Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5vcGVyYXRpb25hbGluc2lnaHRzL3dvcmtzcGFjZXMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5zZWN1cml0eWluc2lnaHRzL3NldHRpbmdzL3t9/2022-06-01-preview.xml (614 lines of code) (raw):

<?xml version='1.0' encoding='utf-8'?> <CodeGen plane="mgmt-plane"> <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.operationalinsights/workspaces/{}/providers/microsoft.securityinsights/settings/{}" version="2022-06-01-preview" swagger="mgmt-plane/securityinsights/ResourceProviders/Microsoft.SecurityInsights/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuT3BlcmF0aW9uYWxJbnNpZ2h0cy93b3Jrc3BhY2VzL3t3b3Jrc3BhY2VOYW1lfS9wcm92aWRlcnMvTWljcm9zb2Z0LlNlY3VyaXR5SW5zaWdodHMvc2V0dGluZ3Mve3NldHRpbmdzTmFtZX0=/V/MjAyMi0wNi0wMS1wcmV2aWV3"/> <commandGroup name="sentinel setting"> <command name="show" version="2022-06-01-preview"> <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.operationalinsights/workspaces/{}/providers/microsoft.securityinsights/settings/{}" version="2022-06-01-preview" swagger="mgmt-plane/securityinsights/ResourceProviders/Microsoft.SecurityInsights/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuT3BlcmF0aW9uYWxJbnNpZ2h0cy93b3Jrc3BhY2VzL3t3b3Jrc3BhY2VOYW1lfS9wcm92aWRlcnMvTWljcm9zb2Z0LlNlY3VyaXR5SW5zaWdodHMvc2V0dGluZ3Mve3NldHRpbmdzTmFtZX0=/V/MjAyMi0wNi0wMS1wcmV2aWV3"/> <argGroup name=""> <arg type="ResourceGroupName" var="$Path.resourceGroupName" options="resource-group g" required="True" idPart="resource_group"/> <arg type="string" var="$Path.settingsName" options="settings-name name n" required="True" idPart="child_name_1"> <help short="The setting name. Supports - Anomalies, EyesOn, EntityAnalytics, Ueba"/> </arg> <arg type="SubscriptionId" var="$Path.subscriptionId" options="subscription" required="True" idPart="subscription"/> <arg type="string" var="$Path.workspaceName" options="workspace-name w" required="True" stage="Experimental" idPart="name"> <help short="The name of the workspace."/> <format maxLength="90" minLength="1"/> </arg> </argGroup> <operation operationId="ProductSettings_Get"> <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/settings/{settingsName}"> <request method="get"> <path> <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True"> <format maxLength="90" minLength="1"/> </param> <param type="string" name="settingsName" arg="$Path.settingsName" required="True"/> <param type="string" name="subscriptionId" arg="$Path.subscriptionId" required="True"> <format minLength="1"/> </param> <param type="string" name="workspaceName" arg="$Path.workspaceName" required="True"> <format maxLength="90" minLength="1"/> </param> </path> <query> <const readOnly="True" const="True" type="string" name="api-version" required="True"> <default value="&quot;2022-06-01-preview&quot;"/> <format minLength="1"/> </const> </query> </request> <response statusCode="200"> <body> <json var="$Instance"> <schema type="object"> <prop type="string" name="etag"/> <prop readOnly="True" type="ResourceId" name="id"> <format template="/subscriptions/{}/resourceGroups/{}/providers/Microsoft.OperationalInsights/workspaces/{}/providers/Microsoft.SecurityInsights/settings/{}"/> </prop> <prop type="string" name="kind" required="True"> <enum> <item value="&quot;Anomalies&quot;"/> <item value="&quot;EntityAnalytics&quot;"/> <item value="&quot;EyesOn&quot;"/> <item value="&quot;Ueba&quot;"/> </enum> </prop> <prop readOnly="True" type="string" name="name"/> <prop readOnly="True" type="object" name="systemData"> <prop readOnly="True" type="dateTime" name="createdAt"/> <prop readOnly="True" type="string" name="createdBy"/> <prop readOnly="True" type="string" name="createdByType"> <enum> <item value="&quot;Application&quot;"/> <item value="&quot;Key&quot;"/> <item value="&quot;ManagedIdentity&quot;"/> <item value="&quot;User&quot;"/> </enum> </prop> <prop readOnly="True" type="dateTime" name="lastModifiedAt"/> <prop readOnly="True" type="string" name="lastModifiedBy"/> <prop readOnly="True" type="string" name="lastModifiedByType"> <enum> <item value="&quot;Application&quot;"/> <item value="&quot;Key&quot;"/> <item value="&quot;ManagedIdentity&quot;"/> <item value="&quot;User&quot;"/> </enum> </prop> </prop> <prop readOnly="True" type="string" name="type"/> <discriminator property="kind" value="Anomalies"> <prop type="object" name="properties" clientFlatten="True"> <prop readOnly="True" type="boolean" name="isEnabled"/> </prop> </discriminator> <discriminator property="kind" value="EntityAnalytics"> <prop type="object" name="properties" clientFlatten="True"> <prop type="array<string>" name="entityProviders"> <item type="string"> <enum> <item value="&quot;ActiveDirectory&quot;"/> <item value="&quot;AzureActiveDirectory&quot;"/> </enum> </item> </prop> </prop> </discriminator> <discriminator property="kind" value="EyesOn"> <prop type="object" name="properties" clientFlatten="True"> <prop readOnly="True" type="boolean" name="isEnabled"/> </prop> </discriminator> <discriminator property="kind" value="Ueba"> <prop type="object" name="properties" clientFlatten="True"> <prop type="array<string>" name="dataSources"> <item type="string"> <enum> <item value="&quot;AuditLogs&quot;"/> <item value="&quot;AzureActivity&quot;"/> <item value="&quot;SecurityEvent&quot;"/> <item value="&quot;SigninLogs&quot;"/> </enum> </item> </prop> </prop> </discriminator> </schema> </json> </body> </response> <response isError="True"> <body> <json> <schema type="@ODataV4Format"/> </json> </body> </response> </http> </operation> <output type="object" ref="$Instance" clientFlatten="True"/> </command> <command name="delete" version="2022-06-01-preview" confirmation="Are you sure you want to perform this operation?"> <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.operationalinsights/workspaces/{}/providers/microsoft.securityinsights/settings/{}" version="2022-06-01-preview" swagger="mgmt-plane/securityinsights/ResourceProviders/Microsoft.SecurityInsights/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuT3BlcmF0aW9uYWxJbnNpZ2h0cy93b3Jrc3BhY2VzL3t3b3Jrc3BhY2VOYW1lfS9wcm92aWRlcnMvTWljcm9zb2Z0LlNlY3VyaXR5SW5zaWdodHMvc2V0dGluZ3Mve3NldHRpbmdzTmFtZX0=/V/MjAyMi0wNi0wMS1wcmV2aWV3"/> <argGroup name=""> <arg type="ResourceGroupName" var="$Path.resourceGroupName" options="resource-group g" required="True" idPart="resource_group"/> <arg type="string" var="$Path.settingsName" options="settings-name name n" required="True" idPart="child_name_1"> <help short="The setting name. Supports - Anomalies, EyesOn, EntityAnalytics, Ueba"/> </arg> <arg type="SubscriptionId" var="$Path.subscriptionId" options="subscription" required="True" idPart="subscription"/> <arg type="string" var="$Path.workspaceName" options="workspace-name w" required="True" stage="Experimental" idPart="name"> <help short="The name of the workspace."/> <format maxLength="90" minLength="1"/> </arg> </argGroup> <operation operationId="ProductSettings_Delete"> <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/settings/{settingsName}"> <request method="delete"> <path> <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True"> <format maxLength="90" minLength="1"/> </param> <param type="string" name="settingsName" arg="$Path.settingsName" required="True"/> <param type="string" name="subscriptionId" arg="$Path.subscriptionId" required="True"> <format minLength="1"/> </param> <param type="string" name="workspaceName" arg="$Path.workspaceName" required="True"> <format maxLength="90" minLength="1"/> </param> </path> <query> <const readOnly="True" const="True" type="string" name="api-version" required="True"> <default value="&quot;2022-06-01-preview&quot;"/> <format minLength="1"/> </const> </query> </request> <response statusCode="200"/> <response statusCode="204"/> <response isError="True"> <body> <json> <schema type="@ODataV4Format"/> </json> </body> </response> </http> </operation> </command> <command name="create" version="2022-06-01-preview"> <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.operationalinsights/workspaces/{}/providers/microsoft.securityinsights/settings/{}" version="2022-06-01-preview" swagger="mgmt-plane/securityinsights/ResourceProviders/Microsoft.SecurityInsights/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuT3BlcmF0aW9uYWxJbnNpZ2h0cy93b3Jrc3BhY2VzL3t3b3Jrc3BhY2VOYW1lfS9wcm92aWRlcnMvTWljcm9zb2Z0LlNlY3VyaXR5SW5zaWdodHMvc2V0dGluZ3Mve3NldHRpbmdzTmFtZX0=/V/MjAyMi0wNi0wMS1wcmV2aWV3"/> <argGroup name=""> <arg type="ResourceGroupName" var="$Path.resourceGroupName" options="resource-group g" required="True" idPart="resource_group"/> <arg type="string" var="$Path.settingsName" options="settings-name name n" required="True" idPart="child_name_1"> <help short="The setting name. Supports - Anomalies, EyesOn, EntityAnalytics, Ueba"/> </arg> <arg type="SubscriptionId" var="$Path.subscriptionId" options="subscription" required="True" idPart="subscription"/> <arg type="string" var="$Path.workspaceName" options="workspace-name w" required="True" stage="Experimental" idPart="name"> <help short="The name of the workspace."/> <format maxLength="90" minLength="1"/> </arg> </argGroup> <argGroup name="Settings"> <arg type="object" var="$settings.EntityAnalytics" options="entity-analytics" group="Settings"> <arg type="array<string>" var="$settings.EntityAnalytics.properties.entityProviders" options="entity-providers" group="Properties"> <help short="The relevant entity providers that are synced"/> <item type="string"> <enum> <item name="ActiveDirectory" value="&quot;ActiveDirectory&quot;"/> <item name="AzureActiveDirectory" value="&quot;AzureActiveDirectory&quot;"/> </enum> </item> </arg> </arg> <arg type="object" var="$settings.Ueba" options="ueba" group="Settings"> <arg type="array<string>" var="$settings.Ueba.properties.dataSources" options="data-sources" group="Properties"> <help short="The relevant data sources that enriched by ueba"/> <item type="string"> <enum> <item name="AuditLogs" value="&quot;AuditLogs&quot;"/> <item name="AzureActivity" value="&quot;AzureActivity&quot;"/> <item name="SecurityEvent" value="&quot;SecurityEvent&quot;"/> <item name="SigninLogs" value="&quot;SigninLogs&quot;"/> </enum> </item> </arg> </arg> <arg type="string" var="$settings.etag" options="etag" group="Settings"> <help short="Etag of the azure resource"/> </arg> </argGroup> <operation operationId="ProductSettings_Update"> <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/settings/{settingsName}"> <request method="put"> <path> <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True"> <format maxLength="90" minLength="1"/> </param> <param type="string" name="settingsName" arg="$Path.settingsName" required="True"/> <param type="string" name="subscriptionId" arg="$Path.subscriptionId" required="True"> <format minLength="1"/> </param> <param type="string" name="workspaceName" arg="$Path.workspaceName" required="True"> <format maxLength="90" minLength="1"/> </param> </path> <query> <const readOnly="True" const="True" type="string" name="api-version" required="True"> <default value="&quot;2022-06-01-preview&quot;"/> <format minLength="1"/> </const> </query> <body> <json> <schema type="object" name="settings" required="True" clientFlatten="True"> <prop type="string" name="etag" arg="$settings.etag"/> <prop type="string" name="kind" required="True"> <enum> <item value="&quot;Anomalies&quot;"/> <item arg="$settings.EntityAnalytics" value="&quot;EntityAnalytics&quot;"/> <item value="&quot;EyesOn&quot;"/> <item arg="$settings.Ueba" value="&quot;Ueba&quot;"/> </enum> </prop> <discriminator property="kind" value="EntityAnalytics"> <prop type="object" name="properties" clientFlatten="True"> <prop type="array<string>" name="entityProviders" arg="$settings.EntityAnalytics.properties.entityProviders"> <item type="string"> <enum> <item value="&quot;ActiveDirectory&quot;"/> <item value="&quot;AzureActiveDirectory&quot;"/> </enum> </item> </prop> </prop> </discriminator> <discriminator property="kind" value="Ueba"> <prop type="object" name="properties" clientFlatten="True"> <prop type="array<string>" name="dataSources" arg="$settings.Ueba.properties.dataSources"> <item type="string"> <enum> <item value="&quot;AuditLogs&quot;"/> <item value="&quot;AzureActivity&quot;"/> <item value="&quot;SecurityEvent&quot;"/> <item value="&quot;SigninLogs&quot;"/> </enum> </item> </prop> </prop> </discriminator> </schema> </json> </body> </request> <response statusCode="200"> <body> <json var="$Instance"> <schema type="object"> <prop type="string" name="etag"/> <prop readOnly="True" type="ResourceId" name="id"> <format template="/subscriptions/{}/resourceGroups/{}/providers/Microsoft.OperationalInsights/workspaces/{}/providers/Microsoft.SecurityInsights/settings/{}"/> </prop> <prop type="string" name="kind" required="True"> <enum> <item value="&quot;Anomalies&quot;"/> <item value="&quot;EntityAnalytics&quot;"/> <item value="&quot;EyesOn&quot;"/> <item value="&quot;Ueba&quot;"/> </enum> </prop> <prop readOnly="True" type="string" name="name"/> <prop readOnly="True" type="object" name="systemData"> <prop readOnly="True" type="dateTime" name="createdAt"/> <prop readOnly="True" type="string" name="createdBy"/> <prop readOnly="True" type="string" name="createdByType"> <enum> <item value="&quot;Application&quot;"/> <item value="&quot;Key&quot;"/> <item value="&quot;ManagedIdentity&quot;"/> <item value="&quot;User&quot;"/> </enum> </prop> <prop readOnly="True" type="dateTime" name="lastModifiedAt"/> <prop readOnly="True" type="string" name="lastModifiedBy"/> <prop readOnly="True" type="string" name="lastModifiedByType"> <enum> <item value="&quot;Application&quot;"/> <item value="&quot;Key&quot;"/> <item value="&quot;ManagedIdentity&quot;"/> <item value="&quot;User&quot;"/> </enum> </prop> </prop> <prop readOnly="True" type="string" name="type"/> <discriminator property="kind" value="Anomalies"> <prop type="object" name="properties" clientFlatten="True"> <prop readOnly="True" type="boolean" name="isEnabled"/> </prop> </discriminator> <discriminator property="kind" value="EntityAnalytics"> <prop type="object" name="properties" clientFlatten="True"> <prop type="array<string>" name="entityProviders"> <item type="string"> <enum> <item value="&quot;ActiveDirectory&quot;"/> <item value="&quot;AzureActiveDirectory&quot;"/> </enum> </item> </prop> </prop> </discriminator> <discriminator property="kind" value="EyesOn"> <prop type="object" name="properties" clientFlatten="True"> <prop readOnly="True" type="boolean" name="isEnabled"/> </prop> </discriminator> <discriminator property="kind" value="Ueba"> <prop type="object" name="properties" clientFlatten="True"> <prop type="array<string>" name="dataSources"> <item type="string"> <enum> <item value="&quot;AuditLogs&quot;"/> <item value="&quot;AzureActivity&quot;"/> <item value="&quot;SecurityEvent&quot;"/> <item value="&quot;SigninLogs&quot;"/> </enum> </item> </prop> </prop> </discriminator> </schema> </json> </body> </response> <response isError="True"> <body> <json> <schema type="@ODataV4Format"/> </json> </body> </response> </http> </operation> <output type="object" ref="$Instance" clientFlatten="True"/> </command> <command name="update" version="2022-06-01-preview"> <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.operationalinsights/workspaces/{}/providers/microsoft.securityinsights/settings/{}" version="2022-06-01-preview" swagger="mgmt-plane/securityinsights/ResourceProviders/Microsoft.SecurityInsights/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuT3BlcmF0aW9uYWxJbnNpZ2h0cy93b3Jrc3BhY2VzL3t3b3Jrc3BhY2VOYW1lfS9wcm92aWRlcnMvTWljcm9zb2Z0LlNlY3VyaXR5SW5zaWdodHMvc2V0dGluZ3Mve3NldHRpbmdzTmFtZX0=/V/MjAyMi0wNi0wMS1wcmV2aWV3"/> <argGroup name=""> <arg type="ResourceGroupName" var="$Path.resourceGroupName" options="resource-group g" required="True" idPart="resource_group"/> <arg type="string" var="$Path.settingsName" options="settings-name name n" required="True" idPart="child_name_1"> <help short="The setting name. Supports - Anomalies, EyesOn, EntityAnalytics, Ueba"/> </arg> <arg type="SubscriptionId" var="$Path.subscriptionId" options="subscription" required="True" idPart="subscription"/> <arg type="string" var="$Path.workspaceName" options="workspace-name w" required="True" stage="Experimental" idPart="name"> <help short="The name of the workspace."/> <format maxLength="90" minLength="1"/> </arg> </argGroup> <argGroup name="Settings"> <arg type="object" var="$settings.EntityAnalytics" options="entity-analytics" group="Settings"> <arg nullable="True" type="array<string>" var="$settings.EntityAnalytics.properties.entityProviders" options="entity-providers" group="Properties"> <help short="The relevant entity providers that are synced"/> <item type="string"> <enum> <item name="ActiveDirectory" value="&quot;ActiveDirectory&quot;"/> <item name="AzureActiveDirectory" value="&quot;AzureActiveDirectory&quot;"/> </enum> </item> </arg> </arg> <arg type="object" var="$settings.Ueba" options="ueba" group="Settings"> <arg nullable="True" type="array<string>" var="$settings.Ueba.properties.dataSources" options="data-sources" group="Properties"> <help short="The relevant data sources that enriched by ueba"/> <item type="string"> <enum> <item name="AuditLogs" value="&quot;AuditLogs&quot;"/> <item name="AzureActivity" value="&quot;AzureActivity&quot;"/> <item name="SecurityEvent" value="&quot;SecurityEvent&quot;"/> <item name="SigninLogs" value="&quot;SigninLogs&quot;"/> </enum> </item> </arg> </arg> <arg nullable="True" type="string" var="$settings.etag" options="etag" group="Settings"> <help short="Etag of the azure resource"/> </arg> </argGroup> <operation operationId="ProductSettings_Get"> <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/settings/{settingsName}"> <request method="get"> <path> <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True"> <format maxLength="90" minLength="1"/> </param> <param type="string" name="settingsName" arg="$Path.settingsName" required="True"/> <param type="string" name="subscriptionId" arg="$Path.subscriptionId" required="True"> <format minLength="1"/> </param> <param type="string" name="workspaceName" arg="$Path.workspaceName" required="True"> <format maxLength="90" minLength="1"/> </param> </path> <query> <const readOnly="True" const="True" type="string" name="api-version" required="True"> <default value="&quot;2022-06-01-preview&quot;"/> <format minLength="1"/> </const> </query> </request> <response statusCode="200"> <body> <json var="$Instance"> <schema type="object" cls="Settings_read"> <prop type="string" name="etag"/> <prop readOnly="True" type="ResourceId" name="id"> <format template="/subscriptions/{}/resourceGroups/{}/providers/Microsoft.OperationalInsights/workspaces/{}/providers/Microsoft.SecurityInsights/settings/{}"/> </prop> <prop type="string" name="kind" required="True"> <enum> <item value="&quot;Anomalies&quot;"/> <item value="&quot;EntityAnalytics&quot;"/> <item value="&quot;EyesOn&quot;"/> <item value="&quot;Ueba&quot;"/> </enum> </prop> <prop readOnly="True" type="string" name="name"/> <prop readOnly="True" type="object" name="systemData"> <prop readOnly="True" type="dateTime" name="createdAt"/> <prop readOnly="True" type="string" name="createdBy"/> <prop readOnly="True" type="string" name="createdByType"> <enum> <item value="&quot;Application&quot;"/> <item value="&quot;Key&quot;"/> <item value="&quot;ManagedIdentity&quot;"/> <item value="&quot;User&quot;"/> </enum> </prop> <prop readOnly="True" type="dateTime" name="lastModifiedAt"/> <prop readOnly="True" type="string" name="lastModifiedBy"/> <prop readOnly="True" type="string" name="lastModifiedByType"> <enum> <item value="&quot;Application&quot;"/> <item value="&quot;Key&quot;"/> <item value="&quot;ManagedIdentity&quot;"/> <item value="&quot;User&quot;"/> </enum> </prop> </prop> <prop readOnly="True" type="string" name="type"/> <discriminator property="kind" value="Anomalies"> <prop type="object" name="properties" clientFlatten="True"> <prop readOnly="True" type="boolean" name="isEnabled"/> </prop> </discriminator> <discriminator property="kind" value="EntityAnalytics"> <prop type="object" name="properties" clientFlatten="True"> <prop type="array<string>" name="entityProviders"> <item type="string"> <enum> <item value="&quot;ActiveDirectory&quot;"/> <item value="&quot;AzureActiveDirectory&quot;"/> </enum> </item> </prop> </prop> </discriminator> <discriminator property="kind" value="EyesOn"> <prop type="object" name="properties" clientFlatten="True"> <prop readOnly="True" type="boolean" name="isEnabled"/> </prop> </discriminator> <discriminator property="kind" value="Ueba"> <prop type="object" name="properties" clientFlatten="True"> <prop type="array<string>" name="dataSources"> <item type="string"> <enum> <item value="&quot;AuditLogs&quot;"/> <item value="&quot;AzureActivity&quot;"/> <item value="&quot;SecurityEvent&quot;"/> <item value="&quot;SigninLogs&quot;"/> </enum> </item> </prop> </prop> </discriminator> </schema> </json> </body> </response> <response isError="True"> <body> <json> <schema type="@ODataV4Format"/> </json> </body> </response> </http> </operation> <operation> <instanceUpdate instance="$Instance"> <json> <schema type="object" name="settings" required="True" clientFlatten="True"> <prop type="string" name="etag" arg="$settings.etag"/> <prop type="string" name="kind" required="True"> <enum> <item value="&quot;Anomalies&quot;"/> <item arg="$settings.EntityAnalytics" value="&quot;EntityAnalytics&quot;"/> <item value="&quot;EyesOn&quot;"/> <item arg="$settings.Ueba" value="&quot;Ueba&quot;"/> </enum> </prop> <discriminator property="kind" value="EntityAnalytics"> <prop type="object" name="properties" clientFlatten="True"> <prop type="array<string>" name="entityProviders" arg="$settings.EntityAnalytics.properties.entityProviders"> <item type="string"> <enum> <item value="&quot;ActiveDirectory&quot;"/> <item value="&quot;AzureActiveDirectory&quot;"/> </enum> </item> </prop> </prop> </discriminator> <discriminator property="kind" value="Ueba"> <prop type="object" name="properties" clientFlatten="True"> <prop type="array<string>" name="dataSources" arg="$settings.Ueba.properties.dataSources"> <item type="string"> <enum> <item value="&quot;AuditLogs&quot;"/> <item value="&quot;AzureActivity&quot;"/> <item value="&quot;SecurityEvent&quot;"/> <item value="&quot;SigninLogs&quot;"/> </enum> </item> </prop> </prop> </discriminator> </schema> </json> </instanceUpdate> </operation> <operation operationId="ProductSettings_Update"> <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/settings/{settingsName}"> <request method="put"> <path> <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True"> <format maxLength="90" minLength="1"/> </param> <param type="string" name="settingsName" arg="$Path.settingsName" required="True"/> <param type="string" name="subscriptionId" arg="$Path.subscriptionId" required="True"> <format minLength="1"/> </param> <param type="string" name="workspaceName" arg="$Path.workspaceName" required="True"> <format maxLength="90" minLength="1"/> </param> </path> <query> <const readOnly="True" const="True" type="string" name="api-version" required="True"> <default value="&quot;2022-06-01-preview&quot;"/> <format minLength="1"/> </const> </query> <body> <json ref="$Instance"/> </body> </request> <response statusCode="200"> <body> <json var="$Instance"> <schema type="@Settings_read"/> </json> </body> </response> <response isError="True"> <body> <json> <schema type="@ODataV4Format"/> </json> </body> </response> </http> </operation> <output type="object" ref="$Instance" clientFlatten="True"/> </command> </commandGroup> </CodeGen>