Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5vcGVyYXRpb25hbGluc2lnaHRzL3dvcmtzcGFjZXMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5zZWN1cml0eWluc2lnaHRzL3RocmVhdGludGVsbGlnZW5jZS9tYWluL2luZGljYXRvcnMve30vcmVwbGFjZXRhZ3M=/2022-06-01-preview.xml

<?xml version='1.0' encoding='utf-8'?> <CodeGen plane="mgmt-plane"> <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.operationalinsights/workspaces/{}/providers/microsoft.securityinsights/threatintelligence/main/indicators/{}/replacetags" version="2022-06-01-preview" swagger="mgmt-plane/securityinsights/ResourceProviders/Microsoft.SecurityInsights/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuT3BlcmF0aW9uYWxJbnNpZ2h0cy93b3Jrc3BhY2VzL3t3b3Jrc3BhY2VOYW1lfS9wcm92aWRlcnMvTWljcm9zb2Z0LlNlY3VyaXR5SW5zaWdodHMvdGhyZWF0SW50ZWxsaWdlbmNlL21haW4vaW5kaWNhdG9ycy97bmFtZX0vcmVwbGFjZVRhZ3M=/V/MjAyMi0wNi0wMS1wcmV2aWV3"/> <commandGroup name="sentinel threat-indicator"> <command name="replace-tag" version="2022-06-01-preview"> <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.operationalinsights/workspaces/{}/providers/microsoft.securityinsights/threatintelligence/main/indicators/{}/replacetags" version="2022-06-01-preview" swagger="mgmt-plane/securityinsights/ResourceProviders/Microsoft.SecurityInsights/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuT3BlcmF0aW9uYWxJbnNpZ2h0cy93b3Jrc3BhY2VzL3t3b3Jrc3BhY2VOYW1lfS9wcm92aWRlcnMvTWljcm9zb2Z0LlNlY3VyaXR5SW5zaWdodHMvdGhyZWF0SW50ZWxsaWdlbmNlL21haW4vaW5kaWNhdG9ycy97bmFtZX0vcmVwbGFjZVRhZ3M=/V/MjAyMi0wNi0wMS1wcmV2aWV3"/> <argGroup name=""> <arg type="string" var="$Path.name" options="name" required="True"> <help short="Threat intelligence indicator name field."/> </arg> <arg type="ResourceGroupName" var="$Path.resourceGroupName" options="resource-group g" required="True"/> <arg type="SubscriptionId" var="$Path.subscriptionId" options="subscription" required="True"/> <arg type="string" var="$Path.workspaceName" options="workspace-name w" required="True" stage="Experimental"> <help short="The name of the workspace."/> <format maxLength="90" minLength="1"/> </arg> </argGroup> <argGroup name="Properties"> <arg type="integer32" var="$ThreatIntelligenceReplaceTags.properties.confidence" options="confidence" group="Properties"> <help short="Confidence of threat intelligence entity"/> </arg> <arg type="string" var="$ThreatIntelligenceReplaceTags.properties.created" options="created" group="Properties"> <help short="Created by"/> </arg> <arg type="string" var="$ThreatIntelligenceReplaceTags.properties.createdByRef" options="created-by-ref" group="Properties"> <help short="Created by reference of threat intelligence entity"/> </arg> <arg type="boolean" var="$ThreatIntelligenceReplaceTags.properties.defanged" options="defanged" group="Properties"> <help short="Is threat intelligence entity defanged"/> </arg> <arg type="string" var="$ThreatIntelligenceReplaceTags.properties.description" options="description" group="Properties"> <help short="Description of a threat intelligence entity"/> </arg> <arg type="string" var="$ThreatIntelligenceReplaceTags.properties.displayName" options="display-name" group="Properties"> <help short="Display name of a threat intelligence entity"/> </arg> <arg type="string" var="$ThreatIntelligenceReplaceTags.properties.externalId" options="external-id" group="Properties"> <help short="External ID of threat intelligence entity"/> </arg> <arg type="string" var="$ThreatIntelligenceReplaceTags.properties.externalLastUpdatedTimeUtc" options="external-updated-time" group="Properties"> <help short="External last updated time in UTC"/> </arg> <arg type="array<object>" var="$ThreatIntelligenceReplaceTags.properties.externalReferences" options="external-references" group="Properties"> <help short="External References"/> <item type="object"> <arg type="string" var="$ThreatIntelligenceReplaceTags.properties.externalReferences[].description" options="description"> <help short="External reference description"/> </arg> <arg type="string" var="$ThreatIntelligenceReplaceTags.properties.externalReferences[].externalId" options="external-id"> <help short="External reference ID"/> </arg> <arg type="object" var="$ThreatIntelligenceReplaceTags.properties.externalReferences[].hashes" options="hashes"> <help short="External reference hashes"/> <additionalProp> <item type="string"/> </additionalProp> </arg> <arg type="string" var="$ThreatIntelligenceReplaceTags.properties.externalReferences[].sourceName" options="source-name"> <help short="External reference source name"/> </arg> <arg type="string" var="$ThreatIntelligenceReplaceTags.properties.externalReferences[].url" options="url"> <help short="External reference URL"/> </arg> </item> </arg> <arg type="array<object>" var="$ThreatIntelligenceReplaceTags.properties.granularMarkings" options="granular-markings" group="Properties"> <help short="Granular Markings"/> <item type="object"> <arg type="string" var="$ThreatIntelligenceReplaceTags.properties.granularMarkings[].language" options="language"> <help short="Language granular marking model"/> </arg> <arg type="integer32" var="$ThreatIntelligenceReplaceTags.properties.granularMarkings[].markingRef" options="marking-ref"> <help short="marking reference granular marking model"/> </arg> <arg type="array<string>" var="$ThreatIntelligenceReplaceTags.properties.granularMarkings[].selectors" options="selectors"> <help short="granular marking model selectors"/> <item type="string"/> </arg> </item> </arg> <arg type="array<string>" var="$ThreatIntelligenceReplaceTags.properties.indicatorTypes" options="indicator-types" group="Properties"> <help short="Indicator types of threat intelligence entities"/> <item type="string"/> </arg> <arg type="array<object>" var="$ThreatIntelligenceReplaceTags.properties.killChainPhases" options="kill-chain-phases" group="Properties"> <help short="Kill chain phases"/> <item type="object"> <arg type="string" var="$ThreatIntelligenceReplaceTags.properties.killChainPhases[].killChainName" options="kill-chain-name"> <help short="Kill chainName name"/> </arg> <arg type="string" var="$ThreatIntelligenceReplaceTags.properties.killChainPhases[].phaseName" options="phase-name"> <help short="Phase name"/> </arg> </item> </arg> <arg type="array<string>" var="$ThreatIntelligenceReplaceTags.properties.labels" options="labels" group="Properties"> <help short="Labels of threat intelligence entity"/> <item type="string"/> </arg> <arg type="string" var="$ThreatIntelligenceReplaceTags.properties.language" options="language" group="Properties"> <help short="Language of threat intelligence entity"/> </arg> <arg type="string" var="$ThreatIntelligenceReplaceTags.properties.lastUpdatedTimeUtc" options="last-updated-time" group="Properties"> <help short="Last updated time in UTC"/> </arg> <arg type="string" var="$ThreatIntelligenceReplaceTags.properties.modified" options="modified" group="Properties"> <help short="Modified by"/> </arg> <arg type="array<string>" var="$ThreatIntelligenceReplaceTags.properties.objectMarkingRefs" options="object-marking-refs" group="Properties"> <help short="Threat intelligence entity object marking references"/> <item type="string"/> </arg> <arg type="array<object>" var="$ThreatIntelligenceReplaceTags.properties.parsedPattern" options="parsed-pattern" group="Properties"> <help short="Parsed patterns"/> <item type="object"> <arg type="string" var="$ThreatIntelligenceReplaceTags.properties.parsedPattern[].patternTypeKey" options="pattern-type-key"> <help short="Pattern type key"/> </arg> <arg type="array<object>" var="$ThreatIntelligenceReplaceTags.properties.parsedPattern[].patternTypeValues" options="pattern-type-values"> <help short="Pattern type keys"/> <item type="object"> <arg type="string" var="$ThreatIntelligenceReplaceTags.properties.parsedPattern[].patternTypeValues[].value" options="value"> <help short="Value of parsed pattern"/> </arg> <arg type="string" var="$ThreatIntelligenceReplaceTags.properties.parsedPattern[].patternTypeValues[].valueType" options="value-type"> <help short="Type of the value"/> </arg> </item> </arg> </item> </arg> <arg type="string" var="$ThreatIntelligenceReplaceTags.properties.pattern" options="pattern" group="Properties"> <help short="Pattern of a threat intelligence entity"/> </arg> <arg type="string" var="$ThreatIntelligenceReplaceTags.properties.patternType" options="pattern-type" group="Properties"> <help short="Pattern type of a threat intelligence entity"/> </arg> <arg type="string" var="$ThreatIntelligenceReplaceTags.properties.patternVersion" options="pattern-version" group="Properties"> <help short="Pattern version of a threat intelligence entity"/> </arg> <arg type="boolean" var="$ThreatIntelligenceReplaceTags.properties.revoked" options="revoked" group="Properties"> <help short="Is threat intelligence entity revoked"/> </arg> <arg type="string" var="$ThreatIntelligenceReplaceTags.properties.source" options="source" group="Properties"> <help short="Source of a threat intelligence entity"/> </arg> <arg type="array<string>" var="$ThreatIntelligenceReplaceTags.properties.threatIntelligenceTags" options="intelligence-tags" group="Properties"> <help short="List of tags"/> <item type="string"/> </arg> <arg type="array<string>" var="$ThreatIntelligenceReplaceTags.properties.threatTypes" options="threat-types" group="Properties"> <help short="Threat types"/> <item type="string"/> </arg> <arg type="string" var="$ThreatIntelligenceReplaceTags.properties.validFrom" options="valid-from" group="Properties"> <help short="Valid from"/> </arg> <arg type="string" var="$ThreatIntelligenceReplaceTags.properties.validUntil" options="valid-until" group="Properties"> <help short="Valid until"/> </arg> </argGroup> <argGroup name="ThreatIntelligenceReplaceTags"> <arg type="string" var="$ThreatIntelligenceReplaceTags.etag" options="etag" group="ThreatIntelligenceReplaceTags"> <help short="Etag of the azure resource"/> </arg> </argGroup> <operation operationId="ThreatIntelligenceIndicator_ReplaceTags"> <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/threatIntelligence/main/indicators/{name}/replaceTags"> <request method="post"> <path> <param type="string" name="name" arg="$Path.name" required="True"/> <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True"> <format maxLength="90" minLength="1"/> </param> <param type="string" name="subscriptionId" arg="$Path.subscriptionId" required="True"> <format minLength="1"/> </param> <param type="string" name="workspaceName" arg="$Path.workspaceName" required="True"> <format maxLength="90" minLength="1"/> </param> </path> <query> <const readOnly="True" const="True" type="string" name="api-version" required="True"> <default value=""2022-06-01-preview""/> <format minLength="1"/> </const> </query> <body> <json> <schema type="object" name="ThreatIntelligenceReplaceTags" required="True" clientFlatten="True"> <prop type="string" name="etag" arg="$ThreatIntelligenceReplaceTags.etag"/> <prop const="True" type="string" name="kind" required="True"> <default value=""indicator""/> <enum> <item value=""indicator""/> </enum> </prop> <prop type="object" name="properties" clientFlatten="True"> <prop type="integer32" name="confidence" arg="$ThreatIntelligenceReplaceTags.properties.confidence"/> <prop type="string" name="created" arg="$ThreatIntelligenceReplaceTags.properties.created"/> <prop type="string" name="createdByRef" arg="$ThreatIntelligenceReplaceTags.properties.createdByRef"/> <prop type="boolean" name="defanged" arg="$ThreatIntelligenceReplaceTags.properties.defanged"/> <prop type="string" name="description" arg="$ThreatIntelligenceReplaceTags.properties.description"/> <prop type="string" name="displayName" arg="$ThreatIntelligenceReplaceTags.properties.displayName"/> <prop type="string" name="externalId" arg="$ThreatIntelligenceReplaceTags.properties.externalId"/> <prop type="string" name="externalLastUpdatedTimeUtc" arg="$ThreatIntelligenceReplaceTags.properties.externalLastUpdatedTimeUtc"/> <prop type="array<object>" name="externalReferences" arg="$ThreatIntelligenceReplaceTags.properties.externalReferences"> <item type="object"> <prop type="string" name="description" arg="$ThreatIntelligenceReplaceTags.properties.externalReferences[].description"/> <prop type="string" name="externalId" arg="$ThreatIntelligenceReplaceTags.properties.externalReferences[].externalId"/> <prop type="object" name="hashes" arg="$ThreatIntelligenceReplaceTags.properties.externalReferences[].hashes"> <additionalProp> <item type="string"/> </additionalProp> </prop> <prop type="string" name="sourceName" arg="$ThreatIntelligenceReplaceTags.properties.externalReferences[].sourceName"/> <prop type="string" name="url" arg="$ThreatIntelligenceReplaceTags.properties.externalReferences[].url"/> </item> </prop> <prop type="array<object>" name="granularMarkings" arg="$ThreatIntelligenceReplaceTags.properties.granularMarkings"> <item type="object"> <prop type="string" name="language" arg="$ThreatIntelligenceReplaceTags.properties.granularMarkings[].language"/> <prop type="integer32" name="markingRef" arg="$ThreatIntelligenceReplaceTags.properties.granularMarkings[].markingRef"/> <prop type="array<string>" name="selectors" arg="$ThreatIntelligenceReplaceTags.properties.granularMarkings[].selectors"> <item type="string"/> </prop> </item> </prop> <prop type="array<string>" name="indicatorTypes" arg="$ThreatIntelligenceReplaceTags.properties.indicatorTypes"> <item type="string"/> </prop> <prop type="array<object>" name="killChainPhases" arg="$ThreatIntelligenceReplaceTags.properties.killChainPhases"> <item type="object"> <prop type="string" name="killChainName" arg="$ThreatIntelligenceReplaceTags.properties.killChainPhases[].killChainName"/> <prop type="string" name="phaseName" arg="$ThreatIntelligenceReplaceTags.properties.killChainPhases[].phaseName"/> </item> </prop> <prop type="array<string>" name="labels" arg="$ThreatIntelligenceReplaceTags.properties.labels"> <item type="string"/> </prop> <prop type="string" name="language" arg="$ThreatIntelligenceReplaceTags.properties.language"/> <prop type="string" name="lastUpdatedTimeUtc" arg="$ThreatIntelligenceReplaceTags.properties.lastUpdatedTimeUtc"/> <prop type="string" name="modified" arg="$ThreatIntelligenceReplaceTags.properties.modified"/> <prop type="array<string>" name="objectMarkingRefs" arg="$ThreatIntelligenceReplaceTags.properties.objectMarkingRefs"> <item type="string"/> </prop> <prop type="array<object>" name="parsedPattern" arg="$ThreatIntelligenceReplaceTags.properties.parsedPattern"> <item type="object"> <prop type="string" name="patternTypeKey" arg="$ThreatIntelligenceReplaceTags.properties.parsedPattern[].patternTypeKey"/> <prop type="array<object>" name="patternTypeValues" arg="$ThreatIntelligenceReplaceTags.properties.parsedPattern[].patternTypeValues"> <item type="object"> <prop type="string" name="value" arg="$ThreatIntelligenceReplaceTags.properties.parsedPattern[].patternTypeValues[].value"/> <prop type="string" name="valueType" arg="$ThreatIntelligenceReplaceTags.properties.parsedPattern[].patternTypeValues[].valueType"/> </item> </prop> </item> </prop> <prop type="string" name="pattern" arg="$ThreatIntelligenceReplaceTags.properties.pattern"/> <prop type="string" name="patternType" arg="$ThreatIntelligenceReplaceTags.properties.patternType"/> <prop type="string" name="patternVersion" arg="$ThreatIntelligenceReplaceTags.properties.patternVersion"/> <prop type="boolean" name="revoked" arg="$ThreatIntelligenceReplaceTags.properties.revoked"/> <prop type="string" name="source" arg="$ThreatIntelligenceReplaceTags.properties.source"/> <prop type="array<string>" name="threatIntelligenceTags" arg="$ThreatIntelligenceReplaceTags.properties.threatIntelligenceTags"> <item type="string"/> </prop> <prop type="array<string>" name="threatTypes" arg="$ThreatIntelligenceReplaceTags.properties.threatTypes"> <item type="string"/> </prop> <prop type="string" name="validFrom" arg="$ThreatIntelligenceReplaceTags.properties.validFrom"/> <prop type="string" name="validUntil" arg="$ThreatIntelligenceReplaceTags.properties.validUntil"/> </prop> </schema> </json> </body> </request> <response statusCode="200"> <body> <json var="$Instance"> <schema type="object"> <prop type="string" name="etag"/> <prop readOnly="True" type="ResourceId" name="id"> <format template="/subscriptions/{}/resourceGroups/{}/providers/Microsoft.OperationalInsights/workspaces/{}/providers/Microsoft.SecurityInsights/threatIntelligence/main/indicators/{}"/> </prop> <prop type="string" name="kind" required="True"> <enum> <item value=""indicator""/> </enum> </prop> <prop readOnly="True" type="string" name="name"/> <prop readOnly="True" type="object" name="systemData"> <prop readOnly="True" type="dateTime" name="createdAt"/> <prop readOnly="True" type="string" name="createdBy"/> <prop readOnly="True" type="string" name="createdByType"> <enum> <item value=""Application""/> <item value=""Key""/> <item value=""ManagedIdentity""/> <item value=""User""/> </enum> </prop> <prop readOnly="True" type="dateTime" name="lastModifiedAt"/> <prop readOnly="True" type="string" name="lastModifiedBy"/> <prop readOnly="True" type="string" name="lastModifiedByType"> <enum> <item value=""Application""/> <item value=""Key""/> <item value=""ManagedIdentity""/> <item value=""User""/> </enum> </prop> </prop> <prop readOnly="True" type="string" name="type"/> <discriminator property="kind" value="indicator"> <prop type="object" name="properties" clientFlatten="True"> <prop readOnly="True" type="object" name="additionalData"> <additionalProp readOnly="True"/> </prop> <prop type="integer32" name="confidence"/> <prop type="string" name="created"/> <prop type="string" name="createdByRef"/> <prop type="boolean" name="defanged"/> <prop type="string" name="description"/> <prop type="string" name="displayName"/> <prop type="string" name="externalId"/> <prop type="string" name="externalLastUpdatedTimeUtc"/> <prop type="array<object>" name="externalReferences"> <item type="object"> <prop type="string" name="description"/> <prop type="string" name="externalId"/> <prop type="object" name="hashes"> <additionalProp> <item type="string"/> </additionalProp> </prop> <prop type="string" name="sourceName"/> <prop type="string" name="url"/> </item> </prop> <prop readOnly="True" type="string" name="friendlyName"/> <prop type="array<object>" name="granularMarkings"> <item type="object"> <prop type="string" name="language"/> <prop type="integer32" name="markingRef"/> <prop type="array<string>" name="selectors"> <item type="string"/> </prop> </item> </prop> <prop type="array<string>" name="indicatorTypes"> <item type="string"/> </prop> <prop type="array<object>" name="killChainPhases"> <item type="object"> <prop type="string" name="killChainName"/> <prop type="string" name="phaseName"/> </item> </prop> <prop type="array<string>" name="labels"> <item type="string"/> </prop> <prop type="string" name="language"/> <prop type="string" name="lastUpdatedTimeUtc"/> <prop type="string" name="modified"/> <prop type="array<string>" name="objectMarkingRefs"> <item type="string"/> </prop> <prop type="array<object>" name="parsedPattern"> <item type="object"> <prop type="string" name="patternTypeKey"/> <prop type="array<object>" name="patternTypeValues"> <item type="object"> <prop type="string" name="value"/> <prop type="string" name="valueType"/> </item> </prop> </item> </prop> <prop type="string" name="pattern"/> <prop type="string" name="patternType"/> <prop type="string" name="patternVersion"/> <prop type="boolean" name="revoked"/> <prop type="string" name="source"/> <prop type="array<string>" name="threatIntelligenceTags"> <item type="string"/> </prop> <prop type="array<string>" name="threatTypes"> <item type="string"/> </prop> <prop type="string" name="validFrom"/> <prop type="string" name="validUntil"/> </prop> </discriminator> </schema> </json> </body> </response> <response isError="True"> <body> <json> <schema type="@ODataV4Format"/> </json> </body> </response> </http> </operation> <output type="object" ref="$Instance" clientFlatten="True"/> </command> </commandGroup> </CodeGen>