties"> <help short="The password for the TAXII server."/> </arg> <arg nullable="True" type="string" var="$dataConnector.ThreatIntelligenceTaxii.properties.pollingFrequency" options="polling-frequency" group="Properties"> <help short="The polling frequency for the TAXII server."/> <enum> <item name="OnceADay" value=""OnceADay""/> <item name="OnceAMinute" value=""OnceAMinute""/> <item name="OnceAnHour" value=""OnceAnHour""/> </enum> </arg> <arg nullable="True" type="dateTime" var="$dataConnector.ThreatIntelligenceTaxii.properties.taxiiLookbackPeriod" options="taxii-lookback-period" group="Properties"> <help short="The lookback period for the TAXII server."/> </arg> <arg nullable="True" type="string" var="$dataConnector.ThreatIntelligenceTaxii.properties.taxiiServer" options="taxii-server" group="Properties"> <help short="The API root for the TAXII server."/> </arg> <arg type="string" var="$dataConnector.ThreatIntelligenceTaxii.properties.tenantId" options="tenant-id" group="Properties"> <help short="The tenant id to connect to, and get the data from."/> </arg> <arg nullable="True" type="string" var="$dataConnector.ThreatIntelligenceTaxii.properties.userName" options="user-name" group="Properties"> <help short="The userName for the TAXII server."/> </arg> <arg nullable="True" type="string" var="$dataConnector.ThreatIntelligenceTaxii.properties.workspaceId" options="workspace-id" group="Properties"> <help short="The workspace id."/> </arg> </arg> <arg nullable="True" type="string" var="$dataConnector.etag" options="etag" group="DataConnector"> <help short="Etag of the azure resource"/> </arg> </argGroup> <operation operationId="DataConnectors_Get"> <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors/{dataConnectorId}"> <request method="get"> <path> <param type="string" name="dataConnectorId" arg="$Path.dataConnectorId" required="True"/> <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True"> <format maxLength="90" minLength="1"/> </param> <param type="string" name="subscriptionId" arg="$Path.subscriptionId" required="True"> <format minLength="1"/> </param> <param type="string" name="workspaceName" arg="$Path.workspaceName" required="True"> <format maxLength="90" minLength="1"/> </param> </path> <query> <const readOnly="True" const="True" type="string" name="api-version" required="True"> <default value=""2022-06-01-preview""/> <format minLength="1"/> </const> </query> </request> <response statusCode="200"> <body> <json var="$Instance"> <schema type="object" cls="DataConnector_read"> <prop type="string" name="etag"/> <prop readOnly="True" type="ResourceId" name="id"> <format template="/subscriptions/{}/resourceGroups/{}/providers/Microsoft.OperationalInsights/workspaces/{}/providers/Microsoft.SecurityInsights/dataConnectors/{}"/> </prop> <prop type="string" name="kind" required="True"> <enum> <item value=""APIPolling""/> <item value=""AmazonWebServicesCloudTrail""/> <item value=""AmazonWebServicesS3""/> <item value=""AzureActiveDirectory""/> <item value=""AzureAdvancedThreatProtection""/> <item value=""AzureSecurityCenter""/> <item value=""Dynamics365""/> <item value=""GenericUI""/> <item value=""IOT""/> <item value=""MicrosoftCloudAppSecurity""/> <item value=""MicrosoftDefenderAdvancedThreatProtection""/> <item value=""MicrosoftThreatIntelligence""/> <item value=""MicrosoftThreatProtection""/> <item value=""Office365""/> <item value=""Office365Project""/> <item value=""OfficeATP""/> <item value=""OfficeIRM""/> <item value=""OfficePowerBI""/> <item value=""ThreatIntelligence""/> <item value=""ThreatIntelligenceTaxii""/> </enum> </prop> <prop readOnly="True" type="string" name="name"/> <prop readOnly="True" type="object" name="systemData"> <prop readOnly="True" type="dateTime" name="createdAt"/> <prop readOnly="True" type="string" name="createdBy"/> <prop readOnly="True" type="string" name="createdByType"> <enum> <item value=""Application""/> <item value=""Key""/> <item value=""ManagedIdentity""/> <item value=""User""/> </enum> </prop> <prop readOnly="True" type="dateTime" name="lastModifiedAt"/> <prop readOnly="True" type="string" name="lastModifiedBy"/> <prop readOnly="True" type="string" name="lastModifiedByType"> <enum> <item value=""Application""/> <item value=""Key""/> <item value=""ManagedIdentity""/> <item value=""User""/> </enum> </prop> </prop> <prop readOnly="True" type="string" name="type"/> <discriminator property="kind" value="APIPolling"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@CodelessUiConnectorConfigProperties_read" name="connectorUiConfig"/> <prop type="object" name="pollingConfig"> <prop type="object" name="auth" required="True"> <prop type="string" name="apiKeyIdentifier"/> <prop type="string" name="apiKeyName"/> <prop type="string" name="authType" required="True"/> <prop type="string" name="authorizationEndpoint"/> <prop type="string" name="flowName"/> <prop type="string" name="isApiKeyInPostPayload"/> <prop type="boolean" name="isClientSecretInHeader"/> <prop type="string" name="redirectionEndpoint"/> <prop type="string" name="scope"/> <prop type="string" name="tokenEndpoint"/> </prop> <prop type="boolean" name="isActive"/> <prop type="object" name="paging"> <prop type="string" name="nextPageParaName"/> <prop type="string" name="nextPageTokenJsonPath"/> <prop type="string" name="pageCountAttributePath"/> <prop type="integer32" name="pageSize"/> <prop type="string" name="pageSizeParaName"/> <prop type="string" name="pageTimeStampAttributePath"/> <prop type="string" name="pageTotalCountAttributePath"/> <prop type="string" name="pagingType" required="True"/> <prop type="string" name="searchTheLatestTimeStampFromEventsList"/> </prop> <prop type="object" name="request" required="True"> <prop type="string" name="apiEndpoint" required="True"/> <prop type="string" name="endTimeAttributeName"/> <prop type="string" name="httpMethod" required="True"/> <prop type="string" name="queryParametersTemplate"/> <prop type="string" name="queryTimeFormat" required="True"/> <prop type="integer32" name="queryWindowInMin" required="True"/> <prop type="integer32" name="rateLimitQps"/> <prop type="integer32" name="retryCount"/> <prop type="string" name="startTimeAttributeName"/> <prop type="integer32" name="timeoutInSeconds"/> </prop> <prop type="object" name="response"> <prop type="array<string>" name="eventsJsonPaths" required="True"> <item type="string"/> </prop> <prop type="boolean" name="isGzipCompressed"/> <prop type="string" name="successStatusJsonPath"/> <prop type="string" name="successStatusValue"/> </prop> </prop> </prop> </discriminator> <discriminator property="kind" value="AmazonWebServicesCloudTrail"> <prop type="object" name="properties" clientFlatten="True"> <prop type="string" name="awsRoleArn"/> <prop type="object" name="dataTypes" required="True"> <prop type="object" name="logs" required="True"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> </prop> </discriminator> <discriminator property="kind" value="AmazonWebServicesS3"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" required="True"> <prop type="object" name="logs" required="True"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="destinationTable" required="True"/> <prop type="string" name="roleArn" required="True"/> <prop type="array<string>" name="sqsUrls" required="True"> <item type="string"/> </prop> </prop> </discriminator> <discriminator property="kind" value="AzureActiveDirectory"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" cls="AlertsDataTypeOfDataConnector_read"> <prop type="object" name="alerts" required="True" cls="DataConnectorDataTypeCommon_read"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="AzureAdvancedThreatProtection"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@AlertsDataTypeOfDataConnector_read" name="dataTypes"/> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="AzureSecurityCenter"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@AlertsDataTypeOfDataConnector_read" name="dataTypes"/> <prop type="string" name="subscriptionId"/> </prop> </discriminator> <discriminator property="kind" value="Dynamics365"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" required="True"> <prop type="object" name="dynamics365CdsActivities" required="True"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="GenericUI"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="connectorUiConfig" cls="CodelessUiConnectorConfigProperties_read"> <prop type="object" name="availability" required="True"> <prop type="boolean" name="isPreview"/> <prop type="integer32" name="status"> <enum> <item value="1"/> </enum> </prop> </prop> <prop type="array<object>" name="connectivityCriteria" required="True"> <item type="object"> <prop type="string" name="type"> <enum> <item value=""IsConnectedQuery""/> </enum> </prop> <prop type="array<string>" name="value"> <item type="string"/> </prop> </item> </prop> <prop type="string" name="customImage"/> <prop type="array<object>" name="dataTypes" required="True"> <item type="object"> <prop type="string" name="lastDataReceivedQuery"/> <prop type="string" name="name"/> </item> </prop> <prop type="string" name="descriptionMarkdown" required="True"/> <prop type="array<object>" name="graphQueries" required="True"> <item type="object"> <prop type="string" name="baseQuery"/> <prop type="string" name="legend"/> <prop type="string" name="metricName"/> </item> </prop> <prop type="string" name="graphQueriesTableName" required="True"/> <prop type="array<object>" name="instructionSteps" required="True"> <item type="object"> <prop type="string" name="description"/> <prop type="array<object>" name="instructions"> <item type="object"> <prop type="string" name="type" required="True"> <enum> <item value=""CopyableLabel""/> <item value=""InfoMessage""/> <item value=""InstructionStepsGroup""/> </enum> </prop> </item> </prop> <prop type="string" name="title"/> </item> </prop> <prop type="object" name="permissions" required="True"> <prop type="array<object>" name="customs"> <item type="object"> <prop type="string" name="description"/> <prop type="string" name="name"/> </item> </prop> <prop type="array<object>" name="resourceProvider"> <item type="object"> <prop type="string" name="permissionsDisplayText"/> <prop type="string" name="provider"> <enum> <item value=""Microsoft.Authorization/policyAssignments""/> <item value=""Microsoft.OperationalInsights/solutions""/> <item value=""Microsoft.OperationalInsights/workspaces""/> <item value=""Microsoft.OperationalInsights/workspaces/datasources""/> <item value=""Microsoft.OperationalInsights/workspaces/sharedKeys""/> <item value=""microsoft.aadiam/diagnosticSettings""/> </enum> </prop> <prop type="string" name="providerDisplayName"/> <prop type="object" name="requiredPermissions"> <prop type="boolean" name="action"/> <prop type="boolean" name="delete"/> <prop type="boolean" name="read"/> <prop type="boolean" name="write"/> </prop> <prop type="string" name="scope"> <enum> <item value=""ResourceGroup""/> <item value=""Subscription""/> <item value=""Workspace""/> </enum> </prop> </item> </prop> </prop> <prop type="string" name="publisher" required="True"/> <prop type="array<object>" name="sampleQueries" required="True"> <item type="object"> <prop type="string" name="description"/> <prop type="string" name="query"/> </item> </prop> <prop type="string" name="title" required="True"/> </prop> </prop> </discriminator> <discriminator property="kind" value="IOT"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@AlertsDataTypeOfDataConnector_read" name="dataTypes"/> <prop type="string" name="subscriptionId"/> </prop> </discriminator> <discriminator property="kind" value="MicrosoftCloudAppSecurity"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" required="True"> <prop type="@DataConnectorDataTypeCommon_read" name="alerts" required="True"/> <prop type="@DataConnectorDataTypeCommon_read" name="discoveryLogs"/> </prop> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="MicrosoftDefenderAdvancedThreatProtection"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@AlertsDataTypeOfDataConnector_read" name="dataTypes"/> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="MicrosoftThreatIntelligence"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" required="True"> <prop type="object" name="bingSafetyPhishingURL" required="True"> <prop type="string" name="lookbackPeriod" required="True"/> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> <prop type="object" name="microsoftEmergingThreatFeed" required="True"> <prop type="string" name="lookbackPeriod" required="True"/> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="MicrosoftThreatProtection"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" required="True"> <prop type="object" name="incidents" required="True"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="Office365"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" required="True"> <prop type="object" name="exchange" required="True"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> <prop type="object" name="sharePoint" required="True"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> <prop type="object" name="teams" required="True"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="Office365Project"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" required="True"> <prop type="object" name="logs" required="True"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="OfficeATP"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@AlertsDataTypeOfDataConnector_read" name="dataTypes"/> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="OfficeIRM"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@AlertsDataTypeOfDataConnector_read" name="dataTypes"/> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="OfficePowerBI"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" required="True"> <prop type="object" name="logs" required="True"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="ThreatIntelligence"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" required="True"> <prop type="object" name="indicators" required="True"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" required="True"/> <prop nullable="True" type="dateTime" name="tipLookbackPeriod"/> </prop> </discriminator> <discriminator property="kind" value="ThreatIntelligenceTaxii"> <prop type="object" name="properties" clientFlatten="True"> <prop type="string" name="collectionId"/> <prop type="object" name="dataTypes" required="True"> <prop type="object" name="taxiiClient" required="True"> <prop type="string" name="state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="friendlyName"/> <prop type="string" name="password"/> <prop nullable="True" type="string" name="pollingFrequency" required="True"> <enum> <item value=""OnceADay""/> <item value=""OnceAMinute""/> <item value=""OnceAnHour""/> </enum> </prop> <prop nullable="True" type="dateTime" name="taxiiLookbackPeriod"/> <prop type="string" name="taxiiServer"/> <prop type="string" name="tenantId" required="True"/> <prop type="string" name="userName"/> <prop type="string" name="workspaceId"/> </prop> </discriminator> </schema> </json> </body> </response> <response isError="True"> <body> <json> <schema type="@ODataV4Format"/> </json> </body> </response> </http> </operation> <operation> <instanceUpdate instance="$Instance"> <json> <schema type="object" name="dataConnector" required="True" clientFlatten="True"> <prop type="string" name="etag" arg="$dataConnector.etag"/> <prop type="string" name="kind" required="True"> <enum> <item arg="$dataConnector.APIPolling" value=""APIPolling""/> <item arg="$dataConnector.AmazonWebServicesCloudTrail" value=""AmazonWebServicesCloudTrail""/> <item arg="$dataConnector.AmazonWebServicesS3" value=""AmazonWebServicesS3""/> <item arg="$dataConnector.AzureActiveDirectory" value=""AzureActiveDirectory""/> <item arg="$dataConnector.AzureAdvancedThreatProtection" value=""AzureAdvancedThreatProtection""/> <item arg="$dataConnector.AzureSecurityCenter" value=""AzureSecurityCenter""/> <item arg="$dataConnector.Dynamics365" value=""Dynamics365""/> <item arg="$dataConnector.GenericUI" value=""GenericUI""/> <item arg="$dataConnector.IOT" value=""IOT""/> <item arg="$dataConnector.MicrosoftCloudAppSecurity" value=""MicrosoftCloudAppSecurity""/> <item arg="$dataConnector.MicrosoftDefenderAdvancedThreatProtection" value=""MicrosoftDefenderAdvancedThreatProtection""/> <item arg="$dataConnector.MicrosoftThreatIntelligence" value=""MicrosoftThreatIntelligence""/> <item arg="$dataConnector.MicrosoftThreatProtection" value=""MicrosoftThreatProtection""/> <item arg="$dataConnector.Office365" value=""Office365""/> <item arg="$dataConnector.Office365Project" value=""Office365Project""/> <item arg="$dataConnector.OfficeATP" value=""OfficeATP""/> <item arg="$dataConnector.OfficeIRM" value=""OfficeIRM""/> <item arg="$dataConnector.OfficePowerBI" value=""OfficePowerBI""/> <item arg="$dataConnector.ThreatIntelligence" value=""ThreatIntelligence""/> <item arg="$dataConnector.ThreatIntelligenceTaxii" value=""ThreatIntelligenceTaxii""/> </enum> </prop> <discriminator property="kind" value="APIPolling"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@CodelessUiConnectorConfigProperties_update" name="connectorUiConfig" arg="$dataConnector.APIPolling.properties.connectorUiConfig"/> <prop type="object" name="pollingConfig" arg="$dataConnector.APIPolling.properties.pollingConfig"> <prop type="object" name="auth" arg="$dataConnector.APIPolling.properties.pollingConfig.auth" required="True"> <prop type="string" name="apiKeyIdentifier" arg="$dataConnector.APIPolling.properties.pollingConfig.auth.apiKeyIdentifier"/> <prop type="string" name="apiKeyName" arg="$dataConnector.APIPolling.properties.pollingConfig.auth.apiKeyName"/> <prop type="string" name="authType" arg="$dataConnector.APIPolling.properties.pollingConfig.auth.authType" required="True"/> <prop type="string" name="authorizationEndpoint" arg="$dataConnector.APIPolling.properties.pollingConfig.auth.authorizationEndpoint"/> <prop type="string" name="flowName" arg="$dataConnector.APIPolling.properties.pollingConfig.auth.flowName"/> <prop type="string" name="isApiKeyInPostPayload" arg="$dataConnector.APIPolling.properties.pollingConfig.auth.isApiKeyInPostPayload"/> <prop type="boolean" name="isClientSecretInHeader" arg="$dataConnector.APIPolling.properties.pollingConfig.auth.isClientSecretInHeader"/> <prop type="string" name="redirectionEndpoint" arg="$dataConnector.APIPolling.properties.pollingConfig.auth.redirectionEndpoint"/> <prop type="string" name="scope" arg="$dataConnector.APIPolling.properties.pollingConfig.auth.scope"/> <prop type="string" name="tokenEndpoint" arg="$dataConnector.APIPolling.properties.pollingConfig.auth.tokenEndpoint"/> </prop> <prop type="boolean" name="isActive" arg="$dataConnector.APIPolling.properties.pollingConfig.isActive"/> <prop type="object" name="paging" arg="$dataConnector.APIPolling.properties.pollingConfig.paging"> <prop type="string" name="nextPageParaName" arg="$dataConnector.APIPolling.properties.pollingConfig.paging.nextPageParaName"/> <prop type="string" name="nextPageTokenJsonPath" arg="$dataConnector.APIPolling.properties.pollingConfig.paging.nextPageTokenJsonPath"/> <prop type="string" name="pageCountAttributePath" arg="$dataConnector.APIPolling.properties.pollingConfig.paging.pageCountAttributePath"/> <prop type="integer32" name="pageSize" arg="$dataConnector.APIPolling.properties.pollingConfig.paging.pageSize"/> <prop type="string" name="pageSizeParaName" arg="$dataConnector.APIPolling.properties.pollingConfig.paging.pageSizeParaName"/> <prop type="string" name="pageTimeStampAttributePath" arg="$dataConnector.APIPolling.properties.pollingConfig.paging.pageTimeStampAttributePath"/> <prop type="string" name="pageTotalCountAttributePath" arg="$dataConnector.APIPolling.properties.pollingConfig.paging.pageTotalCountAttributePath"/> <prop type="string" name="pagingType" arg="$dataConnector.APIPolling.properties.pollingConfig.paging.pagingType" required="True"/> <prop type="string" name="searchTheLatestTimeStampFromEventsList" arg="$dataConnector.APIPolling.properties.pollingConfig.paging.searchTheLatestTimeStampFromEventsList"/> </prop> <prop type="object" name="request" arg="$dataConnector.APIPolling.properties.pollingConfig.request" required="True"> <prop type="string" name="apiEndpoint" arg="$dataConnector.APIPolling.properties.pollingConfig.request.apiEndpoint" required="True"/> <prop type="string" name="endTimeAttributeName" arg="$dataConnector.APIPolling.properties.pollingConfig.request.endTimeAttributeName"/> <prop type="string" name="httpMethod" arg="$dataConnector.APIPolling.properties.pollingConfig.request.httpMethod" required="True"/> <prop type="string" name="queryParametersTemplate" arg="$dataConnector.APIPolling.properties.pollingConfig.request.queryParametersTemplate"/> <prop type="string" name="queryTimeFormat" arg="$dataConnector.APIPolling.properties.pollingConfig.request.queryTimeFormat" required="True"/> <prop type="integer32" name="queryWindowInMin" arg="$dataConnector.APIPolling.properties.pollingConfig.request.queryWindowInMin" required="True"/> <prop type="integer32" name="rateLimitQps" arg="$dataConnector.APIPolling.properties.pollingConfig.request.rateLimitQps"/> <prop type="integer32" name="retryCount" arg="$dataConnector.APIPolling.properties.pollingConfig.request.retryCount"/> <prop type="string" name="startTimeAttributeName" arg="$dataConnector.APIPolling.properties.pollingConfig.request.startTimeAttributeName"/> <prop type="integer32" name="timeoutInSeconds" arg="$dataConnector.APIPolling.properties.pollingConfig.request.timeoutInSeconds"/> </prop> <prop type="object" name="response" arg="$dataConnector.APIPolling.properties.pollingConfig.response"> <prop type="array<string>" name="eventsJsonPaths" arg="$dataConnector.APIPolling.properties.pollingConfig.response.eventsJsonPaths" required="True"> <item type="string"/> </prop> <prop type="boolean" name="isGzipCompressed" arg="$dataConnector.APIPolling.properties.pollingConfig.response.isGzipCompressed"/> <prop type="string" name="successStatusJsonPath" arg="$dataConnector.APIPolling.properties.pollingConfig.response.successStatusJsonPath"/> <prop type="string" name="successStatusValue" arg="$dataConnector.APIPolling.properties.pollingConfig.response.successStatusValue"/> </prop> </prop> </prop> </discriminator> <discriminator property="kind" value="AmazonWebServicesCloudTrail"> <prop type="object" name="properties" clientFlatten="True"> <prop type="string" name="awsRoleArn" arg="$dataConnector.AmazonWebServicesCloudTrail.properties.awsRoleArn"/> <prop type="object" name="dataTypes" arg="$dataConnector.AmazonWebServicesCloudTrail.properties.dataTypes" required="True"> <prop type="object" name="logs" arg="$dataConnector.AmazonWebServicesCloudTrail.properties.dataTypes.logs" required="True"> <prop type="string" name="state" arg="$dataConnector.AmazonWebServicesCloudTrail.properties.dataTypes.logs.state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> </prop> </discriminator> <discriminator property="kind" value="AmazonWebServicesS3"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" arg="$dataConnector.AmazonWebServicesS3.properties.dataTypes" required="True"> <prop type="object" name="logs" arg="$dataConnector.AmazonWebServicesS3.properties.dataTypes.logs" required="True"> <prop type="string" name="state" arg="$dataConnector.AmazonWebServicesS3.properties.dataTypes.logs.state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="destinationTable" arg="$dataConnector.AmazonWebServicesS3.properties.destinationTable" required="True"/> <prop type="string" name="roleArn" arg="$dataConnector.AmazonWebServicesS3.properties.roleArn" required="True"/> <prop type="array<string>" name="sqsUrls" arg="$dataConnector.AmazonWebServicesS3.properties.sqsUrls" required="True"> <item type="string"/> </prop> </prop> </discriminator> <discriminator property="kind" value="AzureActiveDirectory"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" arg="$dataConnector.AzureActiveDirectory.properties.dataTypes" cls="AlertsDataTypeOfDataConnector_update"> <prop type="object" name="alerts" arg="@AlertsDataTypeOfDataConnector_update.alerts" required="True" cls="DataConnectorDataTypeCommon_update"> <prop type="string" name="state" arg="@DataConnectorDataTypeCommon_update.state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" arg="$dataConnector.AzureActiveDirectory.properties.tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="AzureAdvancedThreatProtection"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@AlertsDataTypeOfDataConnector_update" name="dataTypes" arg="$dataConnector.AzureAdvancedThreatProtection.properties.dataTypes"/> <prop type="string" name="tenantId" arg="$dataConnector.AzureAdvancedThreatProtection.properties.tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="AzureSecurityCenter"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@AlertsDataTypeOfDataConnector_update" name="dataTypes" arg="$dataConnector.AzureSecurityCenter.properties.dataTypes"/> <prop type="string" name="subscriptionId" arg="$dataConnector.AzureSecurityCenter.properties.subscriptionId"/> </prop> </discriminator> <discriminator property="kind" value="Dynamics365"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" arg="$dataConnector.Dynamics365.properties.dataTypes" required="True"> <prop type="object" name="dynamics365CdsActivities" arg="$dataConnector.Dynamics365.properties.dataTypes.dynamics365CdsActivities" required="True"> <prop type="string" name="state" arg="$dataConnector.Dynamics365.properties.dataTypes.dynamics365CdsActivities.state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" arg="$dataConnector.Dynamics365.properties.tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="GenericUI"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="connectorUiConfig" arg="$dataConnector.GenericUI.properties.connectorUiConfig" cls="CodelessUiConnectorConfigProperties_update"> <prop type="object" name="availability" arg="@CodelessUiConnectorConfigProperties_update.availability" required="True"> <prop type="boolean" name="isPreview" arg="@CodelessUiConnectorConfigProperties_update.availability.isPreview"/> <prop type="integer32" name="status" arg="@CodelessUiConnectorConfigProperties_update.availability.status"> <enum> <item value="1"/> </enum> </prop> </prop> <prop type="array<object>" name="connectivityCriteria" arg="@CodelessUiConnectorConfigProperties_update.connectivityCriteria" required="True"> <item type="object"> <prop type="string" name="type" arg="@CodelessUiConnectorConfigProperties_update.connectivityCriteria[].type"> <enum> <item value=""IsConnectedQuery""/> </enum> </prop> <prop type="array<string>" name="value" arg="@CodelessUiConnectorConfigProperties_update.connectivityCriteria[].value"> <item type="string"/> </prop> </item> </prop> <prop type="string" name="customImage" arg="@CodelessUiConnectorConfigProperties_update.customImage"/> <prop type="array<object>" name="dataTypes" arg="@CodelessUiConnectorConfigProperties_update.dataTypes" required="True"> <item type="object"> <prop type="string" name="lastDataReceivedQuery" arg="@CodelessUiConnectorConfigProperties_update.dataTypes[].lastDataReceivedQuery"/> <prop type="string" name="name" arg="@CodelessUiConnectorConfigProperties_update.dataTypes[].name"/> </item> </prop> <prop type="string" name="descriptionMarkdown" arg="@CodelessUiConnectorConfigProperties_update.descriptionMarkdown" required="True"/> <prop type="array<object>" name="graphQueries" arg="@CodelessUiConnectorConfigProperties_update.graphQueries" required="True"> <item type="object"> <prop type="string" name="baseQuery" arg="@CodelessUiConnectorConfigProperties_update.graphQueries[].baseQuery"/> <prop type="string" name="legend" arg="@CodelessUiConnectorConfigProperties_update.graphQueries[].legend"/> <prop type="string" name="metricName" arg="@CodelessUiConnectorConfigProperties_update.graphQueries[].metricName"/> </item> </prop> <prop type="string" name="graphQueriesTableName" arg="@CodelessUiConnectorConfigProperties_update.graphQueriesTableName" required="True"/> <prop type="array<object>" name="instructionSteps" arg="@CodelessUiConnectorConfigProperties_update.instructionSteps" required="True"> <item type="object"> <prop type="string" name="description" arg="@CodelessUiConnectorConfigProperties_update.instructionSteps[].description"/> <prop type="array<object>" name="instructions" arg="@CodelessUiConnectorConfigProperties_update.instructionSteps[].instructions"> <item type="object"> <prop type="string" name="type" arg="@CodelessUiConnectorConfigProperties_update.instructionSteps[].instructions[].type" required="True"> <enum> <item value=""CopyableLabel""/> <item value=""InfoMessage""/> <item value=""InstructionStepsGroup""/> </enum> </prop> </item> </prop> <prop type="string" name="title" arg="@CodelessUiConnectorConfigProperties_update.instructionSteps[].title"/> </item> </prop> <prop type="object" name="permissions" arg="@CodelessUiConnectorConfigProperties_update.permissions" required="True"> <prop type="array<object>" name="customs" arg="@CodelessUiConnectorConfigProperties_update.permissions.customs"> <item type="object"> <prop type="string" name="description" arg="@CodelessUiConnectorConfigProperties_update.permissions.customs[].description"/> <prop type="string" name="name" arg="@CodelessUiConnectorConfigProperties_update.permissions.customs[].name"/> </item> </prop> <prop type="array<object>" name="resourceProvider" arg="@CodelessUiConnectorConfigProperties_update.permissions.resourceProvider"> <item type="object"> <prop type="string" name="permissionsDisplayText" arg="@CodelessUiConnectorConfigProperties_update.permissions.resourceProvider[].permissionsDisplayText"/> <prop type="string" name="provider" arg="@CodelessUiConnectorConfigProperties_update.permissions.resourceProvider[].provider"> <enum> <item value=""Microsoft.Authorization/policyAssignments""/> <item value=""Microsoft.OperationalInsights/solutions""/> <item value=""Microsoft.OperationalInsights/workspaces""/> <item value=""Microsoft.OperationalInsights/workspaces/datasources""/> <item value=""Microsoft.OperationalInsights/workspaces/sharedKeys""/> <item value=""microsoft.aadiam/diagnosticSettings""/> </enum> </prop> <prop type="string" name="providerDisplayName" arg="@CodelessUiConnectorConfigProperties_update.permissions.resourceProvider[].providerDisplayName"/> <prop type="object" name="requiredPermissions" arg="@CodelessUiConnectorConfigProperties_update.permissions.resourceProvider[].requiredPermissions"> <prop type="boolean" name="action" arg="@CodelessUiConnectorConfigProperties_update.permissions.resourceProvider[].requiredPermissions.action"/> <prop type="boolean" name="delete" arg="@CodelessUiConnectorConfigProperties_update.permissions.resourceProvider[].requiredPermissions.delete"/> <prop type="boolean" name="read" arg="@CodelessUiConnectorConfigProperties_update.permissions.resourceProvider[].requiredPermissions.read"/> <prop type="boolean" name="write" arg="@CodelessUiConnectorConfigProperties_update.permissions.resourceProvider[].requiredPermissions.write"/> </prop> <prop type="string" name="scope" arg="@CodelessUiConnectorConfigProperties_update.permissions.resourceProvider[].scope"> <enum> <item value=""ResourceGroup""/> <item value=""Subscription""/> <item value=""Workspace""/> </enum> </prop> </item> </prop> </prop> <prop type="string" name="publisher" arg="@CodelessUiConnectorConfigProperties_update.publisher" required="True"/> <prop type="array<object>" name="sampleQueries" arg="@CodelessUiConnectorConfigProperties_update.sampleQueries" required="True"> <item type="object"> <prop type="string" name="description" arg="@CodelessUiConnectorConfigProperties_update.sampleQueries[].description"/> <prop type="string" name="query" arg="@CodelessUiConnectorConfigProperties_update.sampleQueries[].query"/> </item> </prop> <prop type="string" name="title" arg="@CodelessUiConnectorConfigProperties_update.title" required="True"/> </prop> </prop> </discriminator> <discriminator property="kind" value="IOT"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@AlertsDataTypeOfDataConnector_update" name="dataTypes" arg="$dataConnector.IOT.properties.dataTypes"/> <prop type="string" name="subscriptionId" arg="$dataConnector.IOT.properties.subscriptionId"/> </prop> </discriminator> <discriminator property="kind" value="MicrosoftCloudAppSecurity"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" arg="$dataConnector.MicrosoftCloudAppSecurity.properties.dataTypes" required="True"> <prop type="@DataConnectorDataTypeCommon_update" name="alerts" arg="$dataConnector.MicrosoftCloudAppSecurity.properties.dataTypes.alerts" required="True"/> <prop type="@DataConnectorDataTypeCommon_update" name="discoveryLogs" arg="$dataConnector.MicrosoftCloudAppSecurity.properties.dataTypes.discoveryLogs"/> </prop> <prop type="string" name="tenantId" arg="$dataConnector.MicrosoftCloudAppSecurity.properties.tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="MicrosoftDefenderAdvancedThreatProtection"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@AlertsDataTypeOfDataConnector_update" name="dataTypes" arg="$dataConnector.MicrosoftDefenderAdvancedThreatProtection.properties.dataTypes"/> <prop type="string" name="tenantId" arg="$dataConnector.MicrosoftDefenderAdvancedThreatProtection.properties.tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="MicrosoftThreatIntelligence"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" arg="$dataConnector.MicrosoftThreatIntelligence.properties.dataTypes" required="True"> <prop type="object" name="bingSafetyPhishingURL" arg="$dataConnector.MicrosoftThreatIntelligence.properties.dataTypes.bingSafetyPhishingURL" required="True"> <prop type="string" name="lookbackPeriod" arg="$dataConnector.MicrosoftThreatIntelligence.properties.dataTypes.bingSafetyPhishingURL.lookbackPeriod" required="True"/> <prop type="string" name="state" arg="$dataConnector.MicrosoftThreatIntelligence.properties.dataTypes.bingSafetyPhishingURL.state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> <prop type="object" name="microsoftEmergingThreatFeed" arg="$dataConnector.MicrosoftThreatIntelligence.properties.dataTypes.microsoftEmergingThreatFeed" required="True"> <prop type="string" name="lookbackPeriod" arg="$dataConnector.MicrosoftThreatIntelligence.properties.dataTypes.microsoftEmergingThreatFeed.lookbackPeriod" required="True"/> <prop type="string" name="state" arg="$dataConnector.MicrosoftThreatIntelligence.properties.dataTypes.microsoftEmergingThreatFeed.state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" arg="$dataConnector.MicrosoftThreatIntelligence.properties.tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="MicrosoftThreatProtection"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" arg="$dataConnector.MicrosoftThreatProtection.properties.dataTypes" required="True"> <prop type="object" name="incidents" arg="$dataConnector.MicrosoftThreatProtection.properties.dataTypes.incidents" required="True"> <prop type="string" name="state" arg="$dataConnector.MicrosoftThreatProtection.properties.dataTypes.incidents.state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" arg="$dataConnector.MicrosoftThreatProtection.properties.tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="Office365"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" arg="$dataConnector.Office365.properties.dataTypes" required="True"> <prop type="object" name="exchange" arg="$dataConnector.Office365.properties.dataTypes.exchange" required="True"> <prop type="string" name="state" arg="$dataConnector.Office365.properties.dataTypes.exchange.state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> <prop type="object" name="sharePoint" arg="$dataConnector.Office365.properties.dataTypes.sharePoint" required="True"> <prop type="string" name="state" arg="$dataConnector.Office365.properties.dataTypes.sharePoint.state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> <prop type="object" name="teams" arg="$dataConnector.Office365.properties.dataTypes.teams" required="True"> <prop type="string" name="state" arg="$dataConnector.Office365.properties.dataTypes.teams.state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" arg="$dataConnector.Office365.properties.tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="Office365Project"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" arg="$dataConnector.Office365Project.properties.dataTypes" required="True"> <prop type="object" name="logs" arg="$dataConnector.Office365Project.properties.dataTypes.logs" required="True"> <prop type="string" name="state" arg="$dataConnector.Office365Project.properties.dataTypes.logs.state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" arg="$dataConnector.Office365Project.properties.tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="OfficeATP"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@AlertsDataTypeOfDataConnector_update" name="dataTypes" arg="$dataConnector.OfficeATP.properties.dataTypes"/> <prop type="string" name="tenantId" arg="$dataConnector.OfficeATP.properties.tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="OfficeIRM"> <prop type="object" name="properties" clientFlatten="True"> <prop type="@AlertsDataTypeOfDataConnector_update" name="dataTypes" arg="$dataConnector.OfficeIRM.properties.dataTypes"/> <prop type="string" name="tenantId" arg="$dataConnector.OfficeIRM.properties.tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="OfficePowerBI"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" arg="$dataConnector.OfficePowerBI.properties.dataTypes" required="True"> <prop type="object" name="logs" arg="$dataConnector.OfficePowerBI.properties.dataTypes.logs" required="True"> <prop type="string" name="state" arg="$dataConnector.OfficePowerBI.properties.dataTypes.logs.state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" arg="$dataConnector.OfficePowerBI.properties.tenantId" required="True"/> </prop> </discriminator> <discriminator property="kind" value="ThreatIntelligence"> <prop type="object" name="properties" clientFlatten="True"> <prop type="object" name="dataTypes" arg="$dataConnector.ThreatIntelligence.properties.dataTypes" required="True"> <prop type="object" name="indicators" arg="$dataConnector.ThreatIntelligence.properties.dataTypes.indicators" required="True"> <prop type="string" name="state" arg="$dataConnector.ThreatIntelligence.properties.dataTypes.indicators.state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="tenantId" arg="$dataConnector.ThreatIntelligence.properties.tenantId" required="True"/> <prop nullable="True" type="dateTime" name="tipLookbackPeriod" arg="$dataConnector.ThreatIntelligence.properties.tipLookbackPeriod"/> </prop> </discriminator> <discriminator property="kind" value="ThreatIntelligenceTaxii"> <prop type="object" name="properties" clientFlatten="True"> <prop type="string" name="collectionId" arg="$dataConnector.ThreatIntelligenceTaxii.properties.collectionId"/> <prop type="object" name="dataTypes" arg="$dataConnector.ThreatIntelligenceTaxii.properties.dataTypes" required="True"> <prop type="object" name="taxiiClient" arg="$dataConnector.ThreatIntelligenceTaxii.properties.dataTypes.taxiiClient" required="True"> <prop type="string" name="state" arg="$dataConnector.ThreatIntelligenceTaxii.properties.dataTypes.taxiiClient.state" required="True"> <enum> <item value=""Disabled""/> <item value=""Enabled""/> </enum> </prop> </prop> </prop> <prop type="string" name="friendlyName" arg="$dataConnector.ThreatIntelligenceTaxii.properties.friendlyName"/> <prop type="string" name="password" arg="$dataConnector.ThreatIntelligenceTaxii.properties.password"/> <prop nullable="True" type="string" name="pollingFrequency" arg="$dataConnector.ThreatIntelligenceTaxii.properties.pollingFrequency" required="True"> <enum> <item value=""OnceADay""/> <item value=""OnceAMinute""/> <item value=""OnceAnHour""/> </enum> </prop> <prop nullable="True" type="dateTime" name="taxiiLookbackPeriod" arg="$dataConnector.ThreatIntelligenceTaxii.properties.taxiiLookbackPeriod"/> <prop type="string" name="taxiiServer" arg="$dataConnector.ThreatIntelligenceTaxii.properties.taxiiServer"/> <prop type="string" name="tenantId" arg="$dataConnector.ThreatIntelligenceTaxii.properties.tenantId" required="True"/> <prop type="string" name="userName" arg="$dataConnector.ThreatIntelligenceTaxii.properties.userName"/> <prop type="string" name="workspaceId" arg="$dataConnector.ThreatIntelligenceTaxii.properties.workspaceId"/> </prop> </discriminator> </schema> </json> </instanceUpdate> </operation> <operation operationId="DataConnectors_CreateOrUpdate"> <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors/{dataConnectorId}"> <request method="put"> <path> <param type="string" name="dataConnectorId" arg="$Path.dataConnectorId" required="True"/> <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True"> <format maxLength="90" minLength="1"/> </param> <param type="string" name="subscriptionId" arg="$Path.subscriptionId" required="True"> <format minLength="1"/> </param> <param type="string" name="workspaceName" arg="$Path.workspaceName" required="True"> <format maxLength="90" minLength="1"/> </param> </path> <query> <const readOnly="True" const="True" type="string" name="api-version" required="True"> <default value=""2022-06-01-preview""/> <format minLength="1"/> </const> </query> <body> <json ref="$Instance"/> </body> </request> <response statusCode="200 201"> <body> <json var="$Instance"> <schema type="@DataConnector_read"/> </json> </body> </response> <response isError="True"> <body> <json> <schema type="@ODataV4Format"/> </json> </body> </response> </http> </operation> <output type="object" ref="$Instance" clientFlatten="True"/> </command> </commandGroup> </CodeGen>

Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5vcGVyYXRpb25hbGluc2lnaHRzL3dvcmtzcGFjZXMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5zZWN1cml0eWluc2lnaHRzL2RhdGFjb25uZWN0b3JzL3t9/2022-06-01-preview.xml (3,800 lines of code) (raw):