diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/CHANGELOG.md b/sdk/securityinsight/azure-mgmt-securityinsight/CHANGELOG.md index d6f211e0fdd9..afb411263a95 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/CHANGELOG.md +++ b/sdk/securityinsight/azure-mgmt-securityinsight/CHANGELOG.md @@ -1,5 +1,19 @@ # Release History +## 2.0.0b4 (2026-08-19) + +### Features Added + + - Added enum `JobProvisioningState` + - Added enum `MetadataDependencyOperator` + - Added enum `PullRequestState` + - Added enum `WatchlistProvisioningState` + +### Breaking Changes + + - Method `AlertRuleOperations.begin_trigger_rule_run` changed return type from `LROPoller[AlertRule]` to `LROPoller[None]` + - Method `WatchlistsOperations.begin_delete` changed return type from `LROPoller[None]` to `LROPoller[Watchlist]` + ## 2.0.0b3 (2026-05-27) ### Features Added diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/README.md b/sdk/securityinsight/azure-mgmt-securityinsight/README.md index 7290ec1e2437..f4016d645b3d 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/README.md +++ b/sdk/securityinsight/azure-mgmt-securityinsight/README.md @@ -24,7 +24,7 @@ pip install azure-identity ### Authentication -By default, [Azure Active Directory](https://aka.ms/awps/aad) token authentication depends on correct configuration of the following environment variables. +By default, [Microsoft Entra](https://learn.microsoft.com/entra/fundamentals/what-is-entra) token authentication depends on correct configuration of the following environment variables. - `AZURE_CLIENT_ID` for Azure client ID. - `AZURE_TENANT_ID` for Azure tenant ID. diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/_metadata.json b/sdk/securityinsight/azure-mgmt-securityinsight/_metadata.json index 7d0e57ee3c1a..6f611ebb943c 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/_metadata.json +++ b/sdk/securityinsight/azure-mgmt-securityinsight/_metadata.json @@ -1,10 +1,11 @@ { - "apiVersion": "2025-07-01-preview", + "apiVersion": "2025-10-01-preview", "apiVersions": { - "Microsoft.SecurityInsights": "2025-07-01-preview" + "Microsoft.SecurityInsights": "2025-10-01-preview" }, - "commit": "da8db6e593df9f3ddc13139c39930fdad54d12f7", + "commit": "d7da39437a8330fabdc4151f75aebab8e5ca3a64", "repository_url": "https://github.com/Azure/azure-rest-api-specs", "typespec_src": "specification/securityinsights/resource-manager/Microsoft.SecurityInsights/SecurityInsights", - "emitterVersion": "0.62.1" + "emitterVersion": "0.63.5", + "httpClientPythonVersion": "^0.36.0" } \ No newline at end of file diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/api.md b/sdk/securityinsight/azure-mgmt-securityinsight/api.md new file mode 100644 index 000000000000..26332989f194 --- /dev/null +++ b/sdk/securityinsight/azure-mgmt-securityinsight/api.md @@ -0,0 +1,23687 @@ +```py +namespace azure.mgmt.securityinsight + + class azure.mgmt.securityinsight.SecurityInsightsMgmtClient(_SecurityInsightsMgmtClientOperationsMixin): implements ContextManager + actions: ActionsOperations + alert_rule: AlertRuleOperations + alert_rule_templates: AlertRuleTemplatesOperations + alert_rules: AlertRulesOperations + automation_rules: AutomationRulesOperations + billing_statistics: BillingStatisticsOperations + bookmark: BookmarkOperations + bookmark_relations: BookmarkRelationsOperations + bookmarks: BookmarksOperations + content_package: ContentPackageOperations + content_packages: ContentPackagesOperations + content_template: ContentTemplateOperations + content_templates: ContentTemplatesOperations + data_connector_definitions: DataConnectorDefinitionsOperations + data_connectors: DataConnectorsOperations + data_connectors_check_requirements: DataConnectorsCheckRequirementsOperations + entities: EntitiesOperations + entities_get_timeline: EntitiesGetTimelineOperations + entities_relations: EntitiesRelationsOperations + entity_queries: EntityQueriesOperations + entity_query_templates: EntityQueryTemplatesOperations + entity_relations: EntityRelationsOperations + file_imports: FileImportsOperations + get: GetOperations + get_recommendations: GetRecommendationsOperations + get_triggered_analytics_rule_runs: GetTriggeredAnalyticsRuleRunsOperations + hunt_comments: HuntCommentsOperations + hunt_relations: HuntRelationsOperations + hunts: HuntsOperations + incident_comments: IncidentCommentsOperations + incident_relations: IncidentRelationsOperations + incident_tasks: IncidentTasksOperations + incidents: IncidentsOperations + metadata: MetadataOperations + office_consents: OfficeConsentsOperations + operations: Operations + product_package: ProductPackageOperations + product_packages: ProductPackagesOperations + product_settings: ProductSettingsOperations + product_template: ProductTemplateOperations + product_templates: ProductTemplatesOperations + reevaluate: ReevaluateOperations + security_ml_analytics_settings: SecurityMLAnalyticsSettingsOperations + sentinel_onboarding_states: SentinelOnboardingStatesOperations + source_control: SourceControlOperations + source_controls: SourceControlsOperations + threat_intelligence: ThreatIntelligenceOperations + threat_intelligence_indicator: ThreatIntelligenceIndicatorOperations + threat_intelligence_indicator_metrics: ThreatIntelligenceIndicatorMetricsOperations + threat_intelligence_indicators: ThreatIntelligenceIndicatorsOperations + triggered_analytics_rule_run: TriggeredAnalyticsRuleRunOperations + update: UpdateOperations + watchlist_items: WatchlistItemsOperations + watchlists: WatchlistsOperations + workspace_manager_assignment_jobs: WorkspaceManagerAssignmentJobsOperations + workspace_manager_assignments: WorkspaceManagerAssignmentsOperations + workspace_manager_configurations: WorkspaceManagerConfigurationsOperations + workspace_manager_groups: WorkspaceManagerGroupsOperations + workspace_manager_members: WorkspaceManagerMembersOperations + + def __init__( + self, + credential: TokenCredential, + subscription_id: str, + base_url: Optional[str] = None, + *, + api_version: str = ..., + cloud_setting: Optional[AzureClouds] = ..., + polling_interval: Optional[int] = ..., + **kwargs: Any + ) -> None: ... + + def close(self) -> None: ... + + @overload + def list_geodata_by_ip( + self, + resource_group_name: str, + workspace_name: str, + enrichment_type: Union[str, EnrichmentType], + ip_address_body: EnrichmentIpAddressBody, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EnrichmentIpGeodata: ... + + @overload + def list_geodata_by_ip( + self, + resource_group_name: str, + workspace_name: str, + enrichment_type: Union[str, EnrichmentType], + ip_address_body: EnrichmentIpAddressBody, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EnrichmentIpGeodata: ... + + @overload + def list_geodata_by_ip( + self, + resource_group_name: str, + workspace_name: str, + enrichment_type: Union[str, EnrichmentType], + ip_address_body: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EnrichmentIpGeodata: ... + + @overload + def list_whois_by_domain( + self, + resource_group_name: str, + workspace_name: str, + enrichment_type: Union[str, EnrichmentType], + domain_body: EnrichmentDomainBody, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EnrichmentDomainWhois: ... + + @overload + def list_whois_by_domain( + self, + resource_group_name: str, + workspace_name: str, + enrichment_type: Union[str, EnrichmentType], + domain_body: EnrichmentDomainBody, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EnrichmentDomainWhois: ... + + @overload + def list_whois_by_domain( + self, + resource_group_name: str, + workspace_name: str, + enrichment_type: Union[str, EnrichmentType], + domain_body: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EnrichmentDomainWhois: ... + + def send_request( + self, + request: HttpRequest, + *, + stream: bool = False, + **kwargs: Any + ) -> HttpResponse: ... + + +namespace azure.mgmt.securityinsight.aio + + class azure.mgmt.securityinsight.aio.SecurityInsightsMgmtClient(_SecurityInsightsMgmtClientOperationsMixin): implements AsyncContextManager + actions: ActionsOperations + alert_rule: AlertRuleOperations + alert_rule_templates: AlertRuleTemplatesOperations + alert_rules: AlertRulesOperations + automation_rules: AutomationRulesOperations + billing_statistics: BillingStatisticsOperations + bookmark: BookmarkOperations + bookmark_relations: BookmarkRelationsOperations + bookmarks: BookmarksOperations + content_package: ContentPackageOperations + content_packages: ContentPackagesOperations + content_template: ContentTemplateOperations + content_templates: ContentTemplatesOperations + data_connector_definitions: DataConnectorDefinitionsOperations + data_connectors: DataConnectorsOperations + data_connectors_check_requirements: DataConnectorsCheckRequirementsOperations + entities: EntitiesOperations + entities_get_timeline: EntitiesGetTimelineOperations + entities_relations: EntitiesRelationsOperations + entity_queries: EntityQueriesOperations + entity_query_templates: EntityQueryTemplatesOperations + entity_relations: EntityRelationsOperations + file_imports: FileImportsOperations + get: GetOperations + get_recommendations: GetRecommendationsOperations + get_triggered_analytics_rule_runs: GetTriggeredAnalyticsRuleRunsOperations + hunt_comments: HuntCommentsOperations + hunt_relations: HuntRelationsOperations + hunts: HuntsOperations + incident_comments: IncidentCommentsOperations + incident_relations: IncidentRelationsOperations + incident_tasks: IncidentTasksOperations + incidents: IncidentsOperations + metadata: MetadataOperations + office_consents: OfficeConsentsOperations + operations: Operations + product_package: ProductPackageOperations + product_packages: ProductPackagesOperations + product_settings: ProductSettingsOperations + product_template: ProductTemplateOperations + product_templates: ProductTemplatesOperations + reevaluate: ReevaluateOperations + security_ml_analytics_settings: SecurityMLAnalyticsSettingsOperations + sentinel_onboarding_states: SentinelOnboardingStatesOperations + source_control: SourceControlOperations + source_controls: SourceControlsOperations + threat_intelligence: ThreatIntelligenceOperations + threat_intelligence_indicator: ThreatIntelligenceIndicatorOperations + threat_intelligence_indicator_metrics: ThreatIntelligenceIndicatorMetricsOperations + threat_intelligence_indicators: ThreatIntelligenceIndicatorsOperations + triggered_analytics_rule_run: TriggeredAnalyticsRuleRunOperations + update: UpdateOperations + watchlist_items: WatchlistItemsOperations + watchlists: WatchlistsOperations + workspace_manager_assignment_jobs: WorkspaceManagerAssignmentJobsOperations + workspace_manager_assignments: WorkspaceManagerAssignmentsOperations + workspace_manager_configurations: WorkspaceManagerConfigurationsOperations + workspace_manager_groups: WorkspaceManagerGroupsOperations + workspace_manager_members: WorkspaceManagerMembersOperations + + def __init__( + self, + credential: AsyncTokenCredential, + subscription_id: str, + base_url: Optional[str] = None, + *, + api_version: str = ..., + cloud_setting: Optional[AzureClouds] = ..., + polling_interval: Optional[int] = ..., + **kwargs: Any + ) -> None: ... + + async def close(self) -> None: ... + + @overload + async def list_geodata_by_ip( + self, + resource_group_name: str, + workspace_name: str, + enrichment_type: Union[str, EnrichmentType], + ip_address_body: EnrichmentIpAddressBody, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EnrichmentIpGeodata: ... + + @overload + async def list_geodata_by_ip( + self, + resource_group_name: str, + workspace_name: str, + enrichment_type: Union[str, EnrichmentType], + ip_address_body: EnrichmentIpAddressBody, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EnrichmentIpGeodata: ... + + @overload + async def list_geodata_by_ip( + self, + resource_group_name: str, + workspace_name: str, + enrichment_type: Union[str, EnrichmentType], + ip_address_body: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EnrichmentIpGeodata: ... + + @overload + async def list_whois_by_domain( + self, + resource_group_name: str, + workspace_name: str, + enrichment_type: Union[str, EnrichmentType], + domain_body: EnrichmentDomainBody, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EnrichmentDomainWhois: ... + + @overload + async def list_whois_by_domain( + self, + resource_group_name: str, + workspace_name: str, + enrichment_type: Union[str, EnrichmentType], + domain_body: EnrichmentDomainBody, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EnrichmentDomainWhois: ... + + @overload + async def list_whois_by_domain( + self, + resource_group_name: str, + workspace_name: str, + enrichment_type: Union[str, EnrichmentType], + domain_body: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EnrichmentDomainWhois: ... + + def send_request( + self, + request: HttpRequest, + *, + stream: bool = False, + **kwargs: Any + ) -> Awaitable[AsyncHttpResponse]: ... + + +namespace azure.mgmt.securityinsight.aio.operations + + class azure.mgmt.securityinsight.aio.operations.ActionsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + rule_id: str, + action_id: str, + action: ActionRequest, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ActionResponse: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + rule_id: str, + action_id: str, + action: ActionRequest, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ActionResponse: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + rule_id: str, + action_id: str, + action: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ActionResponse: ... + + @distributed_trace_async + async def delete( + self, + resource_group_name: str, + workspace_name: str, + rule_id: str, + action_id: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace_async + async def get( + self, + resource_group_name: str, + workspace_name: str, + rule_id: str, + action_id: str, + **kwargs: Any + ) -> ActionResponse: ... + + @distributed_trace + def list_by_alert_rule( + self, + resource_group_name: str, + workspace_name: str, + rule_id: str, + **kwargs: Any + ) -> AsyncItemPaged[ActionResponse]: ... + + + class azure.mgmt.securityinsight.aio.operations.AlertRuleOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def begin_trigger_rule_run( + self, + resource_group_name: str, + workspace_name: str, + rule_id: str, + analytics_rule_run_trigger_parameter: AnalyticsRuleRunTrigger, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> AsyncLROPoller[None]: ... + + @overload + async def begin_trigger_rule_run( + self, + resource_group_name: str, + workspace_name: str, + rule_id: str, + analytics_rule_run_trigger_parameter: AnalyticsRuleRunTrigger, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> AsyncLROPoller[None]: ... + + @overload + async def begin_trigger_rule_run( + self, + resource_group_name: str, + workspace_name: str, + rule_id: str, + analytics_rule_run_trigger_parameter: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> AsyncLROPoller[None]: ... + + + class azure.mgmt.securityinsight.aio.operations.AlertRuleTemplatesOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace_async + async def get( + self, + resource_group_name: str, + workspace_name: str, + alert_rule_template_id: str, + **kwargs: Any + ) -> AlertRuleTemplate: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs: Any + ) -> AsyncItemPaged[AlertRuleTemplate]: ... + + + class azure.mgmt.securityinsight.aio.operations.AlertRulesOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + rule_id: str, + alert_rule: AlertRule, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> AlertRule: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + rule_id: str, + alert_rule: AlertRule, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> AlertRule: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + rule_id: str, + alert_rule: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> AlertRule: ... + + @distributed_trace_async + async def delete( + self, + resource_group_name: str, + workspace_name: str, + rule_id: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace_async + async def get( + self, + resource_group_name: str, + workspace_name: str, + rule_id: str, + **kwargs: Any + ) -> AlertRule: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs: Any + ) -> AsyncItemPaged[AlertRule]: ... + + + class azure.mgmt.securityinsight.aio.operations.AutomationRulesOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + automation_rule_id: str, + automation_rule_to_upsert: Optional[AutomationRule] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> AutomationRule: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + automation_rule_id: str, + automation_rule_to_upsert: Optional[AutomationRule] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> AutomationRule: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + automation_rule_id: str, + automation_rule_to_upsert: Optional[IO[bytes]] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> AutomationRule: ... + + @distributed_trace_async + async def delete( + self, + resource_group_name: str, + workspace_name: str, + automation_rule_id: str, + **kwargs: Any + ) -> Any: ... + + @distributed_trace_async + async def get( + self, + resource_group_name: str, + workspace_name: str, + automation_rule_id: str, + **kwargs: Any + ) -> AutomationRule: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs: Any + ) -> AsyncItemPaged[AutomationRule]: ... + + + class azure.mgmt.securityinsight.aio.operations.BillingStatisticsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace_async + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'billing_statistic_name', 'accept']}, api_versions_list=['2025-10-01-preview']) + async def get( + self, + resource_group_name: str, + workspace_name: str, + billing_statistic_name: str, + **kwargs: Any + ) -> BillingStatistic: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'accept']}, api_versions_list=['2025-10-01-preview']) + def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs: Any + ) -> AsyncItemPaged[BillingStatistic]: ... + + + class azure.mgmt.securityinsight.aio.operations.BookmarkOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def expand( + self, + resource_group_name: str, + workspace_name: str, + bookmark_id: str, + parameters: BookmarkExpandParameters, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> BookmarkExpandResponse: ... + + @overload + async def expand( + self, + resource_group_name: str, + workspace_name: str, + bookmark_id: str, + parameters: BookmarkExpandParameters, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> BookmarkExpandResponse: ... + + @overload + async def expand( + self, + resource_group_name: str, + workspace_name: str, + bookmark_id: str, + parameters: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> BookmarkExpandResponse: ... + + + class azure.mgmt.securityinsight.aio.operations.BookmarkRelationsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + bookmark_id: str, + relation_name: str, + relation: Relation, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Relation: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + bookmark_id: str, + relation_name: str, + relation: Relation, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Relation: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + bookmark_id: str, + relation_name: str, + relation: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Relation: ... + + @distributed_trace_async + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'bookmark_id', 'relation_name']}, api_versions_list=['2025-10-01-preview']) + async def delete( + self, + resource_group_name: str, + workspace_name: str, + bookmark_id: str, + relation_name: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace_async + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'bookmark_id', 'relation_name', 'accept']}, api_versions_list=['2025-10-01-preview']) + async def get( + self, + resource_group_name: str, + workspace_name: str, + bookmark_id: str, + relation_name: str, + **kwargs: Any + ) -> Relation: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'bookmark_id', 'filter', 'orderby', 'top', 'skip_token', 'accept']}, api_versions_list=['2025-10-01-preview']) + def list( + self, + resource_group_name: str, + workspace_name: str, + bookmark_id: str, + *, + filter: Optional[str] = ..., + orderby: Optional[str] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> AsyncItemPaged[Relation]: ... + + + class azure.mgmt.securityinsight.aio.operations.BookmarksOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + bookmark_id: str, + bookmark: Bookmark, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Bookmark: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + bookmark_id: str, + bookmark: Bookmark, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Bookmark: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + bookmark_id: str, + bookmark: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Bookmark: ... + + @distributed_trace_async + async def delete( + self, + resource_group_name: str, + workspace_name: str, + bookmark_id: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace_async + async def get( + self, + resource_group_name: str, + workspace_name: str, + bookmark_id: str, + **kwargs: Any + ) -> Bookmark: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs: Any + ) -> AsyncItemPaged[Bookmark]: ... + + + class azure.mgmt.securityinsight.aio.operations.ContentPackageOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def install( + self, + resource_group_name: str, + workspace_name: str, + package_id: str, + package_installation_properties: PackageModel, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> PackageModel: ... + + @overload + async def install( + self, + resource_group_name: str, + workspace_name: str, + package_id: str, + package_installation_properties: PackageModel, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> PackageModel: ... + + @overload + async def install( + self, + resource_group_name: str, + workspace_name: str, + package_id: str, + package_installation_properties: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> PackageModel: ... + + @distributed_trace_async + async def uninstall( + self, + resource_group_name: str, + workspace_name: str, + package_id: str, + **kwargs: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.aio.operations.ContentPackagesOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace_async + async def get( + self, + resource_group_name: str, + workspace_name: str, + package_id: str, + **kwargs: Any + ) -> PackageModel: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + *, + count: Optional[bool] = ..., + filter: Optional[str] = ..., + orderby: Optional[str] = ..., + search: Optional[str] = ..., + skip: Optional[int] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> AsyncItemPaged[PackageModel]: ... + + + class azure.mgmt.securityinsight.aio.operations.ContentTemplateOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace_async + async def delete( + self, + resource_group_name: str, + workspace_name: str, + template_id: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace_async + async def get( + self, + resource_group_name: str, + workspace_name: str, + template_id: str, + **kwargs: Any + ) -> TemplateModel: ... + + @overload + async def install( + self, + resource_group_name: str, + workspace_name: str, + template_id: str, + template_installation_properties: TemplateModel, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> TemplateModel: ... + + @overload + async def install( + self, + resource_group_name: str, + workspace_name: str, + template_id: str, + template_installation_properties: TemplateModel, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> TemplateModel: ... + + @overload + async def install( + self, + resource_group_name: str, + workspace_name: str, + template_id: str, + template_installation_properties: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> TemplateModel: ... + + + class azure.mgmt.securityinsight.aio.operations.ContentTemplatesOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + *, + count: Optional[bool] = ..., + expand: Optional[str] = ..., + filter: Optional[str] = ..., + orderby: Optional[str] = ..., + search: Optional[str] = ..., + skip: Optional[int] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> AsyncItemPaged[TemplateModel]: ... + + + class azure.mgmt.securityinsight.aio.operations.DataConnectorDefinitionsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + data_connector_definition_name: str, + connector_definition_input: DataConnectorDefinition, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> DataConnectorDefinition: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + data_connector_definition_name: str, + connector_definition_input: DataConnectorDefinition, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> DataConnectorDefinition: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + data_connector_definition_name: str, + connector_definition_input: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> DataConnectorDefinition: ... + + @distributed_trace_async + async def delete( + self, + resource_group_name: str, + workspace_name: str, + data_connector_definition_name: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace_async + async def get( + self, + resource_group_name: str, + workspace_name: str, + data_connector_definition_name: str, + **kwargs: Any + ) -> DataConnectorDefinition: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs: Any + ) -> AsyncItemPaged[DataConnectorDefinition]: ... + + + class azure.mgmt.securityinsight.aio.operations.DataConnectorsCheckRequirementsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def post( + self, + resource_group_name: str, + workspace_name: str, + data_connectors_check_requirements: DataConnectorsCheckRequirements, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> DataConnectorRequirementsState: ... + + @overload + async def post( + self, + resource_group_name: str, + workspace_name: str, + data_connectors_check_requirements: DataConnectorsCheckRequirements, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> DataConnectorRequirementsState: ... + + @overload + async def post( + self, + resource_group_name: str, + workspace_name: str, + data_connectors_check_requirements: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> DataConnectorRequirementsState: ... + + + class azure.mgmt.securityinsight.aio.operations.DataConnectorsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def connect( + self, + resource_group_name: str, + workspace_name: str, + data_connector_id: str, + connect_body: DataConnectorConnectBody, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> None: ... + + @overload + async def connect( + self, + resource_group_name: str, + workspace_name: str, + data_connector_id: str, + connect_body: DataConnectorConnectBody, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> None: ... + + @overload + async def connect( + self, + resource_group_name: str, + workspace_name: str, + data_connector_id: str, + connect_body: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> None: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + data_connector_id: str, + data_connector: DataConnector, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> DataConnector: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + data_connector_id: str, + data_connector: DataConnector, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> DataConnector: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + data_connector_id: str, + data_connector: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> DataConnector: ... + + @distributed_trace_async + async def delete( + self, + resource_group_name: str, + workspace_name: str, + data_connector_id: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace_async + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'data_connector_id']}, api_versions_list=['2025-10-01-preview']) + async def disconnect( + self, + resource_group_name: str, + workspace_name: str, + data_connector_id: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace_async + async def get( + self, + resource_group_name: str, + workspace_name: str, + data_connector_id: str, + **kwargs: Any + ) -> DataConnector: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs: Any + ) -> AsyncItemPaged[DataConnector]: ... + + + class azure.mgmt.securityinsight.aio.operations.EntitiesGetTimelineOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def list( + self, + resource_group_name: str, + workspace_name: str, + entity_id: str, + parameters: EntityTimelineParameters, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EntityTimelineResponse: ... + + @overload + async def list( + self, + resource_group_name: str, + workspace_name: str, + entity_id: str, + parameters: EntityTimelineParameters, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EntityTimelineResponse: ... + + @overload + async def list( + self, + resource_group_name: str, + workspace_name: str, + entity_id: str, + parameters: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EntityTimelineResponse: ... + + + class azure.mgmt.securityinsight.aio.operations.EntitiesOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def expand( + self, + resource_group_name: str, + workspace_name: str, + entity_id: str, + parameters: EntityExpandParameters, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EntityExpandResponse: ... + + @overload + async def expand( + self, + resource_group_name: str, + workspace_name: str, + entity_id: str, + parameters: EntityExpandParameters, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EntityExpandResponse: ... + + @overload + async def expand( + self, + resource_group_name: str, + workspace_name: str, + entity_id: str, + parameters: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EntityExpandResponse: ... + + @distributed_trace_async + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'entity_id', 'accept']}, api_versions_list=['2025-10-01-preview']) + async def get( + self, + resource_group_name: str, + workspace_name: str, + entity_id: str, + **kwargs: Any + ) -> Entity: ... + + @overload + async def get_insights( + self, + resource_group_name: str, + workspace_name: str, + entity_id: str, + parameters: EntityGetInsightsParameters, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EntityGetInsightsResponse: ... + + @overload + async def get_insights( + self, + resource_group_name: str, + workspace_name: str, + entity_id: str, + parameters: EntityGetInsightsParameters, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EntityGetInsightsResponse: ... + + @overload + async def get_insights( + self, + resource_group_name: str, + workspace_name: str, + entity_id: str, + parameters: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EntityGetInsightsResponse: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'accept']}, api_versions_list=['2025-10-01-preview']) + def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs: Any + ) -> AsyncItemPaged[Entity]: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'entity_id', 'kind', 'accept']}, api_versions_list=['2025-10-01-preview']) + def queries( + self, + resource_group_name: str, + workspace_name: str, + entity_id: str, + *, + kind: Union[str, EntityItemQueryKind], + **kwargs: Any + ) -> AsyncItemPaged[EntityQueryItem]: ... + + @overload + async def run_playbook( + self, + resource_group_name: str, + workspace_name: str, + entity_identifier: str, + request_body: Optional[EntityManualTriggerRequestBody] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> None: ... + + @overload + async def run_playbook( + self, + resource_group_name: str, + workspace_name: str, + entity_identifier: str, + request_body: Optional[EntityManualTriggerRequestBody] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> None: ... + + @overload + async def run_playbook( + self, + resource_group_name: str, + workspace_name: str, + entity_identifier: str, + request_body: Optional[IO[bytes]] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.aio.operations.EntitiesRelationsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + entity_id: str, + *, + filter: Optional[str] = ..., + orderby: Optional[str] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> AsyncItemPaged[Relation]: ... + + + class azure.mgmt.securityinsight.aio.operations.EntityQueriesOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + entity_query_id: str, + entity_query: CustomEntityQuery, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EntityQuery: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + entity_query_id: str, + entity_query: CustomEntityQuery, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EntityQuery: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + entity_query_id: str, + entity_query: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EntityQuery: ... + + @distributed_trace_async + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'entity_query_id']}, api_versions_list=['2025-10-01-preview']) + async def delete( + self, + resource_group_name: str, + workspace_name: str, + entity_query_id: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace_async + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'entity_query_id', 'accept']}, api_versions_list=['2025-10-01-preview']) + async def get( + self, + resource_group_name: str, + workspace_name: str, + entity_query_id: str, + **kwargs: Any + ) -> EntityQuery: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'kind', 'accept']}, api_versions_list=['2025-10-01-preview']) + def list( + self, + resource_group_name: str, + workspace_name: str, + *, + kind: Optional[Union[str, EntityQueryTemplateKind]] = ..., + **kwargs: Any + ) -> AsyncItemPaged[EntityQuery]: ... + + + class azure.mgmt.securityinsight.aio.operations.EntityQueryTemplatesOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace_async + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'entity_query_template_id', 'accept']}, api_versions_list=['2025-10-01-preview']) + async def get( + self, + resource_group_name: str, + workspace_name: str, + entity_query_template_id: str, + **kwargs: Any + ) -> EntityQueryTemplate: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'kind', 'accept']}, api_versions_list=['2025-10-01-preview']) + def list( + self, + resource_group_name: str, + workspace_name: str, + *, + kind: Optional[Union[str, EntityQueryTemplateKind]] = ..., + **kwargs: Any + ) -> AsyncItemPaged[EntityQueryTemplate]: ... + + + class azure.mgmt.securityinsight.aio.operations.EntityRelationsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace_async + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'entity_id', 'relation_name', 'accept']}, api_versions_list=['2025-10-01-preview']) + async def get_relation( + self, + resource_group_name: str, + workspace_name: str, + entity_id: str, + relation_name: str, + **kwargs: Any + ) -> Relation: ... + + + class azure.mgmt.securityinsight.aio.operations.FileImportsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace_async + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'file_import_id', 'accept']}, api_versions_list=['2025-10-01-preview']) + async def begin_delete( + self, + resource_group_name: str, + workspace_name: str, + file_import_id: str, + **kwargs: Any + ) -> AsyncLROPoller[FileImport]: ... + + @overload + async def create( + self, + resource_group_name: str, + workspace_name: str, + file_import_id: str, + file_import: FileImport, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> FileImport: ... + + @overload + async def create( + self, + resource_group_name: str, + workspace_name: str, + file_import_id: str, + file_import: FileImport, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> FileImport: ... + + @overload + async def create( + self, + resource_group_name: str, + workspace_name: str, + file_import_id: str, + file_import: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> FileImport: ... + + @distributed_trace_async + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'file_import_id', 'accept']}, api_versions_list=['2025-10-01-preview']) + async def get( + self, + resource_group_name: str, + workspace_name: str, + file_import_id: str, + **kwargs: Any + ) -> FileImport: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'filter', 'orderby', 'top', 'skip_token', 'accept']}, api_versions_list=['2025-10-01-preview']) + def list( + self, + resource_group_name: str, + workspace_name: str, + *, + filter: Optional[str] = ..., + orderby: Optional[str] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> AsyncItemPaged[FileImport]: ... + + + class azure.mgmt.securityinsight.aio.operations.GetOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace_async + async def single_recommendation( + self, + resource_group_name: str, + workspace_name: str, + recommendation_id: str, + **kwargs: Any + ) -> Recommendation: ... + + + class azure.mgmt.securityinsight.aio.operations.GetRecommendationsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs: Any + ) -> AsyncItemPaged[Recommendation]: ... + + + class azure.mgmt.securityinsight.aio.operations.GetTriggeredAnalyticsRuleRunsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs: Any + ) -> AsyncItemPaged[TriggeredAnalyticsRuleRun]: ... + + + class azure.mgmt.securityinsight.aio.operations.HuntCommentsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + hunt_comment_id: str, + hunt_comment: HuntComment, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> HuntComment: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + hunt_comment_id: str, + hunt_comment: HuntComment, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> HuntComment: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + hunt_comment_id: str, + hunt_comment: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> HuntComment: ... + + @distributed_trace_async + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'hunt_id', 'hunt_comment_id']}, api_versions_list=['2025-10-01-preview']) + async def delete( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + hunt_comment_id: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace_async + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'hunt_id', 'hunt_comment_id', 'accept']}, api_versions_list=['2025-10-01-preview']) + async def get( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + hunt_comment_id: str, + **kwargs: Any + ) -> HuntComment: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'hunt_id', 'filter', 'orderby', 'top', 'skip_token', 'accept']}, api_versions_list=['2025-10-01-preview']) + def list( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + *, + filter: Optional[str] = ..., + orderby: Optional[str] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> AsyncItemPaged[HuntComment]: ... + + + class azure.mgmt.securityinsight.aio.operations.HuntRelationsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + hunt_relation_id: str, + hunt_relation: HuntRelation, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> HuntRelation: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + hunt_relation_id: str, + hunt_relation: HuntRelation, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> HuntRelation: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + hunt_relation_id: str, + hunt_relation: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> HuntRelation: ... + + @distributed_trace_async + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'hunt_id', 'hunt_relation_id']}, api_versions_list=['2025-10-01-preview']) + async def delete( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + hunt_relation_id: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace_async + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'hunt_id', 'hunt_relation_id', 'accept']}, api_versions_list=['2025-10-01-preview']) + async def get( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + hunt_relation_id: str, + **kwargs: Any + ) -> HuntRelation: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'hunt_id', 'filter', 'orderby', 'top', 'skip_token', 'accept']}, api_versions_list=['2025-10-01-preview']) + def list( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + *, + filter: Optional[str] = ..., + orderby: Optional[str] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> AsyncItemPaged[HuntRelation]: ... + + + class azure.mgmt.securityinsight.aio.operations.HuntsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + hunt: Hunt, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Hunt: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + hunt: Hunt, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Hunt: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + hunt: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Hunt: ... + + @distributed_trace_async + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'hunt_id']}, api_versions_list=['2025-10-01-preview']) + async def delete( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace_async + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'hunt_id', 'accept']}, api_versions_list=['2025-10-01-preview']) + async def get( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + **kwargs: Any + ) -> Hunt: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'filter', 'orderby', 'top', 'skip_token', 'accept']}, api_versions_list=['2025-10-01-preview']) + def list( + self, + resource_group_name: str, + workspace_name: str, + *, + filter: Optional[str] = ..., + orderby: Optional[str] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> AsyncItemPaged[Hunt]: ... + + + class azure.mgmt.securityinsight.aio.operations.IncidentCommentsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + incident_comment_id: str, + incident_comment: IncidentComment, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> IncidentComment: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + incident_comment_id: str, + incident_comment: IncidentComment, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> IncidentComment: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + incident_comment_id: str, + incident_comment: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> IncidentComment: ... + + @distributed_trace_async + async def delete( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + incident_comment_id: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace_async + async def get( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + incident_comment_id: str, + **kwargs: Any + ) -> IncidentComment: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + *, + filter: Optional[str] = ..., + orderby: Optional[str] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> AsyncItemPaged[IncidentComment]: ... + + + class azure.mgmt.securityinsight.aio.operations.IncidentRelationsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + relation_name: str, + relation: Relation, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Relation: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + relation_name: str, + relation: Relation, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Relation: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + relation_name: str, + relation: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Relation: ... + + @distributed_trace_async + async def delete( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + relation_name: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace_async + async def get( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + relation_name: str, + **kwargs: Any + ) -> Relation: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + *, + filter: Optional[str] = ..., + orderby: Optional[str] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> AsyncItemPaged[Relation]: ... + + + class azure.mgmt.securityinsight.aio.operations.IncidentTasksOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + incident_task_id: str, + incident_task: IncidentTask, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> IncidentTask: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + incident_task_id: str, + incident_task: IncidentTask, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> IncidentTask: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + incident_task_id: str, + incident_task: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> IncidentTask: ... + + @distributed_trace_async + async def delete( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + incident_task_id: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace_async + async def get( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + incident_task_id: str, + **kwargs: Any + ) -> IncidentTask: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + **kwargs: Any + ) -> AsyncItemPaged[IncidentTask]: ... + + + class azure.mgmt.securityinsight.aio.operations.IncidentsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + incident: Incident, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Incident: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + incident: Incident, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Incident: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + incident: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Incident: ... + + @distributed_trace_async + async def delete( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace_async + async def get( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + **kwargs: Any + ) -> Incident: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + *, + filter: Optional[str] = ..., + orderby: Optional[str] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> AsyncItemPaged[Incident]: ... + + @distributed_trace_async + async def list_alerts( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + **kwargs: Any + ) -> IncidentAlertList: ... + + @distributed_trace_async + async def list_bookmarks( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + **kwargs: Any + ) -> IncidentBookmarkList: ... + + @distributed_trace_async + async def list_entities( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + **kwargs: Any + ) -> IncidentEntitiesResponse: ... + + @overload + async def run_playbook( + self, + resource_group_name: str, + workspace_name: str, + incident_identifier: str, + request_body: Optional[ManualTriggerRequestBody] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Any: ... + + @overload + async def run_playbook( + self, + resource_group_name: str, + workspace_name: str, + incident_identifier: str, + request_body: Optional[ManualTriggerRequestBody] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Any: ... + + @overload + async def run_playbook( + self, + resource_group_name: str, + workspace_name: str, + incident_identifier: str, + request_body: Optional[IO[bytes]] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Any: ... + + + class azure.mgmt.securityinsight.aio.operations.MetadataOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def create( + self, + resource_group_name: str, + workspace_name: str, + metadata_name: str, + metadata: MetadataModel, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> MetadataModel: ... + + @overload + async def create( + self, + resource_group_name: str, + workspace_name: str, + metadata_name: str, + metadata: MetadataModel, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> MetadataModel: ... + + @overload + async def create( + self, + resource_group_name: str, + workspace_name: str, + metadata_name: str, + metadata: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> MetadataModel: ... + + @distributed_trace_async + async def delete( + self, + resource_group_name: str, + workspace_name: str, + metadata_name: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace_async + async def get( + self, + resource_group_name: str, + workspace_name: str, + metadata_name: str, + **kwargs: Any + ) -> MetadataModel: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + *, + filter: Optional[str] = ..., + orderby: Optional[str] = ..., + skip: Optional[int] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> AsyncItemPaged[MetadataModel]: ... + + @overload + async def update( + self, + resource_group_name: str, + workspace_name: str, + metadata_name: str, + metadata_patch: MetadataPatch, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> MetadataModel: ... + + @overload + async def update( + self, + resource_group_name: str, + workspace_name: str, + metadata_name: str, + metadata_patch: MetadataPatch, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> MetadataModel: ... + + @overload + async def update( + self, + resource_group_name: str, + workspace_name: str, + metadata_name: str, + metadata_patch: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> MetadataModel: ... + + + class azure.mgmt.securityinsight.aio.operations.OfficeConsentsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace_async + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'consent_id']}, api_versions_list=['2025-10-01-preview']) + async def delete( + self, + resource_group_name: str, + workspace_name: str, + consent_id: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace_async + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'consent_id', 'accept']}, api_versions_list=['2025-10-01-preview']) + async def get( + self, + resource_group_name: str, + workspace_name: str, + consent_id: str, + **kwargs: Any + ) -> OfficeConsent: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'accept']}, api_versions_list=['2025-10-01-preview']) + def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs: Any + ) -> AsyncItemPaged[OfficeConsent]: ... + + + class azure.mgmt.securityinsight.aio.operations.Operations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace + def list(self, **kwargs: Any) -> AsyncItemPaged[Operation]: ... + + + class azure.mgmt.securityinsight.aio.operations.ProductPackageOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace_async + async def get( + self, + resource_group_name: str, + workspace_name: str, + package_id: str, + **kwargs: Any + ) -> ProductPackageModel: ... + + + class azure.mgmt.securityinsight.aio.operations.ProductPackagesOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + *, + filter: Optional[str] = ..., + orderby: Optional[str] = ..., + search: Optional[str] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> AsyncItemPaged[ProductPackageModel]: ... + + + class azure.mgmt.securityinsight.aio.operations.ProductSettingsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace_async + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'settings_name']}, api_versions_list=['2025-10-01-preview']) + async def delete( + self, + resource_group_name: str, + workspace_name: str, + settings_name: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace_async + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'settings_name', 'accept']}, api_versions_list=['2025-10-01-preview']) + async def get( + self, + resource_group_name: str, + workspace_name: str, + settings_name: str, + **kwargs: Any + ) -> Settings: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'accept']}, api_versions_list=['2025-10-01-preview']) + def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs: Any + ) -> AsyncItemPaged[Settings]: ... + + @overload + async def update( + self, + resource_group_name: str, + workspace_name: str, + settings_name: str, + settings: Settings, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Settings: ... + + @overload + async def update( + self, + resource_group_name: str, + workspace_name: str, + settings_name: str, + settings: Settings, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Settings: ... + + @overload + async def update( + self, + resource_group_name: str, + workspace_name: str, + settings_name: str, + settings: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Settings: ... + + + class azure.mgmt.securityinsight.aio.operations.ProductTemplateOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace_async + async def get( + self, + resource_group_name: str, + workspace_name: str, + template_id: str, + **kwargs: Any + ) -> ProductTemplateModel: ... + + + class azure.mgmt.securityinsight.aio.operations.ProductTemplatesOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + *, + count: Optional[bool] = ..., + filter: Optional[str] = ..., + orderby: Optional[str] = ..., + search: Optional[str] = ..., + skip: Optional[int] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> AsyncItemPaged[ProductTemplateModel]: ... + + + class azure.mgmt.securityinsight.aio.operations.ReevaluateOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace_async + async def recommendation( + self, + resource_group_name: str, + workspace_name: str, + recommendation_id: str, + **kwargs: Any + ) -> ReevaluateResponse: ... + + + class azure.mgmt.securityinsight.aio.operations.SecurityMLAnalyticsSettingsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + settings_resource_name: str, + security_ml_analytics_setting: SecurityMLAnalyticsSetting, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> SecurityMLAnalyticsSetting: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + settings_resource_name: str, + security_ml_analytics_setting: SecurityMLAnalyticsSetting, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> SecurityMLAnalyticsSetting: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + settings_resource_name: str, + security_ml_analytics_setting: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> SecurityMLAnalyticsSetting: ... + + @distributed_trace_async + async def delete( + self, + resource_group_name: str, + workspace_name: str, + settings_resource_name: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace_async + async def get( + self, + resource_group_name: str, + workspace_name: str, + settings_resource_name: str, + **kwargs: Any + ) -> SecurityMLAnalyticsSetting: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs: Any + ) -> AsyncItemPaged[SecurityMLAnalyticsSetting]: ... + + + class azure.mgmt.securityinsight.aio.operations.SentinelOnboardingStatesOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def create( + self, + resource_group_name: str, + workspace_name: str, + sentinel_onboarding_state_name: str, + sentinel_onboarding_state_parameter: Optional[SentinelOnboardingState] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> SentinelOnboardingState: ... + + @overload + async def create( + self, + resource_group_name: str, + workspace_name: str, + sentinel_onboarding_state_name: str, + sentinel_onboarding_state_parameter: Optional[SentinelOnboardingState] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> SentinelOnboardingState: ... + + @overload + async def create( + self, + resource_group_name: str, + workspace_name: str, + sentinel_onboarding_state_name: str, + sentinel_onboarding_state_parameter: Optional[IO[bytes]] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> SentinelOnboardingState: ... + + @distributed_trace_async + async def delete( + self, + resource_group_name: str, + workspace_name: str, + sentinel_onboarding_state_name: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace_async + async def get( + self, + resource_group_name: str, + workspace_name: str, + sentinel_onboarding_state_name: str, + **kwargs: Any + ) -> SentinelOnboardingState: ... + + @distributed_trace_async + async def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs: Any + ) -> SentinelOnboardingStatesList: ... + + + class azure.mgmt.securityinsight.aio.operations.SourceControlOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def list_repositories( + self, + resource_group_name: str, + workspace_name: str, + repository_access: RepositoryAccessProperties, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> AsyncItemPaged[Repo]: ... + + @overload + def list_repositories( + self, + resource_group_name: str, + workspace_name: str, + repository_access: RepositoryAccessProperties, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> AsyncItemPaged[Repo]: ... + + @overload + def list_repositories( + self, + resource_group_name: str, + workspace_name: str, + repository_access: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> AsyncItemPaged[Repo]: ... + + + class azure.mgmt.securityinsight.aio.operations.SourceControlsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def create( + self, + resource_group_name: str, + workspace_name: str, + source_control_id: str, + source_control: SourceControl, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> SourceControl: ... + + @overload + async def create( + self, + resource_group_name: str, + workspace_name: str, + source_control_id: str, + source_control: SourceControl, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> SourceControl: ... + + @overload + async def create( + self, + resource_group_name: str, + workspace_name: str, + source_control_id: str, + source_control: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> SourceControl: ... + + @overload + async def delete( + self, + resource_group_name: str, + workspace_name: str, + source_control_id: str, + repository_access: RepositoryAccessProperties, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Warning: ... + + @overload + async def delete( + self, + resource_group_name: str, + workspace_name: str, + source_control_id: str, + repository_access: RepositoryAccessProperties, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Warning: ... + + @overload + async def delete( + self, + resource_group_name: str, + workspace_name: str, + source_control_id: str, + repository_access: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Warning: ... + + @distributed_trace_async + async def get( + self, + resource_group_name: str, + workspace_name: str, + source_control_id: str, + **kwargs: Any + ) -> SourceControl: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs: Any + ) -> AsyncItemPaged[SourceControl]: ... + + + class azure.mgmt.securityinsight.aio.operations.ThreatIntelligenceIndicatorMetricsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace_async + async def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs: Any + ) -> ThreatIntelligenceMetricsList: ... + + + class azure.mgmt.securityinsight.aio.operations.ThreatIntelligenceIndicatorOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def append_tags( + self, + resource_group_name: str, + workspace_name: str, + name: str, + threat_intelligence_append_tags: ThreatIntelligenceAppendTags, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> None: ... + + @overload + async def append_tags( + self, + resource_group_name: str, + workspace_name: str, + name: str, + threat_intelligence_append_tags: ThreatIntelligenceAppendTags, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> None: ... + + @overload + async def append_tags( + self, + resource_group_name: str, + workspace_name: str, + name: str, + threat_intelligence_append_tags: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> None: ... + + @overload + async def create( + self, + resource_group_name: str, + workspace_name: str, + name: str, + threat_intelligence_properties: ThreatIntelligenceIndicatorModel, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ThreatIntelligenceInformation: ... + + @overload + async def create( + self, + resource_group_name: str, + workspace_name: str, + name: str, + threat_intelligence_properties: ThreatIntelligenceIndicatorModel, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ThreatIntelligenceInformation: ... + + @overload + async def create( + self, + resource_group_name: str, + workspace_name: str, + name: str, + threat_intelligence_properties: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ThreatIntelligenceInformation: ... + + @overload + async def create_indicator( + self, + resource_group_name: str, + workspace_name: str, + threat_intelligence_properties: ThreatIntelligenceIndicatorModel, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ThreatIntelligenceInformation: ... + + @overload + async def create_indicator( + self, + resource_group_name: str, + workspace_name: str, + threat_intelligence_properties: ThreatIntelligenceIndicatorModel, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ThreatIntelligenceInformation: ... + + @overload + async def create_indicator( + self, + resource_group_name: str, + workspace_name: str, + threat_intelligence_properties: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ThreatIntelligenceInformation: ... + + @distributed_trace_async + async def delete( + self, + resource_group_name: str, + workspace_name: str, + name: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace_async + async def get( + self, + resource_group_name: str, + workspace_name: str, + name: str, + **kwargs: Any + ) -> ThreatIntelligenceInformation: ... + + @overload + def query_indicators( + self, + resource_group_name: str, + workspace_name: str, + threat_intelligence_filtering_criteria: ThreatIntelligenceFilteringCriteria, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> AsyncItemPaged[ThreatIntelligenceInformation]: ... + + @overload + def query_indicators( + self, + resource_group_name: str, + workspace_name: str, + threat_intelligence_filtering_criteria: ThreatIntelligenceFilteringCriteria, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> AsyncItemPaged[ThreatIntelligenceInformation]: ... + + @overload + def query_indicators( + self, + resource_group_name: str, + workspace_name: str, + threat_intelligence_filtering_criteria: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> AsyncItemPaged[ThreatIntelligenceInformation]: ... + + @overload + async def replace_tags( + self, + resource_group_name: str, + workspace_name: str, + name: str, + threat_intelligence_replace_tags: ThreatIntelligenceIndicatorModel, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ThreatIntelligenceInformation: ... + + @overload + async def replace_tags( + self, + resource_group_name: str, + workspace_name: str, + name: str, + threat_intelligence_replace_tags: ThreatIntelligenceIndicatorModel, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ThreatIntelligenceInformation: ... + + @overload + async def replace_tags( + self, + resource_group_name: str, + workspace_name: str, + name: str, + threat_intelligence_replace_tags: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ThreatIntelligenceInformation: ... + + + class azure.mgmt.securityinsight.aio.operations.ThreatIntelligenceIndicatorsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + *, + filter: Optional[str] = ..., + orderby: Optional[str] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> AsyncItemPaged[ThreatIntelligenceInformation]: ... + + + class azure.mgmt.securityinsight.aio.operations.ThreatIntelligenceOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def count( + self, + resource_group_name: str, + workspace_name: str, + ti_type: Union[str, TiType], + query: Optional[CountQuery] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ThreatIntelligenceCount: ... + + @overload + async def count( + self, + resource_group_name: str, + workspace_name: str, + ti_type: Union[str, TiType], + query: Optional[CountQuery] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ThreatIntelligenceCount: ... + + @overload + async def count( + self, + resource_group_name: str, + workspace_name: str, + ti_type: Union[str, TiType], + query: Optional[IO[bytes]] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ThreatIntelligenceCount: ... + + @overload + def query( + self, + resource_group_name: str, + workspace_name: str, + ti_type: Union[str, TiType], + query: Optional[Query] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> AsyncItemPaged[TIObject]: ... + + @overload + def query( + self, + resource_group_name: str, + workspace_name: str, + ti_type: Union[str, TiType], + query: Optional[Query] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> AsyncItemPaged[TIObject]: ... + + @overload + def query( + self, + resource_group_name: str, + workspace_name: str, + ti_type: Union[str, TiType], + query: Optional[IO[bytes]] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> AsyncItemPaged[TIObject]: ... + + + class azure.mgmt.securityinsight.aio.operations.TriggeredAnalyticsRuleRunOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace_async + async def get( + self, + resource_group_name: str, + workspace_name: str, + rule_run_id: str, + **kwargs: Any + ) -> TriggeredAnalyticsRuleRun: ... + + + class azure.mgmt.securityinsight.aio.operations.UpdateOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def recommendation( + self, + resource_group_name: str, + workspace_name: str, + recommendation_id: str, + recommendation_patch: RecommendationPatch, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Recommendation: ... + + @overload + async def recommendation( + self, + resource_group_name: str, + workspace_name: str, + recommendation_id: str, + recommendation_patch: RecommendationPatch, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Recommendation: ... + + @overload + async def recommendation( + self, + resource_group_name: str, + workspace_name: str, + recommendation_id: str, + recommendation_patch: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Recommendation: ... + + + class azure.mgmt.securityinsight.aio.operations.WatchlistItemsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + watchlist_alias: str, + watchlist_item_id: str, + watchlist_item: WatchlistItem, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> WatchlistItem: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + watchlist_alias: str, + watchlist_item_id: str, + watchlist_item: WatchlistItem, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> WatchlistItem: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + watchlist_alias: str, + watchlist_item_id: str, + watchlist_item: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> WatchlistItem: ... + + @distributed_trace_async + async def delete( + self, + resource_group_name: str, + workspace_name: str, + watchlist_alias: str, + watchlist_item_id: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace_async + async def get( + self, + resource_group_name: str, + workspace_name: str, + watchlist_alias: str, + watchlist_item_id: str, + **kwargs: Any + ) -> WatchlistItem: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + watchlist_alias: str, + *, + skip_token: Optional[str] = ..., + **kwargs: Any + ) -> AsyncItemPaged[WatchlistItem]: ... + + + class azure.mgmt.securityinsight.aio.operations.WatchlistsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def begin_create_or_update( + self, + resource_group_name: str, + workspace_name: str, + watchlist_alias: str, + watchlist: Watchlist, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> AsyncLROPoller[Watchlist]: ... + + @overload + async def begin_create_or_update( + self, + resource_group_name: str, + workspace_name: str, + watchlist_alias: str, + watchlist: Watchlist, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> AsyncLROPoller[Watchlist]: ... + + @overload + async def begin_create_or_update( + self, + resource_group_name: str, + workspace_name: str, + watchlist_alias: str, + watchlist: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> AsyncLROPoller[Watchlist]: ... + + @distributed_trace_async + async def begin_delete( + self, + resource_group_name: str, + workspace_name: str, + watchlist_alias: str, + **kwargs: Any + ) -> AsyncLROPoller[Watchlist]: ... + + @distributed_trace_async + async def get( + self, + resource_group_name: str, + workspace_name: str, + watchlist_alias: str, + **kwargs: Any + ) -> Watchlist: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + *, + skip_token: Optional[str] = ..., + **kwargs: Any + ) -> AsyncItemPaged[Watchlist]: ... + + + class azure.mgmt.securityinsight.aio.operations.WorkspaceManagerAssignmentJobsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace_async + async def create( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_assignment_name: str, + **kwargs: Any + ) -> Job: ... + + @distributed_trace_async + async def delete( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_assignment_name: str, + job_name: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace_async + async def get( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_assignment_name: str, + job_name: str, + **kwargs: Any + ) -> Job: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_assignment_name: str, + *, + orderby: Optional[str] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> AsyncItemPaged[Job]: ... + + + class azure.mgmt.securityinsight.aio.operations.WorkspaceManagerAssignmentsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_assignment_name: str, + workspace_manager_assignment: WorkspaceManagerAssignment, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> WorkspaceManagerAssignment: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_assignment_name: str, + workspace_manager_assignment: WorkspaceManagerAssignment, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> WorkspaceManagerAssignment: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_assignment_name: str, + workspace_manager_assignment: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> WorkspaceManagerAssignment: ... + + @distributed_trace_async + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'workspace_manager_assignment_name']}, api_versions_list=['2025-10-01-preview']) + async def delete( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_assignment_name: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace_async + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'workspace_manager_assignment_name', 'accept']}, api_versions_list=['2025-10-01-preview']) + async def get( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_assignment_name: str, + **kwargs: Any + ) -> WorkspaceManagerAssignment: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'orderby', 'top', 'skip_token', 'accept']}, api_versions_list=['2025-10-01-preview']) + def list( + self, + resource_group_name: str, + workspace_name: str, + *, + orderby: Optional[str] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> AsyncItemPaged[WorkspaceManagerAssignment]: ... + + + class azure.mgmt.securityinsight.aio.operations.WorkspaceManagerConfigurationsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_configuration_name: str, + workspace_manager_configuration: WorkspaceManagerConfiguration, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> WorkspaceManagerConfiguration: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_configuration_name: str, + workspace_manager_configuration: WorkspaceManagerConfiguration, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> WorkspaceManagerConfiguration: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_configuration_name: str, + workspace_manager_configuration: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> WorkspaceManagerConfiguration: ... + + @distributed_trace_async + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'workspace_manager_configuration_name']}, api_versions_list=['2025-10-01-preview']) + async def delete( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_configuration_name: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace_async + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'workspace_manager_configuration_name', 'accept']}, api_versions_list=['2025-10-01-preview']) + async def get( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_configuration_name: str, + **kwargs: Any + ) -> WorkspaceManagerConfiguration: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'orderby', 'top', 'skip_token', 'accept']}, api_versions_list=['2025-10-01-preview']) + def list( + self, + resource_group_name: str, + workspace_name: str, + *, + orderby: Optional[str] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> AsyncItemPaged[WorkspaceManagerConfiguration]: ... + + + class azure.mgmt.securityinsight.aio.operations.WorkspaceManagerGroupsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_group_name: str, + workspace_manager_group: WorkspaceManagerGroup, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> WorkspaceManagerGroup: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_group_name: str, + workspace_manager_group: WorkspaceManagerGroup, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> WorkspaceManagerGroup: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_group_name: str, + workspace_manager_group: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> WorkspaceManagerGroup: ... + + @distributed_trace_async + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'workspace_manager_group_name']}, api_versions_list=['2025-10-01-preview']) + async def delete( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_group_name: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace_async + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'workspace_manager_group_name', 'accept']}, api_versions_list=['2025-10-01-preview']) + async def get( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_group_name: str, + **kwargs: Any + ) -> WorkspaceManagerGroup: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'orderby', 'top', 'skip_token', 'accept']}, api_versions_list=['2025-10-01-preview']) + def list( + self, + resource_group_name: str, + workspace_name: str, + *, + orderby: Optional[str] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> AsyncItemPaged[WorkspaceManagerGroup]: ... + + + class azure.mgmt.securityinsight.aio.operations.WorkspaceManagerMembersOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_member_name: str, + workspace_manager_member: WorkspaceManagerMember, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> WorkspaceManagerMember: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_member_name: str, + workspace_manager_member: WorkspaceManagerMember, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> WorkspaceManagerMember: ... + + @overload + async def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_member_name: str, + workspace_manager_member: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> WorkspaceManagerMember: ... + + @distributed_trace_async + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'workspace_manager_member_name']}, api_versions_list=['2025-10-01-preview']) + async def delete( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_member_name: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace_async + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'workspace_manager_member_name', 'accept']}, api_versions_list=['2025-10-01-preview']) + async def get( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_member_name: str, + **kwargs: Any + ) -> WorkspaceManagerMember: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'orderby', 'top', 'skip_token', 'accept']}, api_versions_list=['2025-10-01-preview']) + def list( + self, + resource_group_name: str, + workspace_name: str, + *, + orderby: Optional[str] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> AsyncItemPaged[WorkspaceManagerMember]: ... + + +namespace azure.mgmt.securityinsight.models + + class azure.mgmt.securityinsight.models.AADCheckRequirements(DataConnectorsCheckRequirements, discriminator='AzureActiveDirectory'): + kind: Literal[DataConnectorKind.AZURE_ACTIVE_DIRECTORY] + properties: Optional[AADCheckRequirementsProperties] + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[AADCheckRequirementsProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.AADCheckRequirementsProperties(DataConnectorTenantId): + tenant_id: str + + @overload + def __init__( + self, + *, + tenant_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AADDataConnector(DataConnector, discriminator='AzureActiveDirectory'): + etag: str + id: str + kind: Literal[DataConnectorKind.AZURE_ACTIVE_DIRECTORY] + name: str + properties: Optional[AADDataConnectorProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[AADDataConnectorProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.AADDataConnectorProperties(_Model): + data_types: Optional[AlertsDataTypeOfDataConnector] + tenant_id: str + + @overload + def __init__( + self, + *, + data_types: Optional[AlertsDataTypeOfDataConnector] = ..., + tenant_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AATPCheckRequirements(DataConnectorsCheckRequirements, discriminator='AzureAdvancedThreatProtection'): + kind: Literal[DataConnectorKind.AZURE_ADVANCED_THREAT_PROTECTION] + properties: Optional[AATPCheckRequirementsProperties] + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[AATPCheckRequirementsProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.AATPCheckRequirementsProperties(DataConnectorTenantId): + tenant_id: str + + @overload + def __init__( + self, + *, + tenant_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AATPDataConnector(DataConnector, discriminator='AzureAdvancedThreatProtection'): + etag: str + id: str + kind: Literal[DataConnectorKind.AZURE_ADVANCED_THREAT_PROTECTION] + name: str + properties: Optional[AATPDataConnectorProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[AATPDataConnectorProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.AATPDataConnectorProperties(_Model): + data_types: Optional[AlertsDataTypeOfDataConnector] + tenant_id: str + + @overload + def __init__( + self, + *, + data_types: Optional[AlertsDataTypeOfDataConnector] = ..., + tenant_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ASCCheckRequirements(DataConnectorsCheckRequirements, discriminator='AzureSecurityCenter'): + kind: Literal[DataConnectorKind.AZURE_SECURITY_CENTER] + properties: Optional[ASCCheckRequirementsProperties] + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[ASCCheckRequirementsProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.ASCCheckRequirementsProperties(_Model): + subscription_id: Optional[str] + + @overload + def __init__( + self, + *, + subscription_id: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ASCDataConnector(DataConnector, discriminator='AzureSecurityCenter'): + etag: str + id: str + kind: Literal[DataConnectorKind.AZURE_SECURITY_CENTER] + name: str + properties: Optional[ASCDataConnectorProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[ASCDataConnectorProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.ASCDataConnectorProperties(DataConnectorWithAlertsProperties): + data_types: AlertsDataTypeOfDataConnector + subscription_id: Optional[str] + + @overload + def __init__( + self, + *, + data_types: Optional[AlertsDataTypeOfDataConnector] = ..., + subscription_id: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AWSAuthModel(CcpAuthConfig, discriminator='AWS'): + external_id: Optional[str] + role_arn: str + type: Literal[CcpAuthType.AWS] + + @overload + def __init__( + self, + *, + external_id: Optional[str] = ..., + role_arn: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AccountEntity(Entity, discriminator='Account'): + id: str + kind: Literal[EntityKind.ACCOUNT] + name: str + properties: Optional[AccountEntityProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[AccountEntityProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.AccountEntityProperties(EntityCommonProperties): + aad_tenant_id: Optional[str] + aad_user_id: Optional[str] + account_name: Optional[str] + additional_data: dict[str, any] + display_name: Optional[str] + dns_domain: Optional[str] + friendly_name: str + host_entity_id: Optional[str] + is_domain_joined: Optional[bool] + nt_domain: Optional[str] + object_guid: Optional[str] + puid: Optional[str] + sid: Optional[str] + upn_suffix: Optional[str] + + + class azure.mgmt.securityinsight.models.ActionPropertiesBase(_Model): + logic_app_resource_id: str + + @overload + def __init__( + self, + *, + logic_app_resource_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ActionRequest(ResourceWithEtag): + etag: str + id: str + name: str + properties: Optional[ActionRequestProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[ActionRequestProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.ActionRequestProperties(ActionPropertiesBase): + logic_app_resource_id: str + trigger_uri: str + + @overload + def __init__( + self, + *, + logic_app_resource_id: str, + trigger_uri: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ActionResponse(ProxyResource): + etag: Optional[str] + id: str + name: str + properties: Optional[ActionResponseProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[ActionResponseProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.ActionResponseProperties(ActionPropertiesBase): + logic_app_resource_id: str + workflow_id: Optional[str] + + @overload + def __init__( + self, + *, + logic_app_resource_id: str, + workflow_id: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ActionType(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ADD_INCIDENT_TASK = "AddIncidentTask" + MODIFY_PROPERTIES = "ModifyProperties" + RUN_PLAYBOOK = "RunPlaybook" + + + class azure.mgmt.securityinsight.models.ActivityCustomEntityQuery(CustomEntityQuery, discriminator='Activity'): + etag: str + id: str + kind: Literal[CustomEntityQueryKind.ACTIVITY] + name: str + properties: Optional[ActivityEntityQueriesProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[ActivityEntityQueriesProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.ActivityEntityQueriesProperties(_Model): + content: Optional[str] + created_time_utc: Optional[datetime] + description: Optional[str] + enabled: Optional[bool] + entities_filter: Optional[dict[str, list[str]]] + input_entity_type: Optional[Union[str, EntityType]] + last_modified_time_utc: Optional[datetime] + query_definitions: Optional[ActivityEntityQueriesPropertiesQueryDefinitions] + required_input_fields_sets: Optional[list[list[str]]] + template_name: Optional[str] + title: Optional[str] + + @overload + def __init__( + self, + *, + content: Optional[str] = ..., + description: Optional[str] = ..., + enabled: Optional[bool] = ..., + entities_filter: Optional[dict[str, list[str]]] = ..., + input_entity_type: Optional[Union[str, EntityType]] = ..., + query_definitions: Optional[ActivityEntityQueriesPropertiesQueryDefinitions] = ..., + required_input_fields_sets: Optional[list[list[str]]] = ..., + template_name: Optional[str] = ..., + title: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ActivityEntityQueriesPropertiesQueryDefinitions(_Model): + query: Optional[str] + + @overload + def __init__( + self, + *, + query: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ActivityEntityQuery(EntityQuery, discriminator='Activity'): + etag: str + id: str + kind: Literal[EntityQueryKind.ACTIVITY] + name: str + properties: Optional[ActivityEntityQueriesProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[ActivityEntityQueriesProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.ActivityEntityQueryTemplate(EntityQueryTemplate, discriminator='Activity'): + id: str + kind: Literal[EntityQueryTemplateKind.ACTIVITY] + name: str + properties: Optional[ActivityEntityQueryTemplateProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[ActivityEntityQueryTemplateProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.ActivityEntityQueryTemplateProperties(_Model): + content: Optional[str] + data_types: Optional[list[DataTypeDefinitions]] + description: Optional[str] + entities_filter: Optional[dict[str, list[str]]] + input_entity_type: Optional[Union[str, EntityType]] + query_definitions: Optional[ActivityEntityQueryTemplatePropertiesQueryDefinitions] + required_input_fields_sets: Optional[list[list[str]]] + title: Optional[str] + + @overload + def __init__( + self, + *, + content: Optional[str] = ..., + data_types: Optional[list[DataTypeDefinitions]] = ..., + description: Optional[str] = ..., + entities_filter: Optional[dict[str, list[str]]] = ..., + input_entity_type: Optional[Union[str, EntityType]] = ..., + query_definitions: Optional[ActivityEntityQueryTemplatePropertiesQueryDefinitions] = ..., + required_input_fields_sets: Optional[list[list[str]]] = ..., + title: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ActivityEntityQueryTemplatePropertiesQueryDefinitions(_Model): + query: Optional[str] + summarize_by: Optional[str] + + @overload + def __init__( + self, + *, + query: Optional[str] = ..., + summarize_by: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ActivityTimelineItem(EntityTimelineItem, discriminator='Activity'): + bucket_end_time_utc: datetime + bucket_start_time_utc: datetime + content: str + first_activity_time_utc: datetime + kind: Literal[EntityTimelineKind.ACTIVITY] + last_activity_time_utc: datetime + query_id: str + title: str + + @overload + def __init__( + self, + *, + bucket_end_time_utc: datetime, + bucket_start_time_utc: datetime, + content: str, + first_activity_time_utc: datetime, + last_activity_time_utc: datetime, + query_id: str, + title: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AddIncidentTaskActionProperties(_Model): + description: Optional[str] + title: str + + @overload + def __init__( + self, + *, + description: Optional[str] = ..., + title: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AlertDetail(str, Enum, metaclass=CaseInsensitiveEnumMeta): + DISPLAY_NAME = "DisplayName" + SEVERITY = "Severity" + + + class azure.mgmt.securityinsight.models.AlertDetailsOverride(_Model): + alert_description_format: Optional[str] + alert_display_name_format: Optional[str] + alert_dynamic_properties: Optional[list[AlertPropertyMapping]] + alert_severity_column_name: Optional[str] + alert_tactics_column_name: Optional[str] + + @overload + def __init__( + self, + *, + alert_description_format: Optional[str] = ..., + alert_display_name_format: Optional[str] = ..., + alert_dynamic_properties: Optional[list[AlertPropertyMapping]] = ..., + alert_severity_column_name: Optional[str] = ..., + alert_tactics_column_name: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AlertProperty(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ALERT_LINK = "AlertLink" + CONFIDENCE_LEVEL = "ConfidenceLevel" + CONFIDENCE_SCORE = "ConfidenceScore" + EXTENDED_LINKS = "ExtendedLinks" + PRODUCT_COMPONENT_NAME = "ProductComponentName" + PRODUCT_NAME = "ProductName" + PROVIDER_NAME = "ProviderName" + REMEDIATION_STEPS = "RemediationSteps" + SUB_TECHNIQUES = "SubTechniques" + TECHNIQUES = "Techniques" + + + class azure.mgmt.securityinsight.models.AlertPropertyMapping(_Model): + alert_property: Optional[Union[str, AlertProperty]] + value: Optional[str] + + @overload + def __init__( + self, + *, + alert_property: Optional[Union[str, AlertProperty]] = ..., + value: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AlertRule(ProxyResource): + etag: Optional[str] + id: str + kind: str + name: str + system_data: SystemData + type: str + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + kind: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AlertRuleKind(str, Enum, metaclass=CaseInsensitiveEnumMeta): + FUSION = "Fusion" + MICROSOFT_SECURITY_INCIDENT_CREATION = "MicrosoftSecurityIncidentCreation" + ML_BEHAVIOR_ANALYTICS = "MLBehaviorAnalytics" + NRT = "NRT" + SCHEDULED = "Scheduled" + THREAT_INTELLIGENCE = "ThreatIntelligence" + + + class azure.mgmt.securityinsight.models.AlertRuleTemplate(ProxyResource): + id: str + kind: str + name: str + system_data: SystemData + type: str + + @overload + def __init__( + self, + *, + kind: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AlertRuleTemplateDataSource(_Model): + connector_id: Optional[str] + data_types: Optional[list[str]] + + @overload + def __init__( + self, + *, + connector_id: Optional[str] = ..., + data_types: Optional[list[str]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AlertRuleTemplatePropertiesBase(_Model): + alert_rules_created_by_template_count: Optional[int] + created_date_utc: Optional[datetime] + description: Optional[str] + display_name: Optional[str] + last_updated_date_utc: Optional[datetime] + required_data_connectors: Optional[list[AlertRuleTemplateDataSource]] + status: Optional[Union[str, TemplateStatus]] + + @overload + def __init__( + self, + *, + alert_rules_created_by_template_count: Optional[int] = ..., + description: Optional[str] = ..., + display_name: Optional[str] = ..., + required_data_connectors: Optional[list[AlertRuleTemplateDataSource]] = ..., + status: Optional[Union[str, TemplateStatus]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AlertRuleTemplateWithMitreProperties(AlertRuleTemplatePropertiesBase): + alert_rules_created_by_template_count: int + created_date_utc: datetime + description: str + display_name: str + last_updated_date_utc: datetime + required_data_connectors: list[AlertRuleTemplateDataSource] + status: Union[str, TemplateStatus] + tactics: Optional[list[Union[str, AttackTactic]]] + techniques: Optional[list[str]] + + @overload + def __init__( + self, + *, + alert_rules_created_by_template_count: Optional[int] = ..., + description: Optional[str] = ..., + display_name: Optional[str] = ..., + required_data_connectors: Optional[list[AlertRuleTemplateDataSource]] = ..., + status: Optional[Union[str, TemplateStatus]] = ..., + tactics: Optional[list[Union[str, AttackTactic]]] = ..., + techniques: Optional[list[str]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AlertSeverity(str, Enum, metaclass=CaseInsensitiveEnumMeta): + HIGH = "High" + INFORMATIONAL = "Informational" + LOW = "Low" + MEDIUM = "Medium" + + + class azure.mgmt.securityinsight.models.AlertStatus(str, Enum, metaclass=CaseInsensitiveEnumMeta): + DISMISSED = "Dismissed" + IN_PROGRESS = "InProgress" + NEW = "New" + RESOLVED = "Resolved" + UNKNOWN = "Unknown" + + + class azure.mgmt.securityinsight.models.AlertsDataTypeOfDataConnector(_Model): + alerts: DataConnectorDataTypeCommon + + @overload + def __init__( + self, + *, + alerts: DataConnectorDataTypeCommon + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AnalyticsRuleRunTrigger(_Model): + properties: AnalyticsRuleRunTriggerProperties + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: AnalyticsRuleRunTriggerProperties + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.AnalyticsRuleRunTriggerProperties(_Model): + execution_time_utc: datetime + + @overload + def __init__( + self, + *, + execution_time_utc: datetime + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.Anomalies(Settings, discriminator='Anomalies'): + etag: str + id: str + kind: Literal[SettingKind.ANOMALIES] + name: str + properties: Optional[AnomaliesSettingsProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[AnomaliesSettingsProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.AnomaliesSettingsProperties(_Model): + is_enabled: Optional[bool] + + + class azure.mgmt.securityinsight.models.AnomalySecurityMLAnalyticsSettings(SecurityMLAnalyticsSetting, discriminator='Anomaly'): + etag: str + id: str + kind: Literal[SecurityMLAnalyticsSettingsKind.ANOMALY] + name: str + properties: Optional[AnomalySecurityMLAnalyticsSettingsProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[AnomalySecurityMLAnalyticsSettingsProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.AnomalySecurityMLAnalyticsSettingsProperties(_Model): + anomaly_settings_version: Optional[int] + anomaly_version: str + customizable_observations: Optional[Any] + description: Optional[str] + display_name: str + enabled: bool + frequency: timedelta + is_default_settings: bool + last_modified_utc: Optional[datetime] + required_data_connectors: Optional[list[SecurityMLAnalyticsSettingsDataSource]] + settings_definition_id: Optional[str] + settings_status: Union[str, SettingsStatus] + tactics: Optional[list[Union[str, AttackTactic]]] + techniques: Optional[list[str]] + + @overload + def __init__( + self, + *, + anomaly_settings_version: Optional[int] = ..., + anomaly_version: str, + customizable_observations: Optional[Any] = ..., + description: Optional[str] = ..., + display_name: str, + enabled: bool, + frequency: timedelta, + is_default_settings: bool, + required_data_connectors: Optional[list[SecurityMLAnalyticsSettingsDataSource]] = ..., + settings_definition_id: Optional[str] = ..., + settings_status: Union[str, SettingsStatus], + tactics: Optional[list[Union[str, AttackTactic]]] = ..., + techniques: Optional[list[str]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AnomalyTimelineItem(EntityTimelineItem, discriminator='Anomaly'): + azure_resource_id: str + description: Optional[str] + display_name: str + end_time_utc: datetime + intent: Optional[str] + kind: Literal[EntityTimelineKind.ANOMALY] + product_name: Optional[str] + reasons: Optional[list[str]] + start_time_utc: datetime + techniques: Optional[list[str]] + time_generated: datetime + vendor: Optional[str] + + @overload + def __init__( + self, + *, + azure_resource_id: str, + description: Optional[str] = ..., + display_name: str, + end_time_utc: datetime, + intent: Optional[str] = ..., + product_name: Optional[str] = ..., + reasons: Optional[list[str]] = ..., + start_time_utc: datetime, + techniques: Optional[list[str]] = ..., + time_generated: datetime, + vendor: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AntispamMailDirection(str, Enum, metaclass=CaseInsensitiveEnumMeta): + INBOUND = "Inbound" + INTRAORG = "Intraorg" + OUTBOUND = "Outbound" + UNKNOWN = "Unknown" + + + class azure.mgmt.securityinsight.models.ApiKeyAuthModel(CcpAuthConfig, discriminator='APIKey'): + api_key: str + api_key_identifier: Optional[str] + api_key_name: str + is_api_key_in_post_payload: Optional[bool] + type: Literal[CcpAuthType.API_KEY] + + @overload + def __init__( + self, + *, + api_key: str, + api_key_identifier: Optional[str] = ..., + api_key_name: str, + is_api_key_in_post_payload: Optional[bool] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ApiPollingParameters(_Model): + connector_ui_config: Optional[CodelessUiConnectorConfigProperties] + polling_config: Optional[CodelessConnectorPollingConfigProperties] + + @overload + def __init__( + self, + *, + connector_ui_config: Optional[CodelessUiConnectorConfigProperties] = ..., + polling_config: Optional[CodelessConnectorPollingConfigProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AssignmentItem(_Model): + resource_id: Optional[str] + + @overload + def __init__( + self, + *, + resource_id: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AttackPattern(TIObject, discriminator='AttackPattern'): + id: str + kind: Literal[TIObjectKind.ATTACK_PATTERN] + name: str + properties: TIObjectCommonProperties + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[TIObjectCommonProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.AttackTactic(str, Enum, metaclass=CaseInsensitiveEnumMeta): + COLLECTION = "Collection" + COMMAND_AND_CONTROL = "CommandAndControl" + CREDENTIAL_ACCESS = "CredentialAccess" + DEFENSE_EVASION = "DefenseEvasion" + DISCOVERY = "Discovery" + EXECUTION = "Execution" + EXFILTRATION = "Exfiltration" + IMPACT = "Impact" + IMPAIR_PROCESS_CONTROL = "ImpairProcessControl" + INHIBIT_RESPONSE_FUNCTION = "InhibitResponseFunction" + INITIAL_ACCESS = "InitialAccess" + LATERAL_MOVEMENT = "LateralMovement" + PERSISTENCE = "Persistence" + PRE_ATTACK = "PreAttack" + PRIVILEGE_ESCALATION = "PrivilegeEscalation" + RECONNAISSANCE = "Reconnaissance" + RESOURCE_DEVELOPMENT = "ResourceDevelopment" + + + class azure.mgmt.securityinsight.models.AutomationRule(ProxyResource): + etag: Optional[str] + id: str + name: str + properties: AutomationRuleProperties + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: AutomationRuleProperties + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.AutomationRuleAction(_Model): + action_type: str + order: int + + @overload + def __init__( + self, + *, + action_type: str, + order: int + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AutomationRuleAddIncidentTaskAction(AutomationRuleAction, discriminator='AddIncidentTask'): + action_configuration: Optional[AddIncidentTaskActionProperties] + action_type: Literal[ActionType.ADD_INCIDENT_TASK] + order: int + + @overload + def __init__( + self, + *, + action_configuration: Optional[AddIncidentTaskActionProperties] = ..., + order: int + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AutomationRuleBooleanCondition(_Model): + inner_conditions: Optional[list[AutomationRuleCondition]] + operator: Optional[Union[str, AutomationRuleBooleanConditionSupportedOperator]] + + @overload + def __init__( + self, + *, + inner_conditions: Optional[list[AutomationRuleCondition]] = ..., + operator: Optional[Union[str, AutomationRuleBooleanConditionSupportedOperator]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AutomationRuleBooleanConditionSupportedOperator(str, Enum, metaclass=CaseInsensitiveEnumMeta): + AND = "And" + OR = "Or" + + + class azure.mgmt.securityinsight.models.AutomationRuleCondition(_Model): + condition_type: str + + @overload + def __init__( + self, + *, + condition_type: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AutomationRuleModifyPropertiesAction(AutomationRuleAction, discriminator='ModifyProperties'): + action_configuration: Optional[IncidentPropertiesAction] + action_type: Literal[ActionType.MODIFY_PROPERTIES] + order: int + + @overload + def __init__( + self, + *, + action_configuration: Optional[IncidentPropertiesAction] = ..., + order: int + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AutomationRuleProperties(_Model): + actions: list[AutomationRuleAction] + created_by: Optional[ClientInfo] + created_time_utc: Optional[datetime] + display_name: str + last_modified_by: Optional[ClientInfo] + last_modified_time_utc: Optional[datetime] + order: int + triggering_logic: AutomationRuleTriggeringLogic + + @overload + def __init__( + self, + *, + actions: list[AutomationRuleAction], + display_name: str, + order: int, + triggering_logic: AutomationRuleTriggeringLogic + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AutomationRulePropertyArrayChangedConditionSupportedArrayType(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ALERTS = "Alerts" + COMMENTS = "Comments" + LABELS = "Labels" + TACTICS = "Tactics" + + + class azure.mgmt.securityinsight.models.AutomationRulePropertyArrayChangedConditionSupportedChangeType(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ADDED = "Added" + + + class azure.mgmt.securityinsight.models.AutomationRulePropertyArrayChangedValuesCondition(_Model): + array_type: Optional[Union[str, AutomationRulePropertyArrayChangedConditionSupportedArrayType]] + change_type: Optional[Union[str, AutomationRulePropertyArrayChangedConditionSupportedChangeType]] + + @overload + def __init__( + self, + *, + array_type: Optional[Union[str, AutomationRulePropertyArrayChangedConditionSupportedArrayType]] = ..., + change_type: Optional[Union[str, AutomationRulePropertyArrayChangedConditionSupportedChangeType]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AutomationRulePropertyArrayConditionSupportedArrayConditionType(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ALL_ITEMS = "AllItems" + ANY_ITEM = "AnyItem" + + + class azure.mgmt.securityinsight.models.AutomationRulePropertyArrayConditionSupportedArrayType(str, Enum, metaclass=CaseInsensitiveEnumMeta): + CUSTOM_DETAILS = "CustomDetails" + CUSTOM_DETAIL_VALUES = "CustomDetailValues" + INCIDENT_LABELS = "IncidentLabels" + + + class azure.mgmt.securityinsight.models.AutomationRulePropertyArrayValuesCondition(_Model): + array_condition_type: Optional[Union[str, AutomationRulePropertyArrayConditionSupportedArrayConditionType]] + array_type: Optional[Union[str, AutomationRulePropertyArrayConditionSupportedArrayType]] + item_conditions: Optional[list[AutomationRuleCondition]] + + @overload + def __init__( + self, + *, + array_condition_type: Optional[Union[str, AutomationRulePropertyArrayConditionSupportedArrayConditionType]] = ..., + array_type: Optional[Union[str, AutomationRulePropertyArrayConditionSupportedArrayType]] = ..., + item_conditions: Optional[list[AutomationRuleCondition]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AutomationRulePropertyChangedConditionSupportedChangedType(str, Enum, metaclass=CaseInsensitiveEnumMeta): + CHANGED_FROM = "ChangedFrom" + CHANGED_TO = "ChangedTo" + + + class azure.mgmt.securityinsight.models.AutomationRulePropertyChangedConditionSupportedPropertyType(str, Enum, metaclass=CaseInsensitiveEnumMeta): + INCIDENT_OWNER = "IncidentOwner" + INCIDENT_SEVERITY = "IncidentSeverity" + INCIDENT_STATUS = "IncidentStatus" + + + class azure.mgmt.securityinsight.models.AutomationRulePropertyConditionSupportedOperator(str, Enum, metaclass=CaseInsensitiveEnumMeta): + CONTAINS = "Contains" + ENDS_WITH = "EndsWith" + EQUALS = "Equals" + NOT_CONTAINS = "NotContains" + NOT_ENDS_WITH = "NotEndsWith" + NOT_EQUALS = "NotEquals" + NOT_STARTS_WITH = "NotStartsWith" + STARTS_WITH = "StartsWith" + + + class azure.mgmt.securityinsight.models.AutomationRulePropertyConditionSupportedProperty(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ACCOUNT_AAD_TENANT_ID = "AccountAadTenantId" + ACCOUNT_AAD_USER_ID = "AccountAadUserId" + ACCOUNT_NAME = "AccountName" + ACCOUNT_NT_DOMAIN = "AccountNTDomain" + ACCOUNT_OBJECT_GUID = "AccountObjectGuid" + ACCOUNT_PUID = "AccountPUID" + ACCOUNT_SID = "AccountSid" + ACCOUNT_UPN_SUFFIX = "AccountUPNSuffix" + ALERT_ANALYTIC_RULE_IDS = "AlertAnalyticRuleIds" + ALERT_PRODUCT_NAMES = "AlertProductNames" + AZURE_RESOURCE_RESOURCE_ID = "AzureResourceResourceId" + AZURE_RESOURCE_SUBSCRIPTION_ID = "AzureResourceSubscriptionId" + CLOUD_APPLICATION_APP_ID = "CloudApplicationAppId" + CLOUD_APPLICATION_APP_NAME = "CloudApplicationAppName" + DNS_DOMAIN_NAME = "DNSDomainName" + FILE_DIRECTORY = "FileDirectory" + FILE_HASH_VALUE = "FileHashValue" + FILE_NAME = "FileName" + HOST_AZURE_ID = "HostAzureID" + HOST_NAME = "HostName" + HOST_NET_BIOS_NAME = "HostNetBiosName" + HOST_NT_DOMAIN = "HostNTDomain" + HOST_OS_VERSION = "HostOSVersion" + INCIDENT_ALERT_TITLE = "IncidentAlertTitle" + INCIDENT_CUSTOM_DETAILS_KEY = "IncidentCustomDetailsKey" + INCIDENT_CUSTOM_DETAILS_VALUE = "IncidentCustomDetailsValue" + INCIDENT_CUSTOM_DETECTION_RULE_IDS = "IncidentCustomDetectionRuleIds" + INCIDENT_DESCRIPTION = "IncidentDescription" + INCIDENT_LABEL = "IncidentLabel" + INCIDENT_PROVIDER_NAME = "IncidentProviderName" + INCIDENT_RELATED_ANALYTIC_RULE_IDS = "IncidentRelatedAnalyticRuleIds" + INCIDENT_SEVERITY = "IncidentSeverity" + INCIDENT_STATUS = "IncidentStatus" + INCIDENT_TACTICS = "IncidentTactics" + INCIDENT_TITLE = "IncidentTitle" + INCIDENT_UPDATED_BY_SOURCE = "IncidentUpdatedBySource" + IO_T_DEVICE_ID = "IoTDeviceId" + IO_T_DEVICE_MODEL = "IoTDeviceModel" + IO_T_DEVICE_NAME = "IoTDeviceName" + IO_T_DEVICE_OPERATING_SYSTEM = "IoTDeviceOperatingSystem" + IO_T_DEVICE_TYPE = "IoTDeviceType" + IO_T_DEVICE_VENDOR = "IoTDeviceVendor" + IP_ADDRESS = "IPAddress" + MAILBOX_DISPLAY_NAME = "MailboxDisplayName" + MAILBOX_PRIMARY_ADDRESS = "MailboxPrimaryAddress" + MAILBOX_UPN = "MailboxUPN" + MAIL_MESSAGE_DELIVERY_ACTION = "MailMessageDeliveryAction" + MAIL_MESSAGE_DELIVERY_LOCATION = "MailMessageDeliveryLocation" + MAIL_MESSAGE_P1_SENDER = "MailMessageP1Sender" + MAIL_MESSAGE_P2_SENDER = "MailMessageP2Sender" + MAIL_MESSAGE_RECIPIENT = "MailMessageRecipient" + MAIL_MESSAGE_SENDER_IP = "MailMessageSenderIP" + MAIL_MESSAGE_SUBJECT = "MailMessageSubject" + MALWARE_CATEGORY = "MalwareCategory" + MALWARE_NAME = "MalwareName" + PROCESS_COMMAND_LINE = "ProcessCommandLine" + PROCESS_ID = "ProcessId" + REGISTRY_KEY = "RegistryKey" + REGISTRY_VALUE_DATA = "RegistryValueData" + URL = "Url" + + + class azure.mgmt.securityinsight.models.AutomationRulePropertyValuesChangedCondition(_Model): + change_type: Optional[Union[str, AutomationRulePropertyChangedConditionSupportedChangedType]] + operator: Optional[Union[str, AutomationRulePropertyConditionSupportedOperator]] + property_name: Optional[Union[str, AutomationRulePropertyChangedConditionSupportedPropertyType]] + property_values: Optional[list[str]] + + @overload + def __init__( + self, + *, + change_type: Optional[Union[str, AutomationRulePropertyChangedConditionSupportedChangedType]] = ..., + operator: Optional[Union[str, AutomationRulePropertyConditionSupportedOperator]] = ..., + property_name: Optional[Union[str, AutomationRulePropertyChangedConditionSupportedPropertyType]] = ..., + property_values: Optional[list[str]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AutomationRulePropertyValuesCondition(_Model): + operator: Optional[Union[str, AutomationRulePropertyConditionSupportedOperator]] + property_name: Optional[Union[str, AutomationRulePropertyConditionSupportedProperty]] + property_values: Optional[list[str]] + + @overload + def __init__( + self, + *, + operator: Optional[Union[str, AutomationRulePropertyConditionSupportedOperator]] = ..., + property_name: Optional[Union[str, AutomationRulePropertyConditionSupportedProperty]] = ..., + property_values: Optional[list[str]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AutomationRuleRunPlaybookAction(AutomationRuleAction, discriminator='RunPlaybook'): + action_configuration: Optional[PlaybookActionProperties] + action_type: Literal[ActionType.RUN_PLAYBOOK] + order: int + + @overload + def __init__( + self, + *, + action_configuration: Optional[PlaybookActionProperties] = ..., + order: int + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AutomationRuleTriggeringLogic(_Model): + conditions: Optional[list[AutomationRuleCondition]] + expiration_time_utc: Optional[datetime] + is_enabled: bool + triggers_on: Union[str, TriggersOn] + triggers_when: Union[str, TriggersWhen] + + @overload + def __init__( + self, + *, + conditions: Optional[list[AutomationRuleCondition]] = ..., + expiration_time_utc: Optional[datetime] = ..., + is_enabled: bool, + triggers_on: Union[str, TriggersOn], + triggers_when: Union[str, TriggersWhen] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.Availability(_Model): + is_preview: Optional[bool] + status: Optional[Literal[1]] + + @overload + def __init__( + self, + *, + is_preview: Optional[bool] = ..., + status: Optional[Literal[1]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AwsCloudTrailCheckRequirements(DataConnectorsCheckRequirements, discriminator='AmazonWebServicesCloudTrail'): + kind: Literal[DataConnectorKind.AMAZON_WEB_SERVICES_CLOUD_TRAIL] + + @overload + def __init__(self) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AwsCloudTrailDataConnector(DataConnector, discriminator='AmazonWebServicesCloudTrail'): + etag: str + id: str + kind: Literal[DataConnectorKind.AMAZON_WEB_SERVICES_CLOUD_TRAIL] + name: str + properties: Optional[AwsCloudTrailDataConnectorProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[AwsCloudTrailDataConnectorProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.AwsCloudTrailDataConnectorDataTypes(_Model): + logs: AwsCloudTrailDataConnectorDataTypesLogs + + @overload + def __init__( + self, + *, + logs: AwsCloudTrailDataConnectorDataTypesLogs + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AwsCloudTrailDataConnectorDataTypesLogs(DataConnectorDataTypeCommon): + state: Union[str, DataTypeState] + + @overload + def __init__( + self, + *, + state: Union[str, DataTypeState] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AwsCloudTrailDataConnectorProperties(_Model): + aws_role_arn: Optional[str] + data_types: AwsCloudTrailDataConnectorDataTypes + + @overload + def __init__( + self, + *, + aws_role_arn: Optional[str] = ..., + data_types: AwsCloudTrailDataConnectorDataTypes + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AwsS3CheckRequirements(DataConnectorsCheckRequirements, discriminator='AmazonWebServicesS3'): + kind: Literal[DataConnectorKind.AMAZON_WEB_SERVICES_S3] + + @overload + def __init__(self) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AwsS3DataConnector(DataConnector, discriminator='AmazonWebServicesS3'): + etag: str + id: str + kind: Literal[DataConnectorKind.AMAZON_WEB_SERVICES_S3] + name: str + properties: Optional[AwsS3DataConnectorProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[AwsS3DataConnectorProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.AwsS3DataConnectorDataTypes(_Model): + logs: AwsS3DataConnectorDataTypesLogs + + @overload + def __init__( + self, + *, + logs: AwsS3DataConnectorDataTypesLogs + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AwsS3DataConnectorDataTypesLogs(DataConnectorDataTypeCommon): + state: Union[str, DataTypeState] + + @overload + def __init__( + self, + *, + state: Union[str, DataTypeState] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AwsS3DataConnectorProperties(_Model): + data_types: AwsS3DataConnectorDataTypes + destination_table: str + role_arn: str + sqs_urls: list[str] + + @overload + def __init__( + self, + *, + data_types: AwsS3DataConnectorDataTypes, + destination_table: str, + role_arn: str, + sqs_urls: list[str] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AzureDevOpsResourceInfo(_Model): + pipeline_id: Optional[str] + service_connection_id: Optional[str] + + @overload + def __init__( + self, + *, + pipeline_id: Optional[str] = ..., + service_connection_id: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.AzureResourceEntity(Entity, discriminator='AzureResource'): + id: str + kind: Literal[EntityKind.AZURE_RESOURCE] + name: str + properties: Optional[AzureResourceEntityProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[AzureResourceEntityProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.AzureResourceEntityProperties(EntityCommonProperties): + additional_data: dict[str, any] + friendly_name: str + resource_id: Optional[str] + subscription_id: Optional[str] + + + class azure.mgmt.securityinsight.models.BasicAuthModel(CcpAuthConfig, discriminator='Basic'): + password: str + type: Literal[CcpAuthType.BASIC] + user_name: str + + @overload + def __init__( + self, + *, + password: str, + user_name: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.BillingStatistic(ProxyResource): + etag: Optional[str] + id: str + kind: str + name: str + system_data: SystemData + type: str + + @overload + def __init__( + self, + *, + kind: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.BillingStatisticKind(str, Enum, metaclass=CaseInsensitiveEnumMeta): + SAP_SOLUTION_USAGE = "SapSolutionUsage" + + + class azure.mgmt.securityinsight.models.Bookmark(ProxyResource): + etag: Optional[str] + id: str + name: str + properties: Optional[BookmarkProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[BookmarkProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.BookmarkEntityMappings(_Model): + entity_type: Optional[str] + field_mappings: Optional[list[EntityFieldMapping]] + + @overload + def __init__( + self, + *, + entity_type: Optional[str] = ..., + field_mappings: Optional[list[EntityFieldMapping]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.BookmarkExpandParameters(_Model): + end_time: Optional[datetime] + expansion_id: Optional[str] + start_time: Optional[datetime] + + @overload + def __init__( + self, + *, + end_time: Optional[datetime] = ..., + expansion_id: Optional[str] = ..., + start_time: Optional[datetime] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.BookmarkExpandResponse(_Model): + meta_data: Optional[ExpansionResultsMetadata] + value: Optional[BookmarkExpandResponseValue] + + @overload + def __init__( + self, + *, + meta_data: Optional[ExpansionResultsMetadata] = ..., + value: Optional[BookmarkExpandResponseValue] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.BookmarkExpandResponseValue(_Model): + edges: Optional[list[ConnectedEntity]] + entities: Optional[list[Entity]] + + @overload + def __init__( + self, + *, + edges: Optional[list[ConnectedEntity]] = ..., + entities: Optional[list[Entity]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.BookmarkProperties(_Model): + created: Optional[datetime] + created_by: Optional[UserInfo] + display_name: str + entity_mappings: Optional[list[BookmarkEntityMappings]] + event_time: Optional[datetime] + incident_info: Optional[IncidentInfo] + labels: Optional[list[str]] + notes: Optional[str] + query: str + query_end_time: Optional[datetime] + query_result: Optional[str] + query_start_time: Optional[datetime] + tactics: Optional[list[Union[str, AttackTactic]]] + techniques: Optional[list[str]] + updated: Optional[datetime] + updated_by: Optional[UserInfo] + + @overload + def __init__( + self, + *, + created: Optional[datetime] = ..., + created_by: Optional[UserInfo] = ..., + display_name: str, + entity_mappings: Optional[list[BookmarkEntityMappings]] = ..., + event_time: Optional[datetime] = ..., + incident_info: Optional[IncidentInfo] = ..., + labels: Optional[list[str]] = ..., + notes: Optional[str] = ..., + query: str, + query_end_time: Optional[datetime] = ..., + query_result: Optional[str] = ..., + query_start_time: Optional[datetime] = ..., + tactics: Optional[list[Union[str, AttackTactic]]] = ..., + techniques: Optional[list[str]] = ..., + updated: Optional[datetime] = ..., + updated_by: Optional[UserInfo] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.BookmarkTimelineItem(EntityTimelineItem, discriminator='Bookmark'): + azure_resource_id: str + created_by: Optional[UserInfo] + display_name: Optional[str] + end_time_utc: Optional[datetime] + event_time: Optional[datetime] + kind: Literal[EntityTimelineKind.BOOKMARK] + labels: Optional[list[str]] + notes: Optional[str] + start_time_utc: Optional[datetime] + + @overload + def __init__( + self, + *, + azure_resource_id: str, + created_by: Optional[UserInfo] = ..., + display_name: Optional[str] = ..., + end_time_utc: Optional[datetime] = ..., + event_time: Optional[datetime] = ..., + labels: Optional[list[str]] = ..., + notes: Optional[str] = ..., + start_time_utc: Optional[datetime] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.BooleanConditionProperties(AutomationRuleCondition, discriminator='Boolean'): + condition_properties: Optional[AutomationRuleBooleanCondition] + condition_type: Literal[ConditionType.BOOLEAN] + + @overload + def __init__( + self, + *, + condition_properties: Optional[AutomationRuleBooleanCondition] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.CcpAuthConfig(_Model): + type: str + + @overload + def __init__( + self, + *, + type: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.CcpAuthType(str, Enum, metaclass=CaseInsensitiveEnumMeta): + API_KEY = "APIKey" + AWS = "AWS" + BASIC = "Basic" + GCP = "GCP" + GIT_HUB = "GitHub" + JWT_TOKEN = "JwtToken" + NONE = "None" + ORACLE = "Oracle" + O_AUTH2 = "OAuth2" + SERVICE_BUS = "ServiceBus" + SESSION = "Session" + + + class azure.mgmt.securityinsight.models.CcpResponseConfig(_Model): + compression_algo: Optional[str] + convert_child_properties_to_array: Optional[bool] + csv_delimiter: Optional[str] + csv_escape: Optional[str] + events_json_paths: list[str] + format: Optional[str] + has_csv_boundary: Optional[bool] + has_csv_header: Optional[bool] + is_gzip_compressed: Optional[bool] + success_status_json_path: Optional[str] + success_status_value: Optional[str] + + @overload + def __init__( + self, + *, + compression_algo: Optional[str] = ..., + convert_child_properties_to_array: Optional[bool] = ..., + csv_delimiter: Optional[str] = ..., + csv_escape: Optional[str] = ..., + events_json_paths: list[str], + format: Optional[str] = ..., + has_csv_boundary: Optional[bool] = ..., + has_csv_header: Optional[bool] = ..., + is_gzip_compressed: Optional[bool] = ..., + success_status_json_path: Optional[str] = ..., + success_status_value: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ClientInfo(_Model): + email: Optional[str] + name: Optional[str] + object_id: Optional[str] + user_principal_name: Optional[str] + + @overload + def __init__( + self, + *, + email: Optional[str] = ..., + name: Optional[str] = ..., + object_id: Optional[str] = ..., + user_principal_name: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.CloudApplicationEntity(Entity, discriminator='CloudApplication'): + id: str + kind: Literal[EntityKind.CLOUD_APPLICATION] + name: str + properties: Optional[CloudApplicationEntityProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[CloudApplicationEntityProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.CloudApplicationEntityProperties(EntityCommonProperties): + additional_data: dict[str, any] + app_id: Optional[int] + app_name: Optional[str] + friendly_name: str + instance_name: Optional[str] + + + class azure.mgmt.securityinsight.models.CloudError(_Model): + error: Optional[CloudErrorBody] + + @overload + def __init__( + self, + *, + error: Optional[CloudErrorBody] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.CloudErrorBody(_Model): + code: Optional[str] + message: Optional[str] + + + class azure.mgmt.securityinsight.models.CodelessApiPollingDataConnector(DataConnector, discriminator='APIPolling'): + etag: str + id: str + kind: Literal[DataConnectorKind.API_POLLING] + name: str + properties: Optional[ApiPollingParameters] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[ApiPollingParameters] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.CodelessConnectorPollingAuthProperties(_Model): + api_key_identifier: Optional[str] + api_key_name: Optional[str] + auth_type: str + authorization_endpoint: Optional[str] + authorization_endpoint_query_parameters: Optional[Any] + flow_name: Optional[str] + is_api_key_in_post_payload: Optional[str] + is_client_secret_in_header: Optional[bool] + redirection_endpoint: Optional[str] + scope: Optional[str] + token_endpoint: Optional[str] + token_endpoint_headers: Optional[Any] + token_endpoint_query_parameters: Optional[Any] + + @overload + def __init__( + self, + *, + api_key_identifier: Optional[str] = ..., + api_key_name: Optional[str] = ..., + auth_type: str, + authorization_endpoint: Optional[str] = ..., + authorization_endpoint_query_parameters: Optional[Any] = ..., + flow_name: Optional[str] = ..., + is_api_key_in_post_payload: Optional[str] = ..., + is_client_secret_in_header: Optional[bool] = ..., + redirection_endpoint: Optional[str] = ..., + scope: Optional[str] = ..., + token_endpoint: Optional[str] = ..., + token_endpoint_headers: Optional[Any] = ..., + token_endpoint_query_parameters: Optional[Any] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.CodelessConnectorPollingConfigProperties(_Model): + auth: CodelessConnectorPollingAuthProperties + is_active: Optional[bool] + paging: Optional[CodelessConnectorPollingPagingProperties] + request: CodelessConnectorPollingRequestProperties + response: Optional[CodelessConnectorPollingResponseProperties] + + @overload + def __init__( + self, + *, + auth: CodelessConnectorPollingAuthProperties, + is_active: Optional[bool] = ..., + paging: Optional[CodelessConnectorPollingPagingProperties] = ..., + request: CodelessConnectorPollingRequestProperties, + response: Optional[CodelessConnectorPollingResponseProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.CodelessConnectorPollingPagingProperties(_Model): + next_page_para_name: Optional[str] + next_page_token_json_path: Optional[str] + page_count_attribute_path: Optional[str] + page_size: Optional[int] + page_size_para_name: Optional[str] + page_time_stamp_attribute_path: Optional[str] + page_total_count_attribute_path: Optional[str] + paging_type: str + search_the_latest_time_stamp_from_events_list: Optional[str] + + @overload + def __init__( + self, + *, + next_page_para_name: Optional[str] = ..., + next_page_token_json_path: Optional[str] = ..., + page_count_attribute_path: Optional[str] = ..., + page_size: Optional[int] = ..., + page_size_para_name: Optional[str] = ..., + page_time_stamp_attribute_path: Optional[str] = ..., + page_total_count_attribute_path: Optional[str] = ..., + paging_type: str, + search_the_latest_time_stamp_from_events_list: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.CodelessConnectorPollingRequestProperties(_Model): + api_endpoint: str + end_time_attribute_name: Optional[str] + headers: Optional[Any] + http_method: str + query_parameters: Optional[Any] + query_parameters_template: Optional[str] + query_time_format: str + query_window_in_min: int + rate_limit_qps: Optional[int] + retry_count: Optional[int] + start_time_attribute_name: Optional[str] + timeout_in_seconds: Optional[int] + + @overload + def __init__( + self, + *, + api_endpoint: str, + end_time_attribute_name: Optional[str] = ..., + headers: Optional[Any] = ..., + http_method: str, + query_parameters: Optional[Any] = ..., + query_parameters_template: Optional[str] = ..., + query_time_format: str, + query_window_in_min: int, + rate_limit_qps: Optional[int] = ..., + retry_count: Optional[int] = ..., + start_time_attribute_name: Optional[str] = ..., + timeout_in_seconds: Optional[int] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.CodelessConnectorPollingResponseProperties(_Model): + events_json_paths: list[str] + is_gzip_compressed: Optional[bool] + success_status_json_path: Optional[str] + success_status_value: Optional[str] + + @overload + def __init__( + self, + *, + events_json_paths: list[str], + is_gzip_compressed: Optional[bool] = ..., + success_status_json_path: Optional[str] = ..., + success_status_value: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.CodelessParameters(_Model): + connector_ui_config: Optional[CodelessUiConnectorConfigProperties] + + @overload + def __init__( + self, + *, + connector_ui_config: Optional[CodelessUiConnectorConfigProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.CodelessUiConnectorConfigProperties(_Model): + availability: Availability + connectivity_criteria: list[CodelessUiConnectorConfigPropertiesConnectivityCriteriaItem] + custom_image: Optional[str] + data_types: list[CodelessUiConnectorConfigPropertiesDataTypesItem] + description_markdown: str + graph_queries: list[CodelessUiConnectorConfigPropertiesGraphQueriesItem] + graph_queries_table_name: str + instruction_steps: list[CodelessUiConnectorConfigPropertiesInstructionStepsItem] + permissions: Permissions + publisher: str + sample_queries: list[CodelessUiConnectorConfigPropertiesSampleQueriesItem] + title: str + + @overload + def __init__( + self, + *, + availability: Availability, + connectivity_criteria: list[CodelessUiConnectorConfigPropertiesConnectivityCriteriaItem], + custom_image: Optional[str] = ..., + data_types: list[CodelessUiConnectorConfigPropertiesDataTypesItem], + description_markdown: str, + graph_queries: list[CodelessUiConnectorConfigPropertiesGraphQueriesItem], + graph_queries_table_name: str, + instruction_steps: list[CodelessUiConnectorConfigPropertiesInstructionStepsItem], + permissions: Permissions, + publisher: str, + sample_queries: list[CodelessUiConnectorConfigPropertiesSampleQueriesItem], + title: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.CodelessUiConnectorConfigPropertiesConnectivityCriteriaItem(ConnectivityCriteria): + type: Union[str, ConnectivityType] + value: list[str] + + @overload + def __init__( + self, + *, + type: Optional[Union[str, ConnectivityType]] = ..., + value: Optional[list[str]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.CodelessUiConnectorConfigPropertiesDataTypesItem(LastDataReceivedDataType): + last_data_received_query: str + name: str + + @overload + def __init__( + self, + *, + last_data_received_query: Optional[str] = ..., + name: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.CodelessUiConnectorConfigPropertiesGraphQueriesItem(GraphQueries): + base_query: str + legend: str + metric_name: str + + @overload + def __init__( + self, + *, + base_query: Optional[str] = ..., + legend: Optional[str] = ..., + metric_name: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.CodelessUiConnectorConfigPropertiesInstructionStepsItem(InstructionSteps): + description: str + instructions: list[InstructionStepsInstructionsItem] + title: str + + @overload + def __init__( + self, + *, + description: Optional[str] = ..., + instructions: Optional[list[InstructionStepsInstructionsItem]] = ..., + title: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.CodelessUiConnectorConfigPropertiesSampleQueriesItem(SampleQueries): + description: str + query: str + + @overload + def __init__( + self, + *, + description: Optional[str] = ..., + query: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.CodelessUiDataConnector(DataConnector, discriminator='GenericUI'): + etag: str + id: str + kind: Literal[DataConnectorKind.GENERIC_UI] + name: str + properties: Optional[CodelessParameters] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[CodelessParameters] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.ConditionClause(_Model): + clause_connective: Optional[Union[str, Connective]] + field: str + operator: Union[str, Operator] + values_property: list[str] + + @overload + def __init__( + self, + *, + field: str, + operator: Union[str, Operator], + values_property: list[str] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ConditionProperties(_Model): + clauses: list[ConditionClause] + condition_connective: Optional[Union[str, Connective]] + stix_object_type: Optional[str] + + @overload + def __init__( + self, + *, + clauses: list[ConditionClause] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ConditionType(str, Enum, metaclass=CaseInsensitiveEnumMeta): + BOOLEAN = "Boolean" + PROPERTY = "Property" + PROPERTY_ARRAY = "PropertyArray" + PROPERTY_ARRAY_CHANGED = "PropertyArrayChanged" + PROPERTY_CHANGED = "PropertyChanged" + + + class azure.mgmt.securityinsight.models.ConfidenceLevel(str, Enum, metaclass=CaseInsensitiveEnumMeta): + HIGH = "High" + LOW = "Low" + UNKNOWN = "Unknown" + + + class azure.mgmt.securityinsight.models.ConfidenceScoreStatus(str, Enum, metaclass=CaseInsensitiveEnumMeta): + FINAL = "Final" + IN_PROCESS = "InProcess" + NOT_APPLICABLE = "NotApplicable" + NOT_FINAL = "NotFinal" + + + class azure.mgmt.securityinsight.models.ConnectAuthKind(str, Enum, metaclass=CaseInsensitiveEnumMeta): + API_KEY = "APIKey" + BASIC = "Basic" + O_AUTH2 = "OAuth2" + + + class azure.mgmt.securityinsight.models.ConnectedEntity(_Model): + additional_data: Optional[Any] + target_entity_id: Optional[str] + + @overload + def __init__( + self, + *, + additional_data: Optional[Any] = ..., + target_entity_id: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.Connective(str, Enum, metaclass=CaseInsensitiveEnumMeta): + AND = "And" + OR = "Or" + + + class azure.mgmt.securityinsight.models.ConnectivityCriteria(_Model): + type: Optional[Union[str, ConnectivityType]] + value: Optional[list[str]] + + @overload + def __init__( + self, + *, + type: Optional[Union[str, ConnectivityType]] = ..., + value: Optional[list[str]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ConnectivityCriterion(_Model): + type: str + value: Optional[list[str]] + + @overload + def __init__( + self, + *, + type: str, + value: Optional[list[str]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ConnectivityType(str, Enum, metaclass=CaseInsensitiveEnumMeta): + IS_CONNECTED_QUERY = "IsConnectedQuery" + + + class azure.mgmt.securityinsight.models.ConnectorDataType(_Model): + last_data_received_query: str + name: str + + @overload + def __init__( + self, + *, + last_data_received_query: str, + name: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ConnectorDefinitionsAvailability(_Model): + is_preview: Optional[bool] + status: Optional[int] + + @overload + def __init__( + self, + *, + is_preview: Optional[bool] = ..., + status: Optional[int] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ConnectorDefinitionsPermissions(_Model): + customs: Optional[list[CustomPermissionDetails]] + licenses: Optional[list[str]] + resource_provider: Optional[list[ConnectorDefinitionsResourceProvider]] + tenant: Optional[list[str]] + + @overload + def __init__( + self, + *, + customs: Optional[list[CustomPermissionDetails]] = ..., + licenses: Optional[list[str]] = ..., + resource_provider: Optional[list[ConnectorDefinitionsResourceProvider]] = ..., + tenant: Optional[list[str]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ConnectorDefinitionsResourceProvider(_Model): + permissions_display_text: str + provider: str + provider_display_name: str + required_permissions: ResourceProviderRequiredPermissions + scope: Union[str, ProviderPermissionsScope] + + @overload + def __init__( + self, + *, + permissions_display_text: str, + provider: str, + provider_display_name: str, + required_permissions: ResourceProviderRequiredPermissions, + scope: Union[str, ProviderPermissionsScope] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ConnectorInstructionModelBase(_Model): + parameters: Optional[Any] + type: Union[str, SettingType] + + @overload + def __init__( + self, + *, + parameters: Optional[Any] = ..., + type: Union[str, SettingType] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ContentType(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ANALYTICS_RULE = "AnalyticsRule" + AUTOMATION_RULE = "AutomationRule" + HUNTING_QUERY = "HuntingQuery" + PARSER = "Parser" + PLAYBOOK = "Playbook" + WORKBOOK = "Workbook" + + + class azure.mgmt.securityinsight.models.CountQuery(_Model): + properties: Optional[QueryProperties] + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[QueryProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.CreatedByType(str, Enum, metaclass=CaseInsensitiveEnumMeta): + APPLICATION = "Application" + KEY = "Key" + MANAGED_IDENTITY = "ManagedIdentity" + USER = "User" + + + class azure.mgmt.securityinsight.models.CustomEntityQuery(ResourceWithEtag): + etag: str + id: str + kind: str + name: str + system_data: SystemData + type: str + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + kind: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.CustomEntityQueryKind(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ACTIVITY = "Activity" + + + class azure.mgmt.securityinsight.models.CustomPermissionDetails(_Model): + description: str + name: str + + @overload + def __init__( + self, + *, + description: str, + name: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.CustomizableConnectionsConfig(_Model): + template_spec_name: str + template_spec_version: str + + @overload + def __init__( + self, + *, + template_spec_name: str, + template_spec_version: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.CustomizableConnectorDefinition(DataConnectorDefinition, discriminator='Customizable'): + etag: str + id: str + kind: Literal[DataConnectorDefinitionKind.CUSTOMIZABLE] + name: str + properties: Optional[CustomizableConnectorDefinitionProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[CustomizableConnectorDefinitionProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.CustomizableConnectorDefinitionProperties(_Model): + connections_config: Optional[CustomizableConnectionsConfig] + connector_ui_config: CustomizableConnectorUiConfig + created_time_utc: Optional[datetime] + last_modified_utc: Optional[datetime] + + @overload + def __init__( + self, + *, + connections_config: Optional[CustomizableConnectionsConfig] = ..., + connector_ui_config: CustomizableConnectorUiConfig, + created_time_utc: Optional[datetime] = ..., + last_modified_utc: Optional[datetime] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.CustomizableConnectorUiConfig(_Model): + availability: Optional[ConnectorDefinitionsAvailability] + connectivity_criteria: list[ConnectivityCriterion] + data_types: list[ConnectorDataType] + description_markdown: str + graph_queries: list[GraphQuery] + id: Optional[str] + instruction_steps: list[InstructionStep] + is_connectivity_criterias_match_some: Optional[bool] + logo: Optional[str] + permissions: ConnectorDefinitionsPermissions + publisher: str + title: str + + @overload + def __init__( + self, + *, + availability: Optional[ConnectorDefinitionsAvailability] = ..., + connectivity_criteria: list[ConnectivityCriterion], + data_types: list[ConnectorDataType], + description_markdown: str, + graph_queries: list[GraphQuery], + id: Optional[str] = ..., + instruction_steps: list[InstructionStep], + is_connectivity_criterias_match_some: Optional[bool] = ..., + logo: Optional[str] = ..., + permissions: ConnectorDefinitionsPermissions, + publisher: str, + title: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.Customs(CustomsPermission): + description: str + name: str + + @overload + def __init__( + self, + *, + description: Optional[str] = ..., + name: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.CustomsPermission(_Model): + description: Optional[str] + name: Optional[str] + + @overload + def __init__( + self, + *, + description: Optional[str] = ..., + name: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.DCRConfiguration(_Model): + data_collection_endpoint: str + data_collection_rule_immutable_id: str + stream_name: str + + @overload + def __init__( + self, + *, + data_collection_endpoint: str, + data_collection_rule_immutable_id: str, + stream_name: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.DataConnector(ProxyResource): + etag: Optional[str] + id: str + kind: str + name: str + system_data: SystemData + type: str + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + kind: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.DataConnectorAuthorizationState(str, Enum, metaclass=CaseInsensitiveEnumMeta): + INVALID = "Invalid" + VALID = "Valid" + + + class azure.mgmt.securityinsight.models.DataConnectorConnectBody(_Model): + api_key: Optional[str] + authorization_code: Optional[str] + client_id: Optional[str] + client_secret: Optional[str] + data_collection_endpoint: Optional[str] + data_collection_rule_immutable_id: Optional[str] + kind: Optional[Union[str, ConnectAuthKind]] + output_stream: Optional[str] + password: Optional[str] + request_config_user_input_values: Optional[list[Any]] + user_name: Optional[str] + + @overload + def __init__( + self, + *, + api_key: Optional[str] = ..., + authorization_code: Optional[str] = ..., + client_id: Optional[str] = ..., + client_secret: Optional[str] = ..., + data_collection_endpoint: Optional[str] = ..., + data_collection_rule_immutable_id: Optional[str] = ..., + kind: Optional[Union[str, ConnectAuthKind]] = ..., + output_stream: Optional[str] = ..., + password: Optional[str] = ..., + request_config_user_input_values: Optional[list[Any]] = ..., + user_name: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.DataConnectorDataTypeCommon(_Model): + state: Union[str, DataTypeState] + + @overload + def __init__( + self, + *, + state: Union[str, DataTypeState] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.DataConnectorDefinition(ProxyResource): + etag: Optional[str] + id: str + kind: str + name: str + system_data: SystemData + type: str + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + kind: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.DataConnectorDefinitionKind(str, Enum, metaclass=CaseInsensitiveEnumMeta): + CUSTOMIZABLE = "Customizable" + + + class azure.mgmt.securityinsight.models.DataConnectorKind(str, Enum, metaclass=CaseInsensitiveEnumMeta): + AMAZON_WEB_SERVICES_CLOUD_TRAIL = "AmazonWebServicesCloudTrail" + AMAZON_WEB_SERVICES_S3 = "AmazonWebServicesS3" + API_POLLING = "APIPolling" + AZURE_ACTIVE_DIRECTORY = "AzureActiveDirectory" + AZURE_ADVANCED_THREAT_PROTECTION = "AzureAdvancedThreatProtection" + AZURE_SECURITY_CENTER = "AzureSecurityCenter" + DYNAMICS365 = "Dynamics365" + GCP = "GCP" + GENERIC_UI = "GenericUI" + IOT = "IOT" + MICROSOFT_CLOUD_APP_SECURITY = "MicrosoftCloudAppSecurity" + MICROSOFT_DEFENDER_ADVANCED_THREAT_PROTECTION = "MicrosoftDefenderAdvancedThreatProtection" + MICROSOFT_PURVIEW_INFORMATION_PROTECTION = "MicrosoftPurviewInformationProtection" + MICROSOFT_THREAT_INTELLIGENCE = "MicrosoftThreatIntelligence" + MICROSOFT_THREAT_PROTECTION = "MicrosoftThreatProtection" + OFFICE365 = "Office365" + OFFICE365_PROJECT = "Office365Project" + OFFICE_ATP = "OfficeATP" + OFFICE_IRM = "OfficeIRM" + OFFICE_POWER_BI = "OfficePowerBI" + PREMIUM_MICROSOFT_DEFENDER_FOR_THREAT_INTELLIGENCE = "PremiumMicrosoftDefenderForThreatIntelligence" + PURVIEW_AUDIT = "PurviewAudit" + REST_API_POLLER = "RestApiPoller" + THREAT_INTELLIGENCE = "ThreatIntelligence" + THREAT_INTELLIGENCE_TAXII = "ThreatIntelligenceTaxii" + + + class azure.mgmt.securityinsight.models.DataConnectorLicenseState(str, Enum, metaclass=CaseInsensitiveEnumMeta): + INVALID = "Invalid" + UNKNOWN = "Unknown" + VALID = "Valid" + + + class azure.mgmt.securityinsight.models.DataConnectorRequirementsState(_Model): + authorization_state: Optional[Union[str, DataConnectorAuthorizationState]] + license_state: Optional[Union[str, DataConnectorLicenseState]] + + @overload + def __init__( + self, + *, + authorization_state: Optional[Union[str, DataConnectorAuthorizationState]] = ..., + license_state: Optional[Union[str, DataConnectorLicenseState]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.DataConnectorTenantId(_Model): + tenant_id: str + + @overload + def __init__( + self, + *, + tenant_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.DataConnectorWithAlertsProperties(_Model): + data_types: Optional[AlertsDataTypeOfDataConnector] + + @overload + def __init__( + self, + *, + data_types: Optional[AlertsDataTypeOfDataConnector] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.DataConnectorsCheckRequirements(_Model): + kind: str + + @overload + def __init__( + self, + *, + kind: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.DataTypeDefinitions(_Model): + data_type: Optional[str] + + @overload + def __init__( + self, + *, + data_type: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.DataTypeState(str, Enum, metaclass=CaseInsensitiveEnumMeta): + DISABLED = "Disabled" + ENABLED = "Enabled" + + + class azure.mgmt.securityinsight.models.DeleteStatus(str, Enum, metaclass=CaseInsensitiveEnumMeta): + DELETED = "Deleted" + NOT_DELETED = "NotDeleted" + UNSPECIFIED = "Unspecified" + + + class azure.mgmt.securityinsight.models.DeliveryAction(str, Enum, metaclass=CaseInsensitiveEnumMeta): + BLOCKED = "Blocked" + DELIVERED = "Delivered" + DELIVERED_AS_SPAM = "DeliveredAsSpam" + REPLACED = "Replaced" + UNKNOWN = "Unknown" + + + class azure.mgmt.securityinsight.models.DeliveryLocation(str, Enum, metaclass=CaseInsensitiveEnumMeta): + DELETED_FOLDER = "DeletedFolder" + DROPPED = "Dropped" + EXTERNAL = "External" + FAILED = "Failed" + FORWARDED = "Forwarded" + INBOX = "Inbox" + JUNK_FOLDER = "JunkFolder" + QUARANTINE = "Quarantine" + UNKNOWN = "Unknown" + + + class azure.mgmt.securityinsight.models.Deployment(_Model): + deployment_id: Optional[str] + deployment_logs_url: Optional[str] + deployment_result: Optional[Union[str, DeploymentResult]] + deployment_state: Optional[Union[str, DeploymentState]] + deployment_time: Optional[datetime] + + @overload + def __init__( + self, + *, + deployment_id: Optional[str] = ..., + deployment_logs_url: Optional[str] = ..., + deployment_result: Optional[Union[str, DeploymentResult]] = ..., + deployment_state: Optional[Union[str, DeploymentState]] = ..., + deployment_time: Optional[datetime] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.DeploymentFetchStatus(str, Enum, metaclass=CaseInsensitiveEnumMeta): + NOT_FOUND = "NotFound" + SUCCESS = "Success" + UNAUTHORIZED = "Unauthorized" + + + class azure.mgmt.securityinsight.models.DeploymentInfo(_Model): + deployment: Optional[Deployment] + deployment_fetch_status: Optional[Union[str, DeploymentFetchStatus]] + message: Optional[str] + + @overload + def __init__( + self, + *, + deployment: Optional[Deployment] = ..., + deployment_fetch_status: Optional[Union[str, DeploymentFetchStatus]] = ..., + message: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.DeploymentResult(str, Enum, metaclass=CaseInsensitiveEnumMeta): + CANCELED = "Canceled" + FAILED = "Failed" + SUCCESS = "Success" + + + class azure.mgmt.securityinsight.models.DeploymentState(str, Enum, metaclass=CaseInsensitiveEnumMeta): + CANCELING = "Canceling" + COMPLETED = "Completed" + IN_PROGRESS = "In_Progress" + QUEUED = "Queued" + + + class azure.mgmt.securityinsight.models.DeviceImportance(str, Enum, metaclass=CaseInsensitiveEnumMeta): + HIGH = "High" + LOW = "Low" + NORMAL = "Normal" + UNKNOWN = "Unknown" + + + class azure.mgmt.securityinsight.models.DnsEntity(Entity, discriminator='DnsResolution'): + id: str + kind: Literal[EntityKind.DNS_RESOLUTION] + name: str + properties: Optional[DnsEntityProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[DnsEntityProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.DnsEntityProperties(EntityCommonProperties): + additional_data: dict[str, any] + dns_server_ip_entity_id: Optional[str] + domain_name: Optional[str] + friendly_name: str + host_ip_address_entity_id: Optional[str] + ip_address_entity_ids: Optional[list[str]] + + + class azure.mgmt.securityinsight.models.Dynamics365CheckRequirements(DataConnectorsCheckRequirements, discriminator='Dynamics365'): + kind: Literal[DataConnectorKind.DYNAMICS365] + properties: Optional[Dynamics365CheckRequirementsProperties] + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[Dynamics365CheckRequirementsProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.Dynamics365CheckRequirementsProperties(DataConnectorTenantId): + tenant_id: str + + @overload + def __init__( + self, + *, + tenant_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.Dynamics365DataConnector(DataConnector, discriminator='Dynamics365'): + etag: str + id: str + kind: Literal[DataConnectorKind.DYNAMICS365] + name: str + properties: Optional[Dynamics365DataConnectorProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[Dynamics365DataConnectorProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.Dynamics365DataConnectorDataTypes(_Model): + dynamics365_cds_activities: Dynamics365DataConnectorDataTypesDynamics365CdsActivities + + @overload + def __init__( + self, + *, + dynamics365_cds_activities: Dynamics365DataConnectorDataTypesDynamics365CdsActivities + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.Dynamics365DataConnectorDataTypesDynamics365CdsActivities(DataConnectorDataTypeCommon): + state: Union[str, DataTypeState] + + @overload + def __init__( + self, + *, + state: Union[str, DataTypeState] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.Dynamics365DataConnectorProperties(DataConnectorTenantId): + data_types: Dynamics365DataConnectorDataTypes + tenant_id: str + + @overload + def __init__( + self, + *, + data_types: Dynamics365DataConnectorDataTypes, + tenant_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ElevationToken(str, Enum, metaclass=CaseInsensitiveEnumMeta): + DEFAULT = "Default" + FULL = "Full" + LIMITED = "Limited" + + + class azure.mgmt.securityinsight.models.EnrichmentDomainBody(_Model): + domain: Optional[str] + + @overload + def __init__( + self, + *, + domain: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.EnrichmentDomainWhois(_Model): + created: Optional[datetime] + domain: Optional[str] + expires: Optional[datetime] + parsed_whois: Optional[EnrichmentDomainWhoisDetails] + server: Optional[str] + updated: Optional[datetime] + + @overload + def __init__( + self, + *, + created: Optional[datetime] = ..., + domain: Optional[str] = ..., + expires: Optional[datetime] = ..., + parsed_whois: Optional[EnrichmentDomainWhoisDetails] = ..., + server: Optional[str] = ..., + updated: Optional[datetime] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.EnrichmentDomainWhoisContact(_Model): + city: Optional[str] + country: Optional[str] + email: Optional[str] + fax: Optional[str] + name: Optional[str] + org: Optional[str] + phone: Optional[str] + postal: Optional[str] + state: Optional[str] + street: Optional[list[str]] + + @overload + def __init__( + self, + *, + city: Optional[str] = ..., + country: Optional[str] = ..., + email: Optional[str] = ..., + fax: Optional[str] = ..., + name: Optional[str] = ..., + org: Optional[str] = ..., + phone: Optional[str] = ..., + postal: Optional[str] = ..., + state: Optional[str] = ..., + street: Optional[list[str]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.EnrichmentDomainWhoisContacts(_Model): + admin: Optional[EnrichmentDomainWhoisContact] + billing: Optional[EnrichmentDomainWhoisContact] + registrant: Optional[EnrichmentDomainWhoisContact] + tech: Optional[EnrichmentDomainWhoisContact] + + @overload + def __init__( + self, + *, + admin: Optional[EnrichmentDomainWhoisContact] = ..., + billing: Optional[EnrichmentDomainWhoisContact] = ..., + registrant: Optional[EnrichmentDomainWhoisContact] = ..., + tech: Optional[EnrichmentDomainWhoisContact] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.EnrichmentDomainWhoisDetails(_Model): + contacts: Optional[EnrichmentDomainWhoisContacts] + name_servers: Optional[list[str]] + registrar: Optional[EnrichmentDomainWhoisRegistrarDetails] + statuses: Optional[list[str]] + + @overload + def __init__( + self, + *, + contacts: Optional[EnrichmentDomainWhoisContacts] = ..., + name_servers: Optional[list[str]] = ..., + registrar: Optional[EnrichmentDomainWhoisRegistrarDetails] = ..., + statuses: Optional[list[str]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.EnrichmentDomainWhoisRegistrarDetails(_Model): + abuse_contact_email: Optional[str] + abuse_contact_phone: Optional[str] + iana_id: Optional[str] + name: Optional[str] + url: Optional[str] + whois_server: Optional[str] + + @overload + def __init__( + self, + *, + abuse_contact_email: Optional[str] = ..., + abuse_contact_phone: Optional[str] = ..., + iana_id: Optional[str] = ..., + name: Optional[str] = ..., + url: Optional[str] = ..., + whois_server: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.EnrichmentIpAddressBody(_Model): + ip_address: Optional[str] + + @overload + def __init__( + self, + *, + ip_address: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.EnrichmentIpGeodata(_Model): + asn: Optional[str] + carrier: Optional[str] + city: Optional[str] + city_confidence_factor: Optional[int] + continent: Optional[str] + country: Optional[str] + country_confidence_factor: Optional[int] + ip_addr: Optional[str] + ip_routing_type: Optional[str] + latitude: Optional[str] + longitude: Optional[str] + organization: Optional[str] + organization_type: Optional[str] + region: Optional[str] + state: Optional[str] + state_code: Optional[str] + state_confidence_factor: Optional[int] + + @overload + def __init__( + self, + *, + asn: Optional[str] = ..., + carrier: Optional[str] = ..., + city: Optional[str] = ..., + city_confidence_factor: Optional[int] = ..., + continent: Optional[str] = ..., + country: Optional[str] = ..., + country_confidence_factor: Optional[int] = ..., + ip_addr: Optional[str] = ..., + ip_routing_type: Optional[str] = ..., + latitude: Optional[str] = ..., + longitude: Optional[str] = ..., + organization: Optional[str] = ..., + organization_type: Optional[str] = ..., + region: Optional[str] = ..., + state: Optional[str] = ..., + state_code: Optional[str] = ..., + state_confidence_factor: Optional[int] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.EnrichmentType(str, Enum, metaclass=CaseInsensitiveEnumMeta): + MAIN = "main" + + + class azure.mgmt.securityinsight.models.Entity(ProxyResource): + id: str + kind: str + name: str + system_data: SystemData + type: str + + @overload + def __init__( + self, + *, + kind: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.EntityAnalytics(Settings, discriminator='EntityAnalytics'): + etag: str + id: str + kind: Literal[SettingKind.ENTITY_ANALYTICS] + name: str + properties: Optional[EntityAnalyticsProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[EntityAnalyticsProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.EntityAnalyticsProperties(_Model): + entity_providers: Optional[list[Union[str, EntityProviders]]] + + @overload + def __init__( + self, + *, + entity_providers: Optional[list[Union[str, EntityProviders]]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.EntityCommonProperties(_Model): + additional_data: Optional[dict[str, Any]] + friendly_name: Optional[str] + + + class azure.mgmt.securityinsight.models.EntityEdges(_Model): + additional_data: Optional[dict[str, Any]] + target_entity_id: Optional[str] + + @overload + def __init__( + self, + *, + additional_data: Optional[dict[str, Any]] = ..., + target_entity_id: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.EntityExpandParameters(_Model): + end_time: Optional[datetime] + expansion_id: Optional[str] + start_time: Optional[datetime] + + @overload + def __init__( + self, + *, + end_time: Optional[datetime] = ..., + expansion_id: Optional[str] = ..., + start_time: Optional[datetime] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.EntityExpandResponse(_Model): + meta_data: Optional[ExpansionResultsMetadata] + value: Optional[EntityExpandResponseValue] + + @overload + def __init__( + self, + *, + meta_data: Optional[ExpansionResultsMetadata] = ..., + value: Optional[EntityExpandResponseValue] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.EntityExpandResponseValue(_Model): + edges: Optional[list[EntityEdges]] + entities: Optional[list[Entity]] + + @overload + def __init__( + self, + *, + edges: Optional[list[EntityEdges]] = ..., + entities: Optional[list[Entity]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.EntityFieldMapping(_Model): + identifier: Optional[str] + value: Optional[str] + + @overload + def __init__( + self, + *, + identifier: Optional[str] = ..., + value: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.EntityGetInsightsParameters(_Model): + add_default_extended_time_range: Optional[bool] + end_time: datetime + insight_query_ids: Optional[list[str]] + start_time: datetime + + @overload + def __init__( + self, + *, + add_default_extended_time_range: Optional[bool] = ..., + end_time: datetime, + insight_query_ids: Optional[list[str]] = ..., + start_time: datetime + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.EntityGetInsightsResponse(_Model): + meta_data: Optional[GetInsightsResultsMetadata] + value: Optional[list[EntityInsightItem]] + + @overload + def __init__( + self, + *, + meta_data: Optional[GetInsightsResultsMetadata] = ..., + value: Optional[list[EntityInsightItem]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.EntityInsightItem(_Model): + chart_query_results: Optional[list[InsightsTableResult]] + query_id: Optional[str] + query_time_interval: Optional[EntityInsightItemQueryTimeInterval] + table_query_results: Optional[InsightsTableResult] + + @overload + def __init__( + self, + *, + chart_query_results: Optional[list[InsightsTableResult]] = ..., + query_id: Optional[str] = ..., + query_time_interval: Optional[EntityInsightItemQueryTimeInterval] = ..., + table_query_results: Optional[InsightsTableResult] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.EntityInsightItemQueryTimeInterval(_Model): + end_time: Optional[datetime] + start_time: Optional[datetime] + + @overload + def __init__( + self, + *, + end_time: Optional[datetime] = ..., + start_time: Optional[datetime] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.EntityItemQueryKind(str, Enum, metaclass=CaseInsensitiveEnumMeta): + INSIGHT = "Insight" + + + class azure.mgmt.securityinsight.models.EntityKind(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ACCOUNT = "Account" + AZURE_RESOURCE = "AzureResource" + BOOKMARK = "Bookmark" + CLOUD_APPLICATION = "CloudApplication" + DNS_RESOLUTION = "DnsResolution" + FILE = "File" + FILE_HASH = "FileHash" + HOST = "Host" + IO_T_DEVICE = "IoTDevice" + IP = "Ip" + MAILBOX = "Mailbox" + MAIL_CLUSTER = "MailCluster" + MAIL_MESSAGE = "MailMessage" + MALWARE = "Malware" + NIC = "Nic" + PROCESS = "Process" + REGISTRY_KEY = "RegistryKey" + REGISTRY_VALUE = "RegistryValue" + SECURITY_ALERT = "SecurityAlert" + SECURITY_GROUP = "SecurityGroup" + SUBMISSION_MAIL = "SubmissionMail" + URL = "Url" + + + class azure.mgmt.securityinsight.models.EntityManualTriggerRequestBody(_Model): + incident_arm_id: Optional[str] + logic_apps_resource_id: str + tenant_id: Optional[str] + + @overload + def __init__( + self, + *, + incident_arm_id: Optional[str] = ..., + logic_apps_resource_id: str, + tenant_id: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.EntityMapping(_Model): + entity_type: Optional[Union[str, EntityMappingType]] + field_mappings: Optional[list[FieldMapping]] + + @overload + def __init__( + self, + *, + entity_type: Optional[Union[str, EntityMappingType]] = ..., + field_mappings: Optional[list[FieldMapping]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.EntityMappingType(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ACCOUNT = "Account" + AZURE_RESOURCE = "AzureResource" + CLOUD_APPLICATION = "CloudApplication" + DNS = "DNS" + FILE = "File" + FILE_HASH = "FileHash" + HOST = "Host" + IP = "IP" + MAILBOX = "Mailbox" + MAIL_CLUSTER = "MailCluster" + MAIL_MESSAGE = "MailMessage" + MALWARE = "Malware" + PROCESS = "Process" + REGISTRY_KEY = "RegistryKey" + REGISTRY_VALUE = "RegistryValue" + SECURITY_GROUP = "SecurityGroup" + SUBMISSION_MAIL = "SubmissionMail" + URL = "URL" + + + class azure.mgmt.securityinsight.models.EntityProviders(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ACTIVE_DIRECTORY = "ActiveDirectory" + AZURE_ACTIVE_DIRECTORY = "AzureActiveDirectory" + + + class azure.mgmt.securityinsight.models.EntityQuery(ProxyResource): + etag: Optional[str] + id: str + kind: str + name: str + system_data: SystemData + type: str + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + kind: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.EntityQueryItem(_Model): + id: Optional[str] + kind: str + name: Optional[str] + type: Optional[str] + + @overload + def __init__( + self, + *, + kind: str, + name: Optional[str] = ..., + type: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.EntityQueryItemProperties(_Model): + data_types: Optional[list[EntityQueryItemPropertiesDataTypesItem]] + entities_filter: Optional[Any] + input_entity_type: Optional[Union[str, EntityType]] + required_input_fields_sets: Optional[list[list[str]]] + + @overload + def __init__( + self, + *, + data_types: Optional[list[EntityQueryItemPropertiesDataTypesItem]] = ..., + entities_filter: Optional[Any] = ..., + input_entity_type: Optional[Union[str, EntityType]] = ..., + required_input_fields_sets: Optional[list[list[str]]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.EntityQueryItemPropertiesDataTypesItem(_Model): + data_type: Optional[str] + + @overload + def __init__( + self, + *, + data_type: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.EntityQueryKind(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ACTIVITY = "Activity" + EXPANSION = "Expansion" + INSIGHT = "Insight" + + + class azure.mgmt.securityinsight.models.EntityQueryTemplate(ProxyResource): + id: str + kind: str + name: str + system_data: SystemData + type: str + + @overload + def __init__( + self, + *, + kind: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.EntityQueryTemplateKind(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ACTIVITY = "Activity" + ANOMALY = "Anomaly" + BOOKMARK = "Bookmark" + EXPANSION = "Expansion" + GUIDED_INSIGHT = "GuidedInsight" + INSIGHT = "Insight" + SECURITY_ALERT = "SecurityAlert" + + + class azure.mgmt.securityinsight.models.EntityTimelineItem(_Model): + kind: str + + @overload + def __init__( + self, + *, + kind: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.EntityTimelineKind(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ACTIVITY = "Activity" + ANOMALY = "Anomaly" + BOOKMARK = "Bookmark" + SECURITY_ALERT = "SecurityAlert" + + + class azure.mgmt.securityinsight.models.EntityTimelineParameters(_Model): + end_time: datetime + kinds: Optional[list[Union[str, EntityTimelineKind]]] + number_of_bucket: Optional[int] + start_time: datetime + + @overload + def __init__( + self, + *, + end_time: datetime, + kinds: Optional[list[Union[str, EntityTimelineKind]]] = ..., + number_of_bucket: Optional[int] = ..., + start_time: datetime + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.EntityTimelineResponse(_Model): + meta_data: Optional[TimelineResultsMetadata] + value: Optional[list[EntityTimelineItem]] + + @overload + def __init__( + self, + *, + meta_data: Optional[TimelineResultsMetadata] = ..., + value: Optional[list[EntityTimelineItem]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.EntityType(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ACCOUNT = "Account" + AZURE_RESOURCE = "AzureResource" + CLOUD_APPLICATION = "CloudApplication" + DNS = "DNS" + FILE = "File" + FILE_HASH = "FileHash" + HOST = "Host" + HUNTING_BOOKMARK = "HuntingBookmark" + IO_T_DEVICE = "IoTDevice" + IP = "IP" + MAILBOX = "Mailbox" + MAIL_CLUSTER = "MailCluster" + MAIL_MESSAGE = "MailMessage" + MALWARE = "Malware" + NIC = "Nic" + PROCESS = "Process" + REGISTRY_KEY = "RegistryKey" + REGISTRY_VALUE = "RegistryValue" + SECURITY_ALERT = "SecurityAlert" + SECURITY_GROUP = "SecurityGroup" + SUBMISSION_MAIL = "SubmissionMail" + URL = "URL" + + + class azure.mgmt.securityinsight.models.Error(_Model): + error_message: str + member_resource_name: str + + @overload + def __init__( + self, + *, + error_message: str, + member_resource_name: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ErrorAdditionalInfo(_Model): + info: Optional[Any] + type: Optional[str] + + + class azure.mgmt.securityinsight.models.ErrorDetail(_Model): + additional_info: Optional[list[ErrorAdditionalInfo]] + code: Optional[str] + details: Optional[list[ErrorDetail]] + message: Optional[str] + target: Optional[str] + + + class azure.mgmt.securityinsight.models.ErrorResponse(_Model): + error: Optional[ErrorDetail] + + @overload + def __init__( + self, + *, + error: Optional[ErrorDetail] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.EventGroupingAggregationKind(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ALERT_PER_RESULT = "AlertPerResult" + SINGLE_ALERT = "SingleAlert" + + + class azure.mgmt.securityinsight.models.EventGroupingSettings(_Model): + aggregation_kind: Optional[Union[str, EventGroupingAggregationKind]] + + @overload + def __init__( + self, + *, + aggregation_kind: Optional[Union[str, EventGroupingAggregationKind]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ExpansionEntityQueriesProperties(_Model): + data_sources: Optional[list[str]] + display_name: Optional[str] + input_entity_type: Optional[Union[str, EntityType]] + input_fields: Optional[list[str]] + output_entity_types: Optional[list[Union[str, EntityType]]] + query_template: Optional[str] + + @overload + def __init__( + self, + *, + data_sources: Optional[list[str]] = ..., + display_name: Optional[str] = ..., + input_entity_type: Optional[Union[str, EntityType]] = ..., + input_fields: Optional[list[str]] = ..., + output_entity_types: Optional[list[Union[str, EntityType]]] = ..., + query_template: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ExpansionEntityQuery(EntityQuery, discriminator='Expansion'): + etag: str + id: str + kind: Literal[EntityQueryKind.EXPANSION] + name: str + properties: Optional[ExpansionEntityQueriesProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[ExpansionEntityQueriesProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.ExpansionResultAggregation(_Model): + aggregation_type: Optional[str] + count: int + display_name: Optional[str] + entity_kind: Union[str, EntityKind] + + @overload + def __init__( + self, + *, + aggregation_type: Optional[str] = ..., + count: int, + display_name: Optional[str] = ..., + entity_kind: Union[str, EntityKind] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ExpansionResultsMetadata(_Model): + aggregations: Optional[list[ExpansionResultAggregation]] + + @overload + def __init__( + self, + *, + aggregations: Optional[list[ExpansionResultAggregation]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.EyesOn(Settings, discriminator='EyesOn'): + etag: str + id: str + kind: Literal[SettingKind.EYES_ON] + name: str + properties: Optional[EyesOnSettingsProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[EyesOnSettingsProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.EyesOnSettingsProperties(_Model): + is_enabled: Optional[bool] + + + class azure.mgmt.securityinsight.models.FieldMapping(_Model): + column_name: Optional[str] + identifier: Optional[str] + + @overload + def __init__( + self, + *, + column_name: Optional[str] = ..., + identifier: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.FileEntity(Entity, discriminator='File'): + id: str + kind: Literal[EntityKind.FILE] + name: str + properties: Optional[FileEntityProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[FileEntityProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.FileEntityProperties(EntityCommonProperties): + additional_data: dict[str, any] + directory: Optional[str] + file_hash_entity_ids: Optional[list[str]] + file_name: Optional[str] + friendly_name: str + host_entity_id: Optional[str] + + + class azure.mgmt.securityinsight.models.FileFormat(str, Enum, metaclass=CaseInsensitiveEnumMeta): + CSV = "CSV" + JSON = "JSON" + UNSPECIFIED = "Unspecified" + + + class azure.mgmt.securityinsight.models.FileHashAlgorithm(str, Enum, metaclass=CaseInsensitiveEnumMeta): + MD5 = "MD5" + SHA1 = "SHA1" + SHA256 = "SHA256" + SHA256_AC = "SHA256AC" + UNKNOWN = "Unknown" + + + class azure.mgmt.securityinsight.models.FileHashEntity(Entity, discriminator='FileHash'): + id: str + kind: Literal[EntityKind.FILE_HASH] + name: str + properties: Optional[FileHashEntityProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[FileHashEntityProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.FileHashEntityProperties(EntityCommonProperties): + additional_data: dict[str, any] + algorithm: Optional[Union[str, FileHashAlgorithm]] + friendly_name: str + hash_value: Optional[str] + + + class azure.mgmt.securityinsight.models.FileImport(ProxyResource): + id: str + name: str + properties: Optional[FileImportProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[FileImportProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.FileImportContentType(str, Enum, metaclass=CaseInsensitiveEnumMeta): + BASIC_INDICATOR = "BasicIndicator" + STIX_INDICATOR = "StixIndicator" + UNSPECIFIED = "Unspecified" + + + class azure.mgmt.securityinsight.models.FileImportProperties(_Model): + content_type: Union[str, FileImportContentType] + created_time_utc: Optional[datetime] + error_file: Optional[FileMetadata] + errors_preview: Optional[list[ValidationError]] + files_valid_until_time_utc: Optional[datetime] + import_file: FileMetadata + import_valid_until_time_utc: Optional[datetime] + ingested_record_count: Optional[int] + ingestion_mode: Union[str, IngestionMode] + source: str + state: Optional[Union[str, FileImportState]] + total_record_count: Optional[int] + valid_record_count: Optional[int] + + @overload + def __init__( + self, + *, + content_type: Union[str, FileImportContentType], + import_file: FileMetadata, + ingestion_mode: Union[str, IngestionMode], + source: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.FileImportState(str, Enum, metaclass=CaseInsensitiveEnumMeta): + FATAL_ERROR = "FatalError" + INGESTED = "Ingested" + INGESTED_WITH_ERRORS = "IngestedWithErrors" + INVALID = "Invalid" + IN_PROGRESS = "InProgress" + UNSPECIFIED = "Unspecified" + WAITING_FOR_UPLOAD = "WaitingForUpload" + + + class azure.mgmt.securityinsight.models.FileMetadata(_Model): + delete_status: Optional[Union[str, DeleteStatus]] + file_content_uri: Optional[str] + file_format: Optional[Union[str, FileFormat]] + file_name: Optional[str] + file_size: Optional[int] + + @overload + def __init__( + self, + *, + file_format: Optional[Union[str, FileFormat]] = ..., + file_name: Optional[str] = ..., + file_size: Optional[int] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.Flag(str, Enum, metaclass=CaseInsensitiveEnumMeta): + FALSE = "false" + TRUE = "true" + + + class azure.mgmt.securityinsight.models.FusionAlertRule(AlertRule, discriminator='Fusion'): + etag: str + id: str + kind: Literal[AlertRuleKind.FUSION] + name: str + properties: Optional[FusionAlertRuleProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[FusionAlertRuleProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.FusionAlertRuleProperties(_Model): + alert_rule_template_name: str + description: Optional[str] + display_name: Optional[str] + enabled: bool + last_modified_utc: Optional[datetime] + scenario_exclusion_patterns: Optional[list[FusionScenarioExclusionPattern]] + severity: Optional[Union[str, AlertSeverity]] + source_settings: Optional[list[FusionSourceSettings]] + sub_techniques: Optional[list[str]] + tactics: Optional[list[Union[str, AttackTactic]]] + techniques: Optional[list[str]] + + @overload + def __init__( + self, + *, + alert_rule_template_name: str, + enabled: bool, + scenario_exclusion_patterns: Optional[list[FusionScenarioExclusionPattern]] = ..., + source_settings: Optional[list[FusionSourceSettings]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.FusionAlertRuleTemplate(AlertRuleTemplate, discriminator='Fusion'): + id: str + kind: Literal[AlertRuleKind.FUSION] + name: str + properties: Optional[FusionAlertRuleTemplateProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[FusionAlertRuleTemplateProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.FusionAlertRuleTemplateProperties(_Model): + alert_rules_created_by_template_count: Optional[int] + created_date_utc: Optional[datetime] + description: Optional[str] + display_name: Optional[str] + last_updated_date_utc: Optional[datetime] + required_data_connectors: Optional[list[AlertRuleTemplateDataSource]] + severity: Optional[Union[str, AlertSeverity]] + source_settings: Optional[list[FusionTemplateSourceSetting]] + status: Optional[Union[str, TemplateStatus]] + sub_techniques: Optional[list[str]] + tactics: Optional[list[Union[str, AttackTactic]]] + techniques: Optional[list[str]] + + @overload + def __init__( + self, + *, + alert_rules_created_by_template_count: Optional[int] = ..., + description: Optional[str] = ..., + display_name: Optional[str] = ..., + required_data_connectors: Optional[list[AlertRuleTemplateDataSource]] = ..., + severity: Optional[Union[str, AlertSeverity]] = ..., + source_settings: Optional[list[FusionTemplateSourceSetting]] = ..., + status: Optional[Union[str, TemplateStatus]] = ..., + sub_techniques: Optional[list[str]] = ..., + tactics: Optional[list[Union[str, AttackTactic]]] = ..., + techniques: Optional[list[str]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.FusionScenarioExclusionPattern(_Model): + date_added_in_utc: str + exclusion_pattern: str + + @overload + def __init__( + self, + *, + date_added_in_utc: str, + exclusion_pattern: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.FusionSourceSettings(_Model): + enabled: bool + source_name: str + source_sub_types: Optional[list[FusionSourceSubTypeSetting]] + + @overload + def __init__( + self, + *, + enabled: bool, + source_name: str, + source_sub_types: Optional[list[FusionSourceSubTypeSetting]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.FusionSourceSubTypeSetting(_Model): + enabled: bool + severity_filters: FusionSubTypeSeverityFilter + source_sub_type_display_name: Optional[str] + source_sub_type_name: str + + @overload + def __init__( + self, + *, + enabled: bool, + severity_filters: FusionSubTypeSeverityFilter, + source_sub_type_name: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.FusionSubTypeSeverityFilter(_Model): + filters: Optional[list[FusionSubTypeSeverityFiltersItem]] + is_supported: Optional[bool] + + @overload + def __init__( + self, + *, + filters: Optional[list[FusionSubTypeSeverityFiltersItem]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.FusionSubTypeSeverityFiltersItem(_Model): + enabled: bool + severity: Union[str, AlertSeverity] + + @overload + def __init__( + self, + *, + enabled: bool, + severity: Union[str, AlertSeverity] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.FusionTemplateSourceSetting(_Model): + source_name: str + source_sub_types: Optional[list[FusionTemplateSourceSubType]] + + @overload + def __init__( + self, + *, + source_name: str, + source_sub_types: Optional[list[FusionTemplateSourceSubType]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.FusionTemplateSourceSubType(_Model): + severity_filter: FusionTemplateSubTypeSeverityFilter + source_sub_type_display_name: Optional[str] + source_sub_type_name: str + + @overload + def __init__( + self, + *, + severity_filter: FusionTemplateSubTypeSeverityFilter, + source_sub_type_name: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.FusionTemplateSubTypeSeverityFilter(_Model): + is_supported: bool + severity_filters: Optional[list[Union[str, AlertSeverity]]] + + @overload + def __init__( + self, + *, + is_supported: bool, + severity_filters: Optional[list[Union[str, AlertSeverity]]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.GCPAuthModel(CcpAuthConfig, discriminator='GCP'): + project_number: str + service_account_email: str + type: Literal[CcpAuthType.GCP] + workload_identity_provider_id: str + + @overload + def __init__( + self, + *, + project_number: str, + service_account_email: str, + workload_identity_provider_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.GCPAuthProperties(_Model): + project_number: str + service_account_email: str + workload_identity_provider_id: str + + @overload + def __init__( + self, + *, + project_number: str, + service_account_email: str, + workload_identity_provider_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.GCPDataConnector(DataConnector, discriminator='GCP'): + etag: str + id: str + kind: Literal[DataConnectorKind.GCP] + name: str + properties: Optional[GCPDataConnectorProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[GCPDataConnectorProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.GCPDataConnectorProperties(_Model): + auth: GCPAuthProperties + connector_definition_name: str + dcr_config: Optional[DCRConfiguration] + request: GCPRequestProperties + + @overload + def __init__( + self, + *, + auth: GCPAuthProperties, + connector_definition_name: str, + dcr_config: Optional[DCRConfiguration] = ..., + request: GCPRequestProperties + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.GCPRequestProperties(_Model): + project_id: str + subscription_names: list[str] + + @overload + def __init__( + self, + *, + project_id: str, + subscription_names: list[str] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.GenericBlobSbsAuthModel(CcpAuthConfig, discriminator='ServiceBus'): + credentials_config: Optional[dict[str, str]] + storage_account_credentials_config: Optional[dict[str, str]] + type: Literal[CcpAuthType.SERVICE_BUS] + + @overload + def __init__( + self, + *, + credentials_config: Optional[dict[str, str]] = ..., + storage_account_credentials_config: Optional[dict[str, str]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.GeoLocation(_Model): + asn: Optional[int] + city: Optional[str] + country_code: Optional[str] + country_name: Optional[str] + latitude: Optional[float] + longitude: Optional[float] + state: Optional[str] + + + class azure.mgmt.securityinsight.models.GetInsightsError(str, Enum, metaclass=CaseInsensitiveEnumMeta): + INSIGHT = "Insight" + + + class azure.mgmt.securityinsight.models.GetInsightsErrorKind(_Model): + error_message: str + kind: Union[str, GetInsightsError] + query_id: Optional[str] + + @overload + def __init__( + self, + *, + error_message: str, + kind: Union[str, GetInsightsError], + query_id: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.GetInsightsResultsMetadata(_Model): + errors: Optional[list[GetInsightsErrorKind]] + total_count: int + + @overload + def __init__( + self, + *, + errors: Optional[list[GetInsightsErrorKind]] = ..., + total_count: int + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.GitHubAuthModel(CcpAuthConfig, discriminator='GitHub'): + installation_id: Optional[str] + type: Literal[CcpAuthType.GIT_HUB] + + @overload + def __init__( + self, + *, + installation_id: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.GitHubResourceInfo(_Model): + app_installation_id: Optional[str] + + @overload + def __init__( + self, + *, + app_installation_id: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.GraphQueries(_Model): + base_query: Optional[str] + legend: Optional[str] + metric_name: Optional[str] + + @overload + def __init__( + self, + *, + base_query: Optional[str] = ..., + legend: Optional[str] = ..., + metric_name: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.GraphQuery(_Model): + base_query: str + legend: str + metric_name: str + + @overload + def __init__( + self, + *, + base_query: str, + legend: str, + metric_name: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.GroupingConfiguration(_Model): + enabled: bool + group_by_alert_details: Optional[list[Union[str, AlertDetail]]] + group_by_custom_details: Optional[list[str]] + group_by_entities: Optional[list[Union[str, EntityMappingType]]] + lookback_duration: timedelta + matching_method: Union[str, MatchingMethod] + reopen_closed_incident: bool + + @overload + def __init__( + self, + *, + enabled: bool, + group_by_alert_details: Optional[list[Union[str, AlertDetail]]] = ..., + group_by_custom_details: Optional[list[str]] = ..., + group_by_entities: Optional[list[Union[str, EntityMappingType]]] = ..., + lookback_duration: timedelta, + matching_method: Union[str, MatchingMethod], + reopen_closed_incident: bool + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.HostEntity(Entity, discriminator='Host'): + id: str + kind: Literal[EntityKind.HOST] + name: str + properties: Optional[HostEntityProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[HostEntityProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.HostEntityProperties(EntityCommonProperties): + additional_data: dict[str, any] + azure_id: Optional[str] + dns_domain: Optional[str] + friendly_name: str + host_name: Optional[str] + is_domain_joined: Optional[bool] + net_bios_name: Optional[str] + nt_domain: Optional[str] + oms_agent_id: Optional[str] + os_family: Optional[Union[str, OSFamily]] + os_version: Optional[str] + + @overload + def __init__( + self, + *, + os_family: Optional[Union[str, OSFamily]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.HttpMethodVerb(str, Enum, metaclass=CaseInsensitiveEnumMeta): + DELETE = "DELETE" + GET = "GET" + POST = "POST" + PUT = "PUT" + + + class azure.mgmt.securityinsight.models.Hunt(ProxyResource): + etag: Optional[str] + id: str + name: str + properties: Optional[HuntProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[HuntProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.HuntComment(ProxyResource): + etag: Optional[str] + id: str + name: str + properties: Optional[HuntCommentProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[HuntCommentProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.HuntCommentProperties(_Model): + message: str + + @overload + def __init__( + self, + *, + message: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.HuntOwner(_Model): + assigned_to: Optional[str] + email: Optional[str] + object_id: Optional[str] + owner_type: Optional[Union[str, OwnerType]] + user_principal_name: Optional[str] + + @overload + def __init__( + self, + *, + assigned_to: Optional[str] = ..., + email: Optional[str] = ..., + object_id: Optional[str] = ..., + owner_type: Optional[Union[str, OwnerType]] = ..., + user_principal_name: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.HuntProperties(_Model): + attack_tactics: Optional[list[Union[str, AttackTactic]]] + attack_techniques: Optional[list[str]] + description: str + display_name: str + hypothesis_status: Optional[Union[str, HypothesisStatus]] + labels: Optional[list[str]] + owner: Optional[HuntOwner] + status: Optional[Union[str, Status]] + + @overload + def __init__( + self, + *, + attack_tactics: Optional[list[Union[str, AttackTactic]]] = ..., + attack_techniques: Optional[list[str]] = ..., + description: str, + display_name: str, + hypothesis_status: Optional[Union[str, HypothesisStatus]] = ..., + labels: Optional[list[str]] = ..., + owner: Optional[HuntOwner] = ..., + status: Optional[Union[str, Status]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.HuntRelation(ProxyResource): + id: str + name: str + properties: Optional[HuntRelationProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[HuntRelationProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.HuntRelationProperties(_Model): + labels: Optional[list[str]] + related_resource_id: str + related_resource_kind: Optional[str] + related_resource_name: Optional[str] + relation_type: Optional[str] + + @overload + def __init__( + self, + *, + labels: Optional[list[str]] = ..., + related_resource_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.HuntingBookmark(Entity, discriminator='Bookmark'): + id: str + kind: Literal[EntityKind.BOOKMARK] + name: str + properties: Optional[HuntingBookmarkProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[HuntingBookmarkProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.HuntingBookmarkProperties(EntityCommonProperties): + additional_data: dict[str, any] + created: Optional[datetime] + created_by: Optional[UserInfo] + display_name: str + event_time: Optional[datetime] + friendly_name: str + incident_info: Optional[IncidentInfo] + labels: Optional[list[str]] + notes: Optional[str] + query: str + query_result: Optional[str] + updated: Optional[datetime] + updated_by: Optional[UserInfo] + + @overload + def __init__( + self, + *, + created: Optional[datetime] = ..., + created_by: Optional[UserInfo] = ..., + display_name: str, + event_time: Optional[datetime] = ..., + incident_info: Optional[IncidentInfo] = ..., + labels: Optional[list[str]] = ..., + notes: Optional[str] = ..., + query: str, + query_result: Optional[str] = ..., + updated: Optional[datetime] = ..., + updated_by: Optional[UserInfo] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.HypothesisStatus(str, Enum, metaclass=CaseInsensitiveEnumMeta): + INVALIDATED = "Invalidated" + UNKNOWN = "Unknown" + VALIDATED = "Validated" + + + class azure.mgmt.securityinsight.models.Identity(TIObject, discriminator='Identity'): + id: str + kind: Literal[TIObjectKind.IDENTITY] + name: str + properties: TIObjectCommonProperties + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[TIObjectCommonProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.Incident(ProxyResource): + etag: Optional[str] + id: str + name: str + properties: Optional[IncidentProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[IncidentProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.IncidentAdditionalData(_Model): + alert_product_names: Optional[list[str]] + alerts_count: Optional[int] + bookmarks_count: Optional[int] + comments_count: Optional[int] + merged_incident_number: Optional[str] + merged_incident_url: Optional[str] + provider_incident_url: Optional[str] + tactics: Optional[list[Union[str, AttackTactic]]] + techniques: Optional[list[str]] + + + class azure.mgmt.securityinsight.models.IncidentAlertList(_Model): + value: list[SecurityAlert] + + @overload + def __init__( + self, + *, + value: list[SecurityAlert] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.IncidentBookmarkList(_Model): + value: list[HuntingBookmark] + + @overload + def __init__( + self, + *, + value: list[HuntingBookmark] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.IncidentClassification(str, Enum, metaclass=CaseInsensitiveEnumMeta): + BENIGN_POSITIVE = "BenignPositive" + FALSE_POSITIVE = "FalsePositive" + TRUE_POSITIVE = "TruePositive" + UNDETERMINED = "Undetermined" + + + class azure.mgmt.securityinsight.models.IncidentClassificationReason(str, Enum, metaclass=CaseInsensitiveEnumMeta): + INACCURATE_DATA = "InaccurateData" + INCORRECT_ALERT_LOGIC = "IncorrectAlertLogic" + SUSPICIOUS_ACTIVITY = "SuspiciousActivity" + SUSPICIOUS_BUT_EXPECTED = "SuspiciousButExpected" + + + class azure.mgmt.securityinsight.models.IncidentComment(ProxyResource): + etag: Optional[str] + id: str + name: str + properties: Optional[IncidentCommentProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[IncidentCommentProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.IncidentCommentProperties(_Model): + author: Optional[ClientInfo] + created_time_utc: Optional[datetime] + last_modified_time_utc: Optional[datetime] + message: str + + @overload + def __init__( + self, + *, + message: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.IncidentConfiguration(_Model): + create_incident: bool + grouping_configuration: Optional[GroupingConfiguration] + + @overload + def __init__( + self, + *, + create_incident: bool, + grouping_configuration: Optional[GroupingConfiguration] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.IncidentEntitiesResponse(_Model): + entities: Optional[list[Entity]] + meta_data: Optional[list[IncidentEntitiesResultsMetadata]] + + @overload + def __init__( + self, + *, + entities: Optional[list[Entity]] = ..., + meta_data: Optional[list[IncidentEntitiesResultsMetadata]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.IncidentEntitiesResultsMetadata(_Model): + count: int + entity_kind: Union[str, EntityKind] + + @overload + def __init__( + self, + *, + count: int, + entity_kind: Union[str, EntityKind] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.IncidentInfo(_Model): + incident_id: Optional[str] + relation_name: Optional[str] + severity: Optional[Union[str, IncidentSeverity]] + title: Optional[str] + + @overload + def __init__( + self, + *, + incident_id: Optional[str] = ..., + relation_name: Optional[str] = ..., + severity: Optional[Union[str, IncidentSeverity]] = ..., + title: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.IncidentLabel(_Model): + label_name: str + label_type: Optional[Union[str, IncidentLabelType]] + + @overload + def __init__( + self, + *, + label_name: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.IncidentLabelType(str, Enum, metaclass=CaseInsensitiveEnumMeta): + AUTO_ASSIGNED = "AutoAssigned" + USER = "User" + + + class azure.mgmt.securityinsight.models.IncidentOwnerInfo(_Model): + assigned_to: Optional[str] + email: Optional[str] + object_id: Optional[str] + owner_type: Optional[Union[str, OwnerType]] + user_principal_name: Optional[str] + + @overload + def __init__( + self, + *, + assigned_to: Optional[str] = ..., + email: Optional[str] = ..., + object_id: Optional[str] = ..., + owner_type: Optional[Union[str, OwnerType]] = ..., + user_principal_name: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.IncidentProperties(_Model): + additional_data: Optional[IncidentAdditionalData] + classification: Optional[Union[str, IncidentClassification]] + classification_comment: Optional[str] + classification_reason: Optional[Union[str, IncidentClassificationReason]] + created_time_utc: Optional[datetime] + description: Optional[str] + first_activity_time_utc: Optional[datetime] + incident_number: Optional[int] + incident_url: Optional[str] + labels: Optional[list[IncidentLabel]] + last_activity_time_utc: Optional[datetime] + last_modified_time_utc: Optional[datetime] + owner: Optional[IncidentOwnerInfo] + provider_incident_id: Optional[str] + provider_name: Optional[str] + related_analytic_rule_ids: Optional[list[str]] + severity: Union[str, IncidentSeverity] + status: Union[str, IncidentStatus] + team_information: Optional[TeamInformation] + title: str + + @overload + def __init__( + self, + *, + classification: Optional[Union[str, IncidentClassification]] = ..., + classification_comment: Optional[str] = ..., + classification_reason: Optional[Union[str, IncidentClassificationReason]] = ..., + description: Optional[str] = ..., + first_activity_time_utc: Optional[datetime] = ..., + labels: Optional[list[IncidentLabel]] = ..., + last_activity_time_utc: Optional[datetime] = ..., + owner: Optional[IncidentOwnerInfo] = ..., + severity: Union[str, IncidentSeverity], + status: Union[str, IncidentStatus], + team_information: Optional[TeamInformation] = ..., + title: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.IncidentPropertiesAction(_Model): + classification: Optional[Union[str, IncidentClassification]] + classification_comment: Optional[str] + classification_reason: Optional[Union[str, IncidentClassificationReason]] + labels: Optional[list[IncidentLabel]] + owner: Optional[IncidentOwnerInfo] + severity: Optional[Union[str, IncidentSeverity]] + status: Optional[Union[str, IncidentStatus]] + + @overload + def __init__( + self, + *, + classification: Optional[Union[str, IncidentClassification]] = ..., + classification_comment: Optional[str] = ..., + classification_reason: Optional[Union[str, IncidentClassificationReason]] = ..., + labels: Optional[list[IncidentLabel]] = ..., + owner: Optional[IncidentOwnerInfo] = ..., + severity: Optional[Union[str, IncidentSeverity]] = ..., + status: Optional[Union[str, IncidentStatus]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.IncidentSeverity(str, Enum, metaclass=CaseInsensitiveEnumMeta): + HIGH = "High" + INFORMATIONAL = "Informational" + LOW = "Low" + MEDIUM = "Medium" + + + class azure.mgmt.securityinsight.models.IncidentStatus(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ACTIVE = "Active" + CLOSED = "Closed" + NEW = "New" + + + class azure.mgmt.securityinsight.models.IncidentTask(ProxyResource): + etag: Optional[str] + id: str + name: str + properties: IncidentTaskProperties + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: IncidentTaskProperties + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.IncidentTaskProperties(_Model): + created_by: Optional[ClientInfo] + created_time_utc: Optional[datetime] + description: Optional[str] + last_modified_by: Optional[ClientInfo] + last_modified_time_utc: Optional[datetime] + status: Union[str, IncidentTaskStatus] + title: str + + @overload + def __init__( + self, + *, + created_by: Optional[ClientInfo] = ..., + description: Optional[str] = ..., + last_modified_by: Optional[ClientInfo] = ..., + status: Union[str, IncidentTaskStatus], + title: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.IncidentTaskStatus(str, Enum, metaclass=CaseInsensitiveEnumMeta): + COMPLETED = "Completed" + NEW = "New" + + + class azure.mgmt.securityinsight.models.Indicator(TIObject, discriminator='Indicator'): + id: str + kind: Literal[TIObjectKind.INDICATOR] + name: str + observables: Optional[list[IndicatorObservablesItem]] + properties: TIObjectCommonProperties + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + observables: Optional[list[IndicatorObservablesItem]] = ..., + properties: Optional[TIObjectCommonProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.IndicatorObservablesItem(_Model): + type: Optional[str] + value: Optional[str] + + @overload + def __init__( + self, + *, + type: Optional[str] = ..., + value: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.IngestionMode(str, Enum, metaclass=CaseInsensitiveEnumMeta): + INGEST_ANY_VALID_RECORDS = "IngestAnyValidRecords" + INGEST_ONLY_IF_ALL_ARE_VALID = "IngestOnlyIfAllAreValid" + UNSPECIFIED = "Unspecified" + + + class azure.mgmt.securityinsight.models.InsightQueryItem(EntityQueryItem, discriminator='Insight'): + id: str + kind: Literal[EntityQueryKind.INSIGHT] + name: str + properties: Optional[InsightQueryItemProperties] + type: str + + @overload + def __init__( + self, + *, + name: Optional[str] = ..., + properties: Optional[InsightQueryItemProperties] = ..., + type: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.InsightQueryItemProperties(EntityQueryItemProperties): + additional_query: Optional[InsightQueryItemPropertiesAdditionalQuery] + base_query: Optional[str] + chart_query: Optional[Any] + data_types: list[EntityQueryItemPropertiesDataTypesItem] + default_time_range: Optional[InsightQueryItemPropertiesDefaultTimeRange] + description: Optional[str] + display_name: Optional[str] + entities_filter: any + input_entity_type: Union[str, EntityType] + reference_time_range: Optional[InsightQueryItemPropertiesReferenceTimeRange] + required_input_fields_sets: list[list[str]] + table_query: Optional[InsightQueryItemPropertiesTableQuery] + + @overload + def __init__( + self, + *, + additional_query: Optional[InsightQueryItemPropertiesAdditionalQuery] = ..., + base_query: Optional[str] = ..., + chart_query: Optional[Any] = ..., + data_types: Optional[list[EntityQueryItemPropertiesDataTypesItem]] = ..., + default_time_range: Optional[InsightQueryItemPropertiesDefaultTimeRange] = ..., + description: Optional[str] = ..., + display_name: Optional[str] = ..., + entities_filter: Optional[Any] = ..., + input_entity_type: Optional[Union[str, EntityType]] = ..., + reference_time_range: Optional[InsightQueryItemPropertiesReferenceTimeRange] = ..., + required_input_fields_sets: Optional[list[list[str]]] = ..., + table_query: Optional[InsightQueryItemPropertiesTableQuery] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.InsightQueryItemPropertiesAdditionalQuery(_Model): + query: Optional[str] + text: Optional[str] + + @overload + def __init__( + self, + *, + query: Optional[str] = ..., + text: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.InsightQueryItemPropertiesDefaultTimeRange(_Model): + after_range: Optional[str] + before_range: Optional[str] + + @overload + def __init__( + self, + *, + after_range: Optional[str] = ..., + before_range: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.InsightQueryItemPropertiesReferenceTimeRange(_Model): + before_range: Optional[str] + + @overload + def __init__( + self, + *, + before_range: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.InsightQueryItemPropertiesTableQuery(_Model): + columns_definitions: Optional[list[InsightQueryItemPropertiesTableQueryColumnsDefinitionsItem]] + queries_definitions: Optional[list[InsightQueryItemPropertiesTableQueryQueriesDefinitionsItem]] + + @overload + def __init__( + self, + *, + columns_definitions: Optional[list[InsightQueryItemPropertiesTableQueryColumnsDefinitionsItem]] = ..., + queries_definitions: Optional[list[InsightQueryItemPropertiesTableQueryQueriesDefinitionsItem]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.InsightQueryItemPropertiesTableQueryColumnsDefinitionsItem(_Model): + header: Optional[str] + output_type: Optional[Union[str, OutputType]] + support_deep_link: Optional[bool] + + @overload + def __init__( + self, + *, + header: Optional[str] = ..., + output_type: Optional[Union[str, OutputType]] = ..., + support_deep_link: Optional[bool] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.InsightQueryItemPropertiesTableQueryQueriesDefinitionsItem(_Model): + filter: Optional[str] + link_columns_definitions: Optional[list[InsightQueryItemPropertiesTableQueryQueriesDefinitionsPropertiesItemsItem]] + project: Optional[str] + summarize: Optional[str] + + @overload + def __init__( + self, + *, + filter: Optional[str] = ..., + link_columns_definitions: Optional[list[InsightQueryItemPropertiesTableQueryQueriesDefinitionsPropertiesItemsItem]] = ..., + project: Optional[str] = ..., + summarize: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.InsightQueryItemPropertiesTableQueryQueriesDefinitionsPropertiesItemsItem(_Model): + projected_name: Optional[str] + query: Optional[str] + + @overload + def __init__( + self, + *, + projected_name: Optional[str] = ..., + query: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.InsightsTableResult(_Model): + columns: Optional[list[InsightsTableResultColumnsItem]] + rows: Optional[list[list[str]]] + + @overload + def __init__( + self, + *, + columns: Optional[list[InsightsTableResultColumnsItem]] = ..., + rows: Optional[list[list[str]]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.InsightsTableResultColumnsItem(_Model): + name: Optional[str] + type: Optional[str] + + @overload + def __init__( + self, + *, + name: Optional[str] = ..., + type: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.InstructionStep(_Model): + description: Optional[str] + inner_steps: Optional[list[InstructionStep]] + instructions: Optional[list[InstructionStepDetails]] + title: Optional[str] + + @overload + def __init__( + self, + *, + description: Optional[str] = ..., + inner_steps: Optional[list[InstructionStep]] = ..., + instructions: Optional[list[InstructionStepDetails]] = ..., + title: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.InstructionStepDetails(_Model): + parameters: Any + type: str + + @overload + def __init__( + self, + *, + parameters: Any, + type: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.InstructionSteps(_Model): + description: Optional[str] + instructions: Optional[list[InstructionStepsInstructionsItem]] + title: Optional[str] + + @overload + def __init__( + self, + *, + description: Optional[str] = ..., + instructions: Optional[list[InstructionStepsInstructionsItem]] = ..., + title: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.InstructionStepsInstructionsItem(ConnectorInstructionModelBase): + parameters: any + type: Union[str, SettingType] + + @overload + def __init__( + self, + *, + parameters: Optional[Any] = ..., + type: Union[str, SettingType] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.IoTCheckRequirements(DataConnectorsCheckRequirements, discriminator='IOT'): + kind: Literal[DataConnectorKind.IOT] + properties: Optional[IoTCheckRequirementsProperties] + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[IoTCheckRequirementsProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.IoTCheckRequirementsProperties(_Model): + subscription_id: Optional[str] + + @overload + def __init__( + self, + *, + subscription_id: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.IoTDataConnector(DataConnector, discriminator='IOT'): + etag: str + id: str + kind: Literal[DataConnectorKind.IOT] + name: str + properties: Optional[IoTDataConnectorProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[IoTDataConnectorProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.IoTDataConnectorProperties(DataConnectorWithAlertsProperties): + data_types: AlertsDataTypeOfDataConnector + subscription_id: Optional[str] + + @overload + def __init__( + self, + *, + data_types: Optional[AlertsDataTypeOfDataConnector] = ..., + subscription_id: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.IoTDeviceEntity(Entity, discriminator='IoTDevice'): + id: str + kind: Literal[EntityKind.IO_T_DEVICE] + name: str + properties: Optional[IoTDeviceEntityProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[IoTDeviceEntityProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.IoTDeviceEntityProperties(EntityCommonProperties): + additional_data: dict[str, any] + device_id: Optional[str] + device_name: Optional[str] + device_sub_type: Optional[str] + device_type: Optional[str] + edge_id: Optional[str] + firmware_version: Optional[str] + friendly_name: str + host_entity_id: Optional[str] + importance: Optional[Union[str, DeviceImportance]] + iot_hub_entity_id: Optional[str] + iot_security_agent_id: Optional[str] + ip_address_entity_id: Optional[str] + is_authorized: Optional[bool] + is_programming: Optional[bool] + is_scanner: Optional[bool] + mac_address: Optional[str] + model: Optional[str] + nic_entity_ids: Optional[list[str]] + operating_system: Optional[str] + owners: Optional[list[str]] + protocols: Optional[list[str]] + purdue_layer: Optional[str] + sensor: Optional[str] + serial_number: Optional[str] + site: Optional[str] + source: Optional[str] + threat_intelligence: Optional[list[ThreatIntelligence]] + vendor: Optional[str] + zone: Optional[str] + + @overload + def __init__( + self, + *, + importance: Optional[Union[str, DeviceImportance]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.IpEntity(Entity, discriminator='Ip'): + id: str + kind: Literal[EntityKind.IP] + name: str + properties: Optional[IpEntityProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[IpEntityProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.IpEntityProperties(EntityCommonProperties): + additional_data: dict[str, any] + address: Optional[str] + friendly_name: str + location: Optional[GeoLocation] + threat_intelligence: Optional[list[ThreatIntelligence]] + + + class azure.mgmt.securityinsight.models.Job(ProxyResource): + etag: Optional[str] + id: str + name: str + properties: Optional[JobProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[JobProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.JobItem(_Model): + errors: Optional[list[Error]] + execution_time: Optional[datetime] + resource_id: Optional[str] + status: Optional[Union[str, Status]] + + @overload + def __init__( + self, + *, + errors: Optional[list[Error]] = ..., + resource_id: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.JobProperties(_Model): + end_time: Optional[datetime] + error_message: Optional[str] + items_property: Optional[list[JobItem]] + provisioning_state: Optional[Union[str, JobProvisioningState]] + start_time: Optional[datetime] + + @overload + def __init__( + self, + *, + items_property: Optional[list[JobItem]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.JobProvisioningState(str, Enum, metaclass=CaseInsensitiveEnumMeta): + CANCELED = "Canceled" + FAILED = "Failed" + IN_PROGRESS = "InProgress" + SUCCEEDED = "Succeeded" + + + class azure.mgmt.securityinsight.models.JwtAuthModel(CcpAuthConfig, discriminator='JwtToken'): + headers: Optional[dict[str, str]] + is_credentials_in_headers: Optional[bool] + is_json_request: Optional[bool] + password: dict[str, str] + query_parameters: Optional[dict[str, str]] + request_timeout_in_seconds: Optional[int] + token_endpoint: str + type: Literal[CcpAuthType.JWT_TOKEN] + user_name: dict[str, str] + + @overload + def __init__( + self, + *, + headers: Optional[dict[str, str]] = ..., + is_credentials_in_headers: Optional[bool] = ..., + is_json_request: Optional[bool] = ..., + password: dict[str, str], + query_parameters: Optional[dict[str, str]] = ..., + request_timeout_in_seconds: Optional[int] = ..., + token_endpoint: str, + user_name: dict[str, str] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.KillChainIntent(str, Enum, metaclass=CaseInsensitiveEnumMeta): + COLLECTION = "Collection" + COMMAND_AND_CONTROL = "CommandAndControl" + CREDENTIAL_ACCESS = "CredentialAccess" + DEFENSE_EVASION = "DefenseEvasion" + DISCOVERY = "Discovery" + EXECUTION = "Execution" + EXFILTRATION = "Exfiltration" + EXPLOITATION = "Exploitation" + IMPACT = "Impact" + LATERAL_MOVEMENT = "LateralMovement" + PERSISTENCE = "Persistence" + PRIVILEGE_ESCALATION = "PrivilegeEscalation" + PROBING = "Probing" + UNKNOWN = "Unknown" + + + class azure.mgmt.securityinsight.models.Kind(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ANALYTICS_RULE = "AnalyticsRule" + ANALYTICS_RULE_TEMPLATE = "AnalyticsRuleTemplate" + AUTOMATION_RULE = "AutomationRule" + AZURE_FUNCTION = "AzureFunction" + CUSTOM_DETECTION = "CustomDetection" + DATA_CONNECTOR = "DataConnector" + DATA_TYPE = "DataType" + HUNTING_QUERY = "HuntingQuery" + INVESTIGATION_QUERY = "InvestigationQuery" + LOGIC_APPS_CUSTOM_CONNECTOR = "LogicAppsCustomConnector" + NOTEBOOK = "Notebook" + PARSER = "Parser" + PLAYBOOK = "Playbook" + PLAYBOOK_TEMPLATE = "PlaybookTemplate" + RESOURCES_DATA_CONNECTOR = "ResourcesDataConnector" + SOLUTION = "Solution" + STANDALONE = "Standalone" + SUMMARY_RULE = "SummaryRule" + WATCHLIST = "Watchlist" + WATCHLIST_TEMPLATE = "WatchlistTemplate" + WORKBOOK = "Workbook" + WORKBOOK_TEMPLATE = "WorkbookTemplate" + + + class azure.mgmt.securityinsight.models.LastDataReceivedDataType(_Model): + last_data_received_query: Optional[str] + name: Optional[str] + + @overload + def __init__( + self, + *, + last_data_received_query: Optional[str] = ..., + name: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MCASCheckRequirements(DataConnectorsCheckRequirements, discriminator='MicrosoftCloudAppSecurity'): + kind: Literal[DataConnectorKind.MICROSOFT_CLOUD_APP_SECURITY] + properties: Optional[MCASCheckRequirementsProperties] + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[MCASCheckRequirementsProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.MCASCheckRequirementsProperties(DataConnectorTenantId): + tenant_id: str + + @overload + def __init__( + self, + *, + tenant_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MCASDataConnector(DataConnector, discriminator='MicrosoftCloudAppSecurity'): + etag: str + id: str + kind: Literal[DataConnectorKind.MICROSOFT_CLOUD_APP_SECURITY] + name: str + properties: Optional[MCASDataConnectorProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[MCASDataConnectorProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.MCASDataConnectorDataTypes(AlertsDataTypeOfDataConnector): + alerts: DataConnectorDataTypeCommon + discovery_logs: Optional[DataConnectorDataTypeCommon] + + @overload + def __init__( + self, + *, + alerts: DataConnectorDataTypeCommon, + discovery_logs: Optional[DataConnectorDataTypeCommon] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MCASDataConnectorProperties(DataConnectorTenantId): + data_types: MCASDataConnectorDataTypes + tenant_id: str + + @overload + def __init__( + self, + *, + data_types: MCASDataConnectorDataTypes, + tenant_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MDATPCheckRequirements(DataConnectorsCheckRequirements, discriminator='MicrosoftDefenderAdvancedThreatProtection'): + kind: Literal[DataConnectorKind.MICROSOFT_DEFENDER_ADVANCED_THREAT_PROTECTION] + properties: Optional[MDATPCheckRequirementsProperties] + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[MDATPCheckRequirementsProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.MDATPCheckRequirementsProperties(DataConnectorTenantId): + tenant_id: str + + @overload + def __init__( + self, + *, + tenant_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MDATPDataConnector(DataConnector, discriminator='MicrosoftDefenderAdvancedThreatProtection'): + etag: str + id: str + kind: Literal[DataConnectorKind.MICROSOFT_DEFENDER_ADVANCED_THREAT_PROTECTION] + name: str + properties: Optional[MDATPDataConnectorProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[MDATPDataConnectorProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.MDATPDataConnectorProperties(_Model): + data_types: Optional[AlertsDataTypeOfDataConnector] + tenant_id: str + + @overload + def __init__( + self, + *, + data_types: Optional[AlertsDataTypeOfDataConnector] = ..., + tenant_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MLBehaviorAnalyticsAlertRule(AlertRule, discriminator='MLBehaviorAnalytics'): + etag: str + id: str + kind: Literal[AlertRuleKind.ML_BEHAVIOR_ANALYTICS] + name: str + properties: Optional[MLBehaviorAnalyticsAlertRuleProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[MLBehaviorAnalyticsAlertRuleProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.MLBehaviorAnalyticsAlertRuleProperties(_Model): + alert_rule_template_name: str + description: Optional[str] + display_name: Optional[str] + enabled: bool + last_modified_utc: Optional[datetime] + severity: Optional[Union[str, AlertSeverity]] + sub_techniques: Optional[list[str]] + tactics: Optional[list[Union[str, AttackTactic]]] + techniques: Optional[list[str]] + + @overload + def __init__( + self, + *, + alert_rule_template_name: str, + enabled: bool + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MLBehaviorAnalyticsAlertRuleTemplate(AlertRuleTemplate, discriminator='MLBehaviorAnalytics'): + id: str + kind: Literal[AlertRuleKind.ML_BEHAVIOR_ANALYTICS] + name: str + properties: Optional[MLBehaviorAnalyticsAlertRuleTemplateProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[MLBehaviorAnalyticsAlertRuleTemplateProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.MLBehaviorAnalyticsAlertRuleTemplateProperties(AlertRuleTemplateWithMitreProperties): + alert_rules_created_by_template_count: int + created_date_utc: datetime + description: str + display_name: str + last_updated_date_utc: datetime + required_data_connectors: list[AlertRuleTemplateDataSource] + severity: Union[str, AlertSeverity] + status: Union[str, TemplateStatus] + tactics: Union[list[str, AttackTactic]] + techniques: list[str] + + @overload + def __init__( + self, + *, + alert_rules_created_by_template_count: Optional[int] = ..., + description: Optional[str] = ..., + display_name: Optional[str] = ..., + required_data_connectors: Optional[list[AlertRuleTemplateDataSource]] = ..., + severity: Union[str, AlertSeverity], + status: Optional[Union[str, TemplateStatus]] = ..., + tactics: Optional[list[Union[str, AttackTactic]]] = ..., + techniques: Optional[list[str]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MSTICheckRequirements(DataConnectorsCheckRequirements, discriminator='MicrosoftThreatIntelligence'): + kind: Literal[DataConnectorKind.MICROSOFT_THREAT_INTELLIGENCE] + properties: Optional[MSTICheckRequirementsProperties] + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[MSTICheckRequirementsProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.MSTICheckRequirementsProperties(DataConnectorTenantId): + tenant_id: str + + @overload + def __init__( + self, + *, + tenant_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MSTIDataConnector(DataConnector, discriminator='MicrosoftThreatIntelligence'): + etag: str + id: str + kind: Literal[DataConnectorKind.MICROSOFT_THREAT_INTELLIGENCE] + name: str + properties: Optional[MSTIDataConnectorProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[MSTIDataConnectorProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.MSTIDataConnectorDataTypes(_Model): + microsoft_emerging_threat_feed: MSTIDataConnectorDataTypesMicrosoftEmergingThreatFeed + + @overload + def __init__( + self, + *, + microsoft_emerging_threat_feed: MSTIDataConnectorDataTypesMicrosoftEmergingThreatFeed + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MSTIDataConnectorDataTypesMicrosoftEmergingThreatFeed(DataConnectorDataTypeCommon): + lookback_period: datetime + state: Union[str, DataTypeState] + + @overload + def __init__( + self, + *, + lookback_period: datetime, + state: Union[str, DataTypeState] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MSTIDataConnectorProperties(DataConnectorTenantId): + data_types: MSTIDataConnectorDataTypes + tenant_id: str + + @overload + def __init__( + self, + *, + data_types: MSTIDataConnectorDataTypes, + tenant_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MTPCheckRequirementsProperties(DataConnectorTenantId): + tenant_id: str + + @overload + def __init__( + self, + *, + tenant_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MTPDataConnector(DataConnector, discriminator='MicrosoftThreatProtection'): + etag: str + id: str + kind: Literal[DataConnectorKind.MICROSOFT_THREAT_PROTECTION] + name: str + properties: Optional[MTPDataConnectorProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[MTPDataConnectorProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.MTPDataConnectorDataTypes(_Model): + alerts: Optional[MTPDataConnectorDataTypesAlerts] + incidents: MTPDataConnectorDataTypesIncidents + + @overload + def __init__( + self, + *, + alerts: Optional[MTPDataConnectorDataTypesAlerts] = ..., + incidents: MTPDataConnectorDataTypesIncidents + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MTPDataConnectorDataTypesAlerts(DataConnectorDataTypeCommon): + state: Union[str, DataTypeState] + + @overload + def __init__( + self, + *, + state: Union[str, DataTypeState] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MTPDataConnectorDataTypesIncidents(DataConnectorDataTypeCommon): + state: Union[str, DataTypeState] + + @overload + def __init__( + self, + *, + state: Union[str, DataTypeState] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MTPDataConnectorProperties(DataConnectorTenantId): + data_types: MTPDataConnectorDataTypes + filtered_providers: Optional[MtpFilteredProviders] + tenant_id: str + + @overload + def __init__( + self, + *, + data_types: MTPDataConnectorDataTypes, + filtered_providers: Optional[MtpFilteredProviders] = ..., + tenant_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MailClusterEntity(Entity, discriminator='MailCluster'): + id: str + kind: Literal[EntityKind.MAIL_CLUSTER] + name: str + properties: Optional[MailClusterEntityProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[MailClusterEntityProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.MailClusterEntityProperties(EntityCommonProperties): + additional_data: dict[str, any] + cluster_group: Optional[str] + cluster_query_end_time: Optional[datetime] + cluster_query_start_time: Optional[datetime] + cluster_source_identifier: Optional[str] + cluster_source_type: Optional[str] + count_by_delivery_status: Optional[Any] + count_by_protection_status: Optional[Any] + count_by_threat_type: Optional[Any] + friendly_name: str + is_volume_anomaly: Optional[bool] + mail_count: Optional[int] + network_message_ids: Optional[list[str]] + query: Optional[str] + query_time: Optional[datetime] + source: Optional[str] + threats: Optional[list[str]] + + + class azure.mgmt.securityinsight.models.MailMessageEntity(Entity, discriminator='MailMessage'): + id: str + kind: Literal[EntityKind.MAIL_MESSAGE] + name: str + properties: Optional[MailMessageEntityProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[MailMessageEntityProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.MailMessageEntityProperties(EntityCommonProperties): + additional_data: dict[str, any] + antispam_direction: Optional[Union[str, AntispamMailDirection]] + body_fingerprint_bin1: Optional[int] + body_fingerprint_bin2: Optional[int] + body_fingerprint_bin3: Optional[int] + body_fingerprint_bin4: Optional[int] + body_fingerprint_bin5: Optional[int] + delivery_action: Optional[Union[str, DeliveryAction]] + delivery_location: Optional[Union[str, DeliveryLocation]] + file_entity_ids: Optional[list[str]] + friendly_name: str + internet_message_id: Optional[str] + language: Optional[str] + network_message_id: Optional[str] + p1_sender: Optional[str] + p1_sender_display_name: Optional[str] + p1_sender_domain: Optional[str] + p2_sender: Optional[str] + p2_sender_display_name: Optional[str] + p2_sender_domain: Optional[str] + receive_date: Optional[datetime] + recipient: Optional[str] + sender_ip: Optional[str] + subject: Optional[str] + threat_detection_methods: Optional[list[str]] + threats: Optional[list[str]] + urls: Optional[list[str]] + + @overload + def __init__( + self, + *, + antispam_direction: Optional[Union[str, AntispamMailDirection]] = ..., + body_fingerprint_bin1: Optional[int] = ..., + body_fingerprint_bin2: Optional[int] = ..., + body_fingerprint_bin3: Optional[int] = ..., + body_fingerprint_bin4: Optional[int] = ..., + body_fingerprint_bin5: Optional[int] = ..., + delivery_action: Optional[Union[str, DeliveryAction]] = ..., + delivery_location: Optional[Union[str, DeliveryLocation]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MailboxEntity(Entity, discriminator='Mailbox'): + id: str + kind: Literal[EntityKind.MAILBOX] + name: str + properties: Optional[MailboxEntityProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[MailboxEntityProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.MailboxEntityProperties(EntityCommonProperties): + additional_data: dict[str, any] + display_name: Optional[str] + external_directory_object_id: Optional[str] + friendly_name: str + mailbox_primary_address: Optional[str] + upn: Optional[str] + + + class azure.mgmt.securityinsight.models.MalwareEntity(Entity, discriminator='Malware'): + id: str + kind: Literal[EntityKind.MALWARE] + name: str + properties: Optional[MalwareEntityProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[MalwareEntityProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.MalwareEntityProperties(EntityCommonProperties): + additional_data: dict[str, any] + category: Optional[str] + file_entity_ids: Optional[list[str]] + friendly_name: str + malware_name: Optional[str] + process_entity_ids: Optional[list[str]] + + + class azure.mgmt.securityinsight.models.ManualTriggerRequestBody(_Model): + logic_apps_resource_id: str + tenant_id: Optional[str] + + @overload + def __init__( + self, + *, + logic_apps_resource_id: str, + tenant_id: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MatchingMethod(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ALL_ENTITIES = "AllEntities" + ANY_ALERT = "AnyAlert" + SELECTED = "Selected" + + + class azure.mgmt.securityinsight.models.MetadataAuthor(_Model): + email: Optional[str] + link: Optional[str] + name: Optional[str] + + @overload + def __init__( + self, + *, + email: Optional[str] = ..., + link: Optional[str] = ..., + name: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MetadataCategories(_Model): + domains: Optional[list[str]] + verticals: Optional[list[str]] + + @overload + def __init__( + self, + *, + domains: Optional[list[str]] = ..., + verticals: Optional[list[str]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MetadataDependencies(_Model): + content_id: Optional[str] + criteria: Optional[list[MetadataDependencies]] + kind: Optional[Union[str, Kind]] + name: Optional[str] + operator: Optional[Union[str, MetadataDependencyOperator]] + version: Optional[str] + + @overload + def __init__( + self, + *, + content_id: Optional[str] = ..., + criteria: Optional[list[MetadataDependencies]] = ..., + kind: Optional[Union[str, Kind]] = ..., + name: Optional[str] = ..., + operator: Optional[Union[str, MetadataDependencyOperator]] = ..., + version: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MetadataDependencyOperator(str, Enum, metaclass=CaseInsensitiveEnumMeta): + AND = "AND" + OR = "OR" + + + class azure.mgmt.securityinsight.models.MetadataModel(ProxyResource): + etag: Optional[str] + id: str + name: str + properties: Optional[MetadataProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[MetadataProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.MetadataPatch(ResourceWithEtag): + etag: str + id: str + name: str + properties: Optional[MetadataPropertiesPatch] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[MetadataPropertiesPatch] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.MetadataProperties(_Model): + author: Optional[MetadataAuthor] + categories: Optional[MetadataCategories] + content_id: Optional[str] + content_schema_version: Optional[str] + custom_version: Optional[str] + dependencies: Optional[MetadataDependencies] + first_publish_date: Optional[date] + icon: Optional[str] + kind: str + last_publish_date: Optional[date] + parent_id: str + preview_images: Optional[list[str]] + preview_images_dark: Optional[list[str]] + providers: Optional[list[str]] + source: Optional[MetadataSource] + support: Optional[MetadataSupport] + threat_analysis_tactics: Optional[list[str]] + threat_analysis_techniques: Optional[list[str]] + version: Optional[str] + + @overload + def __init__( + self, + *, + author: Optional[MetadataAuthor] = ..., + categories: Optional[MetadataCategories] = ..., + content_id: Optional[str] = ..., + content_schema_version: Optional[str] = ..., + custom_version: Optional[str] = ..., + dependencies: Optional[MetadataDependencies] = ..., + first_publish_date: Optional[date] = ..., + icon: Optional[str] = ..., + kind: str, + last_publish_date: Optional[date] = ..., + parent_id: str, + preview_images: Optional[list[str]] = ..., + preview_images_dark: Optional[list[str]] = ..., + providers: Optional[list[str]] = ..., + source: Optional[MetadataSource] = ..., + support: Optional[MetadataSupport] = ..., + threat_analysis_tactics: Optional[list[str]] = ..., + threat_analysis_techniques: Optional[list[str]] = ..., + version: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MetadataPropertiesPatch(_Model): + author: Optional[MetadataAuthor] + categories: Optional[MetadataCategories] + content_id: Optional[str] + content_schema_version: Optional[str] + custom_version: Optional[str] + dependencies: Optional[MetadataDependencies] + first_publish_date: Optional[date] + icon: Optional[str] + kind: Optional[str] + last_publish_date: Optional[date] + parent_id: Optional[str] + preview_images: Optional[list[str]] + preview_images_dark: Optional[list[str]] + providers: Optional[list[str]] + source: Optional[MetadataSource] + support: Optional[MetadataSupport] + threat_analysis_tactics: Optional[list[str]] + threat_analysis_techniques: Optional[list[str]] + version: Optional[str] + + @overload + def __init__( + self, + *, + author: Optional[MetadataAuthor] = ..., + categories: Optional[MetadataCategories] = ..., + content_id: Optional[str] = ..., + content_schema_version: Optional[str] = ..., + custom_version: Optional[str] = ..., + dependencies: Optional[MetadataDependencies] = ..., + first_publish_date: Optional[date] = ..., + icon: Optional[str] = ..., + kind: Optional[str] = ..., + last_publish_date: Optional[date] = ..., + parent_id: Optional[str] = ..., + preview_images: Optional[list[str]] = ..., + preview_images_dark: Optional[list[str]] = ..., + providers: Optional[list[str]] = ..., + source: Optional[MetadataSource] = ..., + support: Optional[MetadataSupport] = ..., + threat_analysis_tactics: Optional[list[str]] = ..., + threat_analysis_techniques: Optional[list[str]] = ..., + version: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MetadataSource(_Model): + kind: Union[str, SourceKind] + name: Optional[str] + source_id: Optional[str] + + @overload + def __init__( + self, + *, + kind: Union[str, SourceKind], + name: Optional[str] = ..., + source_id: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MetadataSupport(_Model): + email: Optional[str] + link: Optional[str] + name: Optional[str] + tier: Union[str, SupportTier] + + @overload + def __init__( + self, + *, + email: Optional[str] = ..., + link: Optional[str] = ..., + name: Optional[str] = ..., + tier: Union[str, SupportTier] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MicrosoftPurviewInformationProtectionCheckRequirements(DataConnectorsCheckRequirements, discriminator='MicrosoftPurviewInformationProtection'): + kind: Literal[DataConnectorKind.MICROSOFT_PURVIEW_INFORMATION_PROTECTION] + properties: Optional[MicrosoftPurviewInformationProtectionCheckRequirementsProperties] + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[MicrosoftPurviewInformationProtectionCheckRequirementsProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.MicrosoftPurviewInformationProtectionCheckRequirementsProperties(DataConnectorTenantId): + tenant_id: str + + @overload + def __init__( + self, + *, + tenant_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MicrosoftPurviewInformationProtectionConnectorDataTypes(_Model): + logs: MicrosoftPurviewInformationProtectionConnectorDataTypesLogs + + @overload + def __init__( + self, + *, + logs: MicrosoftPurviewInformationProtectionConnectorDataTypesLogs + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MicrosoftPurviewInformationProtectionConnectorDataTypesLogs(DataConnectorDataTypeCommon): + state: Union[str, DataTypeState] + + @overload + def __init__( + self, + *, + state: Union[str, DataTypeState] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MicrosoftPurviewInformationProtectionDataConnector(DataConnector, discriminator='MicrosoftPurviewInformationProtection'): + etag: str + id: str + kind: Literal[DataConnectorKind.MICROSOFT_PURVIEW_INFORMATION_PROTECTION] + name: str + properties: Optional[MicrosoftPurviewInformationProtectionDataConnectorProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[MicrosoftPurviewInformationProtectionDataConnectorProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.MicrosoftPurviewInformationProtectionDataConnectorProperties(DataConnectorTenantId): + data_types: MicrosoftPurviewInformationProtectionConnectorDataTypes + tenant_id: str + + @overload + def __init__( + self, + *, + data_types: MicrosoftPurviewInformationProtectionConnectorDataTypes, + tenant_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MicrosoftSecurityIncidentCreationAlertRule(AlertRule, discriminator='MicrosoftSecurityIncidentCreation'): + etag: str + id: str + kind: Literal[AlertRuleKind.MICROSOFT_SECURITY_INCIDENT_CREATION] + name: str + properties: Optional[MicrosoftSecurityIncidentCreationAlertRuleProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[MicrosoftSecurityIncidentCreationAlertRuleProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.MicrosoftSecurityIncidentCreationAlertRuleCommonProperties(_Model): + display_names_exclude_filter: Optional[list[str]] + display_names_filter: Optional[list[str]] + product_filter: Union[str, MicrosoftSecurityProductName] + severities_filter: Optional[list[Union[str, AlertSeverity]]] + + @overload + def __init__( + self, + *, + display_names_exclude_filter: Optional[list[str]] = ..., + display_names_filter: Optional[list[str]] = ..., + product_filter: Union[str, MicrosoftSecurityProductName], + severities_filter: Optional[list[Union[str, AlertSeverity]]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MicrosoftSecurityIncidentCreationAlertRuleProperties(MicrosoftSecurityIncidentCreationAlertRuleCommonProperties): + alert_rule_template_name: Optional[str] + description: Optional[str] + display_name: str + display_names_exclude_filter: list[str] + display_names_filter: list[str] + enabled: bool + last_modified_utc: Optional[datetime] + product_filter: Union[str, MicrosoftSecurityProductName] + severities_filter: Union[list[str, AlertSeverity]] + + @overload + def __init__( + self, + *, + alert_rule_template_name: Optional[str] = ..., + description: Optional[str] = ..., + display_name: str, + display_names_exclude_filter: Optional[list[str]] = ..., + display_names_filter: Optional[list[str]] = ..., + enabled: bool, + product_filter: Union[str, MicrosoftSecurityProductName], + severities_filter: Optional[list[Union[str, AlertSeverity]]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MicrosoftSecurityIncidentCreationAlertRuleTemplate(AlertRuleTemplate, discriminator='MicrosoftSecurityIncidentCreation'): + id: str + kind: Literal[AlertRuleKind.MICROSOFT_SECURITY_INCIDENT_CREATION] + name: str + properties: Optional[MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties(AlertRuleTemplatePropertiesBase): + alert_rules_created_by_template_count: int + created_date_utc: datetime + description: str + display_name: str + display_names_exclude_filter: Optional[list[str]] + display_names_filter: Optional[list[str]] + last_updated_date_utc: datetime + product_filter: Optional[Union[str, MicrosoftSecurityProductName]] + required_data_connectors: list[AlertRuleTemplateDataSource] + severities_filter: Optional[list[Union[str, AlertSeverity]]] + status: Union[str, TemplateStatus] + + @overload + def __init__( + self, + *, + alert_rules_created_by_template_count: Optional[int] = ..., + description: Optional[str] = ..., + display_name: Optional[str] = ..., + display_names_exclude_filter: Optional[list[str]] = ..., + display_names_filter: Optional[list[str]] = ..., + product_filter: Optional[Union[str, MicrosoftSecurityProductName]] = ..., + required_data_connectors: Optional[list[AlertRuleTemplateDataSource]] = ..., + severities_filter: Optional[list[Union[str, AlertSeverity]]] = ..., + status: Optional[Union[str, TemplateStatus]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MicrosoftSecurityProductName(str, Enum, metaclass=CaseInsensitiveEnumMeta): + AZURE_ACTIVE_DIRECTORY_IDENTITY_PROTECTION = "Azure Active Directory Identity Protection" + AZURE_ADVANCED_THREAT_PROTECTION = "Azure Advanced Threat Protection" + AZURE_SECURITY_CENTER = "Azure Security Center" + AZURE_SECURITY_CENTER_FOR_IO_T = "Azure Security Center for IoT" + MICROSOFT_CLOUD_APP_SECURITY = "Microsoft Cloud App Security" + MICROSOFT_DEFENDER_ADVANCED_THREAT_PROTECTION = "Microsoft Defender Advanced Threat Protection" + OFFICE365_ADVANCED_THREAT_PROTECTION = "Office 365 Advanced Threat Protection" + + + class azure.mgmt.securityinsight.models.Mode(str, Enum, metaclass=CaseInsensitiveEnumMeta): + DISABLED = "Disabled" + ENABLED = "Enabled" + + + class azure.mgmt.securityinsight.models.MtpCheckRequirements(DataConnectorsCheckRequirements, discriminator='MicrosoftThreatProtection'): + kind: Literal[DataConnectorKind.MICROSOFT_THREAT_PROTECTION] + properties: Optional[MTPCheckRequirementsProperties] + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[MTPCheckRequirementsProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.MtpFilteredProviders(_Model): + alerts: list[Union[str, MtpProvider]] + + @overload + def __init__( + self, + *, + alerts: list[Union[str, MtpProvider]] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.MtpProvider(str, Enum, metaclass=CaseInsensitiveEnumMeta): + MICROSOFT_DEFENDER_FOR_CLOUD_APPS = "microsoftDefenderForCloudApps" + MICROSOFT_DEFENDER_FOR_IDENTITY = "microsoftDefenderForIdentity" + + + class azure.mgmt.securityinsight.models.NicEntity(Entity, discriminator='Nic'): + id: str + kind: Literal[EntityKind.NIC] + name: str + properties: Optional[NicEntityProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[NicEntityProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.NicEntityProperties(EntityCommonProperties): + additional_data: dict[str, any] + friendly_name: str + ip_address_entity_id: Optional[str] + mac_address: Optional[str] + vlans: Optional[list[str]] + + + class azure.mgmt.securityinsight.models.NoneAuthModel(CcpAuthConfig, discriminator='None'): + type: Literal[CcpAuthType.NONE] + + @overload + def __init__(self) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.NrtAlertRule(AlertRule, discriminator='NRT'): + etag: str + id: str + kind: Literal[AlertRuleKind.NRT] + name: str + properties: Optional[NrtAlertRuleProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[NrtAlertRuleProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.NrtAlertRuleProperties(_Model): + alert_details_override: Optional[AlertDetailsOverride] + alert_rule_template_name: Optional[str] + custom_details: Optional[dict[str, str]] + description: Optional[str] + display_name: str + enabled: bool + entity_mappings: Optional[list[EntityMapping]] + event_grouping_settings: Optional[EventGroupingSettings] + incident_configuration: Optional[IncidentConfiguration] + last_modified_utc: Optional[datetime] + query: str + sentinel_entities_mappings: Optional[list[SentinelEntityMapping]] + severity: Union[str, AlertSeverity] + sub_techniques: Optional[list[str]] + suppression_duration: timedelta + suppression_enabled: bool + tactics: Optional[list[Union[str, AttackTactic]]] + techniques: Optional[list[str]] + template_version: Optional[str] + + @overload + def __init__( + self, + *, + alert_details_override: Optional[AlertDetailsOverride] = ..., + alert_rule_template_name: Optional[str] = ..., + custom_details: Optional[dict[str, str]] = ..., + description: Optional[str] = ..., + display_name: str, + enabled: bool, + entity_mappings: Optional[list[EntityMapping]] = ..., + event_grouping_settings: Optional[EventGroupingSettings] = ..., + incident_configuration: Optional[IncidentConfiguration] = ..., + query: str, + sentinel_entities_mappings: Optional[list[SentinelEntityMapping]] = ..., + severity: Union[str, AlertSeverity], + sub_techniques: Optional[list[str]] = ..., + suppression_duration: timedelta, + suppression_enabled: bool, + tactics: Optional[list[Union[str, AttackTactic]]] = ..., + techniques: Optional[list[str]] = ..., + template_version: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.NrtAlertRuleTemplate(AlertRuleTemplate, discriminator='NRT'): + id: str + kind: Literal[AlertRuleKind.NRT] + name: str + properties: Optional[NrtAlertRuleTemplateProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[NrtAlertRuleTemplateProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.NrtAlertRuleTemplateProperties(_Model): + alert_details_override: Optional[AlertDetailsOverride] + alert_rules_created_by_template_count: Optional[int] + created_date_utc: Optional[datetime] + custom_details: Optional[dict[str, str]] + description: Optional[str] + display_name: Optional[str] + entity_mappings: Optional[list[EntityMapping]] + event_grouping_settings: Optional[EventGroupingSettings] + last_updated_date_utc: Optional[datetime] + query: Optional[str] + required_data_connectors: Optional[list[AlertRuleTemplateDataSource]] + sentinel_entities_mappings: Optional[list[SentinelEntityMapping]] + severity: Optional[Union[str, AlertSeverity]] + status: Optional[Union[str, TemplateStatus]] + tactics: Optional[list[Union[str, AttackTactic]]] + techniques: Optional[list[str]] + version: Optional[str] + + @overload + def __init__( + self, + *, + alert_details_override: Optional[AlertDetailsOverride] = ..., + alert_rules_created_by_template_count: Optional[int] = ..., + custom_details: Optional[dict[str, str]] = ..., + description: Optional[str] = ..., + display_name: Optional[str] = ..., + entity_mappings: Optional[list[EntityMapping]] = ..., + event_grouping_settings: Optional[EventGroupingSettings] = ..., + query: Optional[str] = ..., + required_data_connectors: Optional[list[AlertRuleTemplateDataSource]] = ..., + sentinel_entities_mappings: Optional[list[SentinelEntityMapping]] = ..., + severity: Optional[Union[str, AlertSeverity]] = ..., + status: Optional[Union[str, TemplateStatus]] = ..., + tactics: Optional[list[Union[str, AttackTactic]]] = ..., + techniques: Optional[list[str]] = ..., + version: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.OAuthModel(CcpAuthConfig, discriminator='OAuth2'): + access_token_prepend: Optional[str] + authorization_code: Optional[str] + authorization_endpoint: Optional[str] + authorization_endpoint_headers: Optional[dict[str, str]] + authorization_endpoint_query_parameters: Optional[dict[str, str]] + client_id: str + client_secret: str + grant_type: str + is_credentials_in_headers: Optional[bool] + is_jwt_bearer_flow: Optional[bool] + redirect_uri: Optional[str] + scope: Optional[str] + token_endpoint: str + token_endpoint_headers: Optional[dict[str, str]] + token_endpoint_query_parameters: Optional[dict[str, str]] + type: Literal[CcpAuthType.O_AUTH2] + + @overload + def __init__( + self, + *, + access_token_prepend: Optional[str] = ..., + authorization_code: Optional[str] = ..., + authorization_endpoint: Optional[str] = ..., + authorization_endpoint_headers: Optional[dict[str, str]] = ..., + authorization_endpoint_query_parameters: Optional[dict[str, str]] = ..., + client_id: str, + client_secret: str, + grant_type: str, + is_credentials_in_headers: Optional[bool] = ..., + is_jwt_bearer_flow: Optional[bool] = ..., + redirect_uri: Optional[str] = ..., + scope: Optional[str] = ..., + token_endpoint: str, + token_endpoint_headers: Optional[dict[str, str]] = ..., + token_endpoint_query_parameters: Optional[dict[str, str]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.OSFamily(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ANDROID = "Android" + IOS = "IOS" + LINUX = "Linux" + UNKNOWN = "Unknown" + WINDOWS = "Windows" + + + class azure.mgmt.securityinsight.models.Office365ProjectCheckRequirements(DataConnectorsCheckRequirements, discriminator='Office365Project'): + kind: Literal[DataConnectorKind.OFFICE365_PROJECT] + properties: Optional[Office365ProjectCheckRequirementsProperties] + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[Office365ProjectCheckRequirementsProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.Office365ProjectCheckRequirementsProperties(DataConnectorTenantId): + tenant_id: str + + @overload + def __init__( + self, + *, + tenant_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.Office365ProjectConnectorDataTypes(_Model): + logs: Office365ProjectConnectorDataTypesLogs + + @overload + def __init__( + self, + *, + logs: Office365ProjectConnectorDataTypesLogs + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.Office365ProjectConnectorDataTypesLogs(DataConnectorDataTypeCommon): + state: Union[str, DataTypeState] + + @overload + def __init__( + self, + *, + state: Union[str, DataTypeState] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.Office365ProjectDataConnector(DataConnector, discriminator='Office365Project'): + etag: str + id: str + kind: Literal[DataConnectorKind.OFFICE365_PROJECT] + name: str + properties: Optional[Office365ProjectDataConnectorProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[Office365ProjectDataConnectorProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.Office365ProjectDataConnectorProperties(DataConnectorTenantId): + data_types: Office365ProjectConnectorDataTypes + tenant_id: str + + @overload + def __init__( + self, + *, + data_types: Office365ProjectConnectorDataTypes, + tenant_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.OfficeATPCheckRequirements(DataConnectorsCheckRequirements, discriminator='OfficeATP'): + kind: Literal[DataConnectorKind.OFFICE_ATP] + properties: Optional[OfficeATPCheckRequirementsProperties] + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[OfficeATPCheckRequirementsProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.OfficeATPCheckRequirementsProperties(DataConnectorTenantId): + tenant_id: str + + @overload + def __init__( + self, + *, + tenant_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.OfficeATPDataConnector(DataConnector, discriminator='OfficeATP'): + etag: str + id: str + kind: Literal[DataConnectorKind.OFFICE_ATP] + name: str + properties: Optional[OfficeATPDataConnectorProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[OfficeATPDataConnectorProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.OfficeATPDataConnectorProperties(_Model): + data_types: Optional[AlertsDataTypeOfDataConnector] + tenant_id: str + + @overload + def __init__( + self, + *, + data_types: Optional[AlertsDataTypeOfDataConnector] = ..., + tenant_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.OfficeConsent(ProxyResource): + id: str + name: str + properties: Optional[OfficeConsentProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[OfficeConsentProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.OfficeConsentProperties(_Model): + consent_id: Optional[str] + tenant_id: Optional[str] + + @overload + def __init__( + self, + *, + consent_id: Optional[str] = ..., + tenant_id: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.OfficeDataConnector(DataConnector, discriminator='Office365'): + etag: str + id: str + kind: Literal[DataConnectorKind.OFFICE365] + name: str + properties: Optional[OfficeDataConnectorProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[OfficeDataConnectorProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.OfficeDataConnectorDataTypes(_Model): + exchange: OfficeDataConnectorDataTypesExchange + share_point: OfficeDataConnectorDataTypesSharePoint + teams: OfficeDataConnectorDataTypesTeams + + @overload + def __init__( + self, + *, + exchange: OfficeDataConnectorDataTypesExchange, + share_point: OfficeDataConnectorDataTypesSharePoint, + teams: OfficeDataConnectorDataTypesTeams + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.OfficeDataConnectorDataTypesExchange(DataConnectorDataTypeCommon): + state: Union[str, DataTypeState] + + @overload + def __init__( + self, + *, + state: Union[str, DataTypeState] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.OfficeDataConnectorDataTypesSharePoint(DataConnectorDataTypeCommon): + state: Union[str, DataTypeState] + + @overload + def __init__( + self, + *, + state: Union[str, DataTypeState] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.OfficeDataConnectorDataTypesTeams(DataConnectorDataTypeCommon): + state: Union[str, DataTypeState] + + @overload + def __init__( + self, + *, + state: Union[str, DataTypeState] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.OfficeDataConnectorProperties(DataConnectorTenantId): + data_types: OfficeDataConnectorDataTypes + tenant_id: str + + @overload + def __init__( + self, + *, + data_types: OfficeDataConnectorDataTypes, + tenant_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.OfficeIRMCheckRequirements(DataConnectorsCheckRequirements, discriminator='OfficeIRM'): + kind: Literal[DataConnectorKind.OFFICE_IRM] + properties: Optional[OfficeIRMCheckRequirementsProperties] + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[OfficeIRMCheckRequirementsProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.OfficeIRMCheckRequirementsProperties(DataConnectorTenantId): + tenant_id: str + + @overload + def __init__( + self, + *, + tenant_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.OfficeIRMDataConnector(DataConnector, discriminator='OfficeIRM'): + etag: str + id: str + kind: Literal[DataConnectorKind.OFFICE_IRM] + name: str + properties: Optional[OfficeIRMDataConnectorProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[OfficeIRMDataConnectorProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.OfficeIRMDataConnectorProperties(_Model): + data_types: Optional[AlertsDataTypeOfDataConnector] + tenant_id: str + + @overload + def __init__( + self, + *, + data_types: Optional[AlertsDataTypeOfDataConnector] = ..., + tenant_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.OfficePowerBICheckRequirements(DataConnectorsCheckRequirements, discriminator='OfficePowerBI'): + kind: Literal[DataConnectorKind.OFFICE_POWER_BI] + properties: Optional[OfficePowerBICheckRequirementsProperties] + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[OfficePowerBICheckRequirementsProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.OfficePowerBICheckRequirementsProperties(DataConnectorTenantId): + tenant_id: str + + @overload + def __init__( + self, + *, + tenant_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.OfficePowerBIConnectorDataTypes(_Model): + logs: OfficePowerBIConnectorDataTypesLogs + + @overload + def __init__( + self, + *, + logs: OfficePowerBIConnectorDataTypesLogs + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.OfficePowerBIConnectorDataTypesLogs(DataConnectorDataTypeCommon): + state: Union[str, DataTypeState] + + @overload + def __init__( + self, + *, + state: Union[str, DataTypeState] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.OfficePowerBIDataConnector(DataConnector, discriminator='OfficePowerBI'): + etag: str + id: str + kind: Literal[DataConnectorKind.OFFICE_POWER_BI] + name: str + properties: Optional[OfficePowerBIDataConnectorProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[OfficePowerBIDataConnectorProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.OfficePowerBIDataConnectorProperties(DataConnectorTenantId): + data_types: OfficePowerBIConnectorDataTypes + tenant_id: str + + @overload + def __init__( + self, + *, + data_types: OfficePowerBIConnectorDataTypes, + tenant_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.Operation(_Model): + display: Optional[OperationDisplay] + is_data_action: Optional[bool] + name: Optional[str] + origin: Optional[str] + + @overload + def __init__( + self, + *, + display: Optional[OperationDisplay] = ..., + is_data_action: Optional[bool] = ..., + name: Optional[str] = ..., + origin: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.OperationDisplay(_Model): + description: Optional[str] + operation: Optional[str] + provider: Optional[str] + resource: Optional[str] + + @overload + def __init__( + self, + *, + description: Optional[str] = ..., + operation: Optional[str] = ..., + provider: Optional[str] = ..., + resource: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.Operator(str, Enum, metaclass=CaseInsensitiveEnumMeta): + AFTER_ABSOLUTE = "AfterAbsolute" + AFTER_RELATIVE = "AfterRelative" + ARRAY_CONTAINS = "ArrayContains" + ARRAY_NOT_CONTAINS = "ArrayNotContains" + BEFORE_ABSOLUTE = "BeforeAbsolute" + BEFORE_RELATIVE = "BeforeRelative" + EQUALS = "Equals" + GREATER_THAN = "GreaterThan" + GREATER_THAN_EQUAL = "GreaterThanEqual" + IS_FALSE = "IsFalse" + IS_NULL = "IsNull" + IS_TRUE = "IsTrue" + LESS_THAN = "LessThan" + LESS_THAN_EQUAL = "LessThanEqual" + NOT_EQUALS = "NotEquals" + ON_OR_AFTER_ABSOLUTE = "OnOrAfterAbsolute" + ON_OR_AFTER_RELATIVE = "OnOrAfterRelative" + ON_OR_BEFORE_ABSOLUTE = "OnOrBeforeAbsolute" + ON_OR_BEFORE_RELATIVE = "OnOrBeforeRelative" + STRING_CONTAINS = "StringContains" + STRING_ENDS_WITH = "StringEndsWith" + STRING_IS_EMPTY = "StringIsEmpty" + STRING_NOT_CONTAINS = "StringNotContains" + STRING_NOT_ENDS_WITH = "StringNotEndsWith" + STRING_NOT_STARTS_WITH = "StringNotStartsWith" + STRING_STARTS_WITH = "StringStartsWith" + + + class azure.mgmt.securityinsight.models.OracleAuthModel(CcpAuthConfig, discriminator='Oracle'): + pem_file: str + public_fingerprint: str + tenant_id: str + type: Literal[CcpAuthType.ORACLE] + user_id: str + + @overload + def __init__( + self, + *, + pem_file: str, + public_fingerprint: str, + tenant_id: str, + user_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.OutputType(str, Enum, metaclass=CaseInsensitiveEnumMeta): + DATE = "Date" + ENTITY = "Entity" + NUMBER = "Number" + STRING = "String" + + + class azure.mgmt.securityinsight.models.OwnerType(str, Enum, metaclass=CaseInsensitiveEnumMeta): + GROUP = "Group" + UNKNOWN = "Unknown" + USER = "User" + + + class azure.mgmt.securityinsight.models.PackageBaseProperties(_Model): + author: Optional[MetadataAuthor] + categories: Optional[MetadataCategories] + content_id: Optional[str] + content_kind: Optional[Union[str, PackageKind]] + content_product_id: Optional[str] + content_schema_version: Optional[str] + dependencies: Optional[MetadataDependencies] + description: Optional[str] + display_name: Optional[str] + first_publish_date: Optional[date] + icon: Optional[str] + is_deprecated: Optional[Union[str, Flag]] + is_featured: Optional[Union[str, Flag]] + is_new: Optional[Union[str, Flag]] + is_preview: Optional[Union[str, Flag]] + last_publish_date: Optional[date] + providers: Optional[list[str]] + publisher_display_name: Optional[str] + source: Optional[MetadataSource] + support: Optional[MetadataSupport] + threat_analysis_tactics: Optional[list[str]] + threat_analysis_techniques: Optional[list[str]] + version: Optional[str] + + @overload + def __init__( + self, + *, + author: Optional[MetadataAuthor] = ..., + categories: Optional[MetadataCategories] = ..., + content_id: Optional[str] = ..., + content_kind: Optional[Union[str, PackageKind]] = ..., + content_product_id: Optional[str] = ..., + content_schema_version: Optional[str] = ..., + dependencies: Optional[MetadataDependencies] = ..., + description: Optional[str] = ..., + display_name: Optional[str] = ..., + first_publish_date: Optional[date] = ..., + icon: Optional[str] = ..., + is_deprecated: Optional[Union[str, Flag]] = ..., + is_featured: Optional[Union[str, Flag]] = ..., + is_new: Optional[Union[str, Flag]] = ..., + is_preview: Optional[Union[str, Flag]] = ..., + last_publish_date: Optional[date] = ..., + providers: Optional[list[str]] = ..., + publisher_display_name: Optional[str] = ..., + source: Optional[MetadataSource] = ..., + support: Optional[MetadataSupport] = ..., + threat_analysis_tactics: Optional[list[str]] = ..., + threat_analysis_techniques: Optional[list[str]] = ..., + version: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.PackageKind(str, Enum, metaclass=CaseInsensitiveEnumMeta): + SOLUTION = "Solution" + STANDALONE = "Standalone" + + + class azure.mgmt.securityinsight.models.PackageModel(ProxyResource): + etag: Optional[str] + id: str + name: str + properties: Optional[PackageProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[PackageProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.PackageProperties(PackageBaseProperties): + author: MetadataAuthor + categories: MetadataCategories + content_id: str + content_kind: Union[str, PackageKind] + content_product_id: str + content_schema_version: str + dependencies: MetadataDependencies + description: str + display_name: str + first_publish_date: date + icon: str + is_deprecated: Union[str, Flag] + is_featured: Union[str, Flag] + is_new: Union[str, Flag] + is_preview: Union[str, Flag] + last_publish_date: date + providers: list[str] + publisher_display_name: str + source: MetadataSource + support: MetadataSupport + threat_analysis_tactics: list[str] + threat_analysis_techniques: list[str] + version: str + + @overload + def __init__( + self, + *, + author: Optional[MetadataAuthor] = ..., + categories: Optional[MetadataCategories] = ..., + content_id: Optional[str] = ..., + content_kind: Optional[Union[str, PackageKind]] = ..., + content_product_id: Optional[str] = ..., + content_schema_version: Optional[str] = ..., + dependencies: Optional[MetadataDependencies] = ..., + description: Optional[str] = ..., + display_name: Optional[str] = ..., + first_publish_date: Optional[date] = ..., + icon: Optional[str] = ..., + is_deprecated: Optional[Union[str, Flag]] = ..., + is_featured: Optional[Union[str, Flag]] = ..., + is_new: Optional[Union[str, Flag]] = ..., + is_preview: Optional[Union[str, Flag]] = ..., + last_publish_date: Optional[date] = ..., + providers: Optional[list[str]] = ..., + publisher_display_name: Optional[str] = ..., + source: Optional[MetadataSource] = ..., + support: Optional[MetadataSupport] = ..., + threat_analysis_tactics: Optional[list[str]] = ..., + threat_analysis_techniques: Optional[list[str]] = ..., + version: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.PermissionProviderScope(str, Enum, metaclass=CaseInsensitiveEnumMeta): + RESOURCE_GROUP = "ResourceGroup" + SUBSCRIPTION = "Subscription" + WORKSPACE = "Workspace" + + + class azure.mgmt.securityinsight.models.Permissions(_Model): + customs: Optional[list[PermissionsCustomsItem]] + resource_provider: Optional[list[PermissionsResourceProviderItem]] + + @overload + def __init__( + self, + *, + customs: Optional[list[PermissionsCustomsItem]] = ..., + resource_provider: Optional[list[PermissionsResourceProviderItem]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.PermissionsCustomsItem(Customs): + description: str + name: str + + @overload + def __init__( + self, + *, + description: Optional[str] = ..., + name: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.PermissionsResourceProviderItem(ResourceProvider): + permissions_display_text: str + provider: Union[str, ProviderName] + provider_display_name: str + required_permissions: RequiredPermissions + scope: Union[str, PermissionProviderScope] + + @overload + def __init__( + self, + *, + permissions_display_text: Optional[str] = ..., + provider: Optional[Union[str, ProviderName]] = ..., + provider_display_name: Optional[str] = ..., + required_permissions: Optional[RequiredPermissions] = ..., + scope: Optional[Union[str, PermissionProviderScope]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.PlaybookActionProperties(_Model): + logic_app_resource_id: str + tenant_id: Optional[str] + + @overload + def __init__( + self, + *, + logic_app_resource_id: str, + tenant_id: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.PollingFrequency(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ONCE_AN_HOUR = "OnceAnHour" + ONCE_A_DAY = "OnceADay" + ONCE_A_MINUTE = "OnceAMinute" + + + class azure.mgmt.securityinsight.models.PremiumMdtiDataConnectorDataTypes(_Model): + connector: PremiumMdtiDataConnectorDataTypesConnector + + @overload + def __init__( + self, + *, + connector: PremiumMdtiDataConnectorDataTypesConnector + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.PremiumMdtiDataConnectorDataTypesConnector(DataConnectorDataTypeCommon): + state: Union[str, DataTypeState] + + @overload + def __init__( + self, + *, + state: Union[str, DataTypeState] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.PremiumMdtiDataConnectorProperties(DataConnectorTenantId): + data_types: PremiumMdtiDataConnectorDataTypes + lookback_period: datetime + required_skus_present: Optional[bool] + tenant_id: str + + @overload + def __init__( + self, + *, + data_types: PremiumMdtiDataConnectorDataTypes, + lookback_period: datetime, + required_skus_present: Optional[bool] = ..., + tenant_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.PremiumMicrosoftDefenderForThreatIntelligence(DataConnector, discriminator='PremiumMicrosoftDefenderForThreatIntelligence'): + etag: str + id: str + kind: Literal[DataConnectorKind.PREMIUM_MICROSOFT_DEFENDER_FOR_THREAT_INTELLIGENCE] + name: str + properties: Optional[PremiumMdtiDataConnectorProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[PremiumMdtiDataConnectorProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.ProcessEntity(Entity, discriminator='Process'): + id: str + kind: Literal[EntityKind.PROCESS] + name: str + properties: Optional[ProcessEntityProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[ProcessEntityProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.ProcessEntityProperties(EntityCommonProperties): + account_entity_id: Optional[str] + additional_data: dict[str, any] + command_line: Optional[str] + creation_time_utc: Optional[datetime] + elevation_token: Optional[Union[str, ElevationToken]] + friendly_name: str + host_entity_id: Optional[str] + host_logon_session_entity_id: Optional[str] + image_file_entity_id: Optional[str] + parent_process_entity_id: Optional[str] + process_id: Optional[str] + + @overload + def __init__( + self, + *, + elevation_token: Optional[Union[str, ElevationToken]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ProductPackageModel(ProxyResource): + etag: Optional[str] + id: str + name: str + properties: Optional[ProductPackageProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[ProductPackageProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.ProductPackageProperties(_Model): + author: Optional[MetadataAuthor] + categories: Optional[MetadataCategories] + content_id: Optional[str] + content_kind: Optional[Union[str, PackageKind]] + content_product_id: Optional[str] + content_schema_version: Optional[str] + dependencies: Optional[MetadataDependencies] + description: Optional[str] + display_name: Optional[str] + first_publish_date: Optional[date] + icon: Optional[str] + installed_version: Optional[str] + is_deprecated: Optional[Union[str, Flag]] + is_featured: Optional[Union[str, Flag]] + is_new: Optional[Union[str, Flag]] + is_preview: Optional[Union[str, Flag]] + last_publish_date: Optional[date] + metadata_resource_id: Optional[str] + packaged_content: Optional[Any] + providers: Optional[list[str]] + publisher_display_name: Optional[str] + source: Optional[MetadataSource] + support: Optional[MetadataSupport] + threat_analysis_tactics: Optional[list[str]] + threat_analysis_techniques: Optional[list[str]] + version: Optional[str] + + @overload + def __init__( + self, + *, + author: Optional[MetadataAuthor] = ..., + categories: Optional[MetadataCategories] = ..., + content_id: Optional[str] = ..., + content_kind: Optional[Union[str, PackageKind]] = ..., + content_product_id: Optional[str] = ..., + content_schema_version: Optional[str] = ..., + dependencies: Optional[MetadataDependencies] = ..., + description: Optional[str] = ..., + display_name: Optional[str] = ..., + first_publish_date: Optional[date] = ..., + icon: Optional[str] = ..., + installed_version: Optional[str] = ..., + is_deprecated: Optional[Union[str, Flag]] = ..., + is_featured: Optional[Union[str, Flag]] = ..., + is_new: Optional[Union[str, Flag]] = ..., + is_preview: Optional[Union[str, Flag]] = ..., + last_publish_date: Optional[date] = ..., + metadata_resource_id: Optional[str] = ..., + packaged_content: Optional[Any] = ..., + providers: Optional[list[str]] = ..., + publisher_display_name: Optional[str] = ..., + source: Optional[MetadataSource] = ..., + support: Optional[MetadataSupport] = ..., + threat_analysis_tactics: Optional[list[str]] = ..., + threat_analysis_techniques: Optional[list[str]] = ..., + version: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ProductTemplateModel(ProxyResource): + etag: Optional[str] + id: str + name: str + properties: Optional[ProductTemplateProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[ProductTemplateProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.ProductTemplateProperties(_Model): + author: Optional[MetadataAuthor] + categories: Optional[MetadataCategories] + content_id: Optional[str] + content_kind: Optional[Union[str, Kind]] + content_product_id: Optional[str] + content_schema_version: Optional[str] + custom_version: Optional[str] + dependencies: Optional[MetadataDependencies] + display_name: Optional[str] + first_publish_date: Optional[date] + icon: Optional[str] + is_deprecated: Optional[Union[str, Flag]] + last_publish_date: Optional[date] + package_id: Optional[str] + package_kind: Optional[Union[str, PackageKind]] + package_name: Optional[str] + package_version: Optional[str] + packaged_content: Optional[Any] + preview_images: Optional[list[str]] + preview_images_dark: Optional[list[str]] + providers: Optional[list[str]] + source: Optional[MetadataSource] + support: Optional[MetadataSupport] + threat_analysis_tactics: Optional[list[str]] + threat_analysis_techniques: Optional[list[str]] + version: Optional[str] + + @overload + def __init__( + self, + *, + author: Optional[MetadataAuthor] = ..., + categories: Optional[MetadataCategories] = ..., + content_id: Optional[str] = ..., + content_kind: Optional[Union[str, Kind]] = ..., + content_product_id: Optional[str] = ..., + content_schema_version: Optional[str] = ..., + custom_version: Optional[str] = ..., + dependencies: Optional[MetadataDependencies] = ..., + display_name: Optional[str] = ..., + first_publish_date: Optional[date] = ..., + icon: Optional[str] = ..., + last_publish_date: Optional[date] = ..., + package_id: Optional[str] = ..., + package_kind: Optional[Union[str, PackageKind]] = ..., + package_name: Optional[str] = ..., + package_version: Optional[str] = ..., + packaged_content: Optional[Any] = ..., + preview_images: Optional[list[str]] = ..., + preview_images_dark: Optional[list[str]] = ..., + providers: Optional[list[str]] = ..., + source: Optional[MetadataSource] = ..., + support: Optional[MetadataSupport] = ..., + threat_analysis_tactics: Optional[list[str]] = ..., + threat_analysis_techniques: Optional[list[str]] = ..., + version: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.PropertyArrayChangedConditionProperties(AutomationRuleCondition, discriminator='PropertyArrayChanged'): + condition_properties: Optional[AutomationRulePropertyArrayChangedValuesCondition] + condition_type: Literal[ConditionType.PROPERTY_ARRAY_CHANGED] + + @overload + def __init__( + self, + *, + condition_properties: Optional[AutomationRulePropertyArrayChangedValuesCondition] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.PropertyArrayConditionProperties(AutomationRuleCondition, discriminator='PropertyArray'): + condition_properties: Optional[AutomationRulePropertyArrayValuesCondition] + condition_type: Literal[ConditionType.PROPERTY_ARRAY] + + @overload + def __init__( + self, + *, + condition_properties: Optional[AutomationRulePropertyArrayValuesCondition] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.PropertyChangedConditionProperties(AutomationRuleCondition, discriminator='PropertyChanged'): + condition_properties: Optional[AutomationRulePropertyValuesChangedCondition] + condition_type: Literal[ConditionType.PROPERTY_CHANGED] + + @overload + def __init__( + self, + *, + condition_properties: Optional[AutomationRulePropertyValuesChangedCondition] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.PropertyConditionProperties(AutomationRuleCondition, discriminator='Property'): + condition_properties: Optional[AutomationRulePropertyValuesCondition] + condition_type: Literal[ConditionType.PROPERTY] + + @overload + def __init__( + self, + *, + condition_properties: Optional[AutomationRulePropertyValuesCondition] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ProviderName(str, Enum, metaclass=CaseInsensitiveEnumMeta): + MICROSOFT_AADIAM_DIAGNOSTIC_SETTINGS = "microsoft.aadiam/diagnosticSettings" + MICROSOFT_AUTHORIZATION_POLICY_ASSIGNMENTS = "Microsoft.Authorization/policyAssignments" + MICROSOFT_OPERATIONAL_INSIGHTS_SOLUTIONS = "Microsoft.OperationalInsights/solutions" + MICROSOFT_OPERATIONAL_INSIGHTS_WORKSPACES = "Microsoft.OperationalInsights/workspaces" + MICROSOFT_OPERATIONAL_INSIGHTS_WORKSPACES_DATASOURCES = "Microsoft.OperationalInsights/workspaces/datasources" + MICROSOFT_OPERATIONAL_INSIGHTS_WORKSPACES_SHARED_KEYS = "Microsoft.OperationalInsights/workspaces/sharedKeys" + + + class azure.mgmt.securityinsight.models.ProviderPermissionsScope(str, Enum, metaclass=CaseInsensitiveEnumMeta): + RESOURCE_GROUP = "ResourceGroup" + SUBSCRIPTION = "Subscription" + WORKSPACE = "Workspace" + + + class azure.mgmt.securityinsight.models.ProvisioningState(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ACCEPTED = "Accepted" + CANCELED = "Canceled" + FAILED = "Failed" + IN_PROGRESS = "InProgress" + SUCCEEDED = "Succeeded" + + + class azure.mgmt.securityinsight.models.ProxyResource(Resource): + id: str + name: str + system_data: SystemData + type: str + + + class azure.mgmt.securityinsight.models.PullRequest(_Model): + state: Optional[Union[str, PullRequestState]] + url: Optional[str] + + + class azure.mgmt.securityinsight.models.PullRequestState(str, Enum, metaclass=CaseInsensitiveEnumMeta): + CLOSED = "Closed" + OPEN = "Open" + + + class azure.mgmt.securityinsight.models.PurviewAuditCheckRequirements(DataConnectorsCheckRequirements, discriminator='PurviewAudit'): + kind: Literal[DataConnectorKind.PURVIEW_AUDIT] + properties: Optional[PurviewAuditCheckRequirementsProperties] + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[PurviewAuditCheckRequirementsProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.PurviewAuditCheckRequirementsProperties(DataConnectorTenantId): + tenant_id: str + + @overload + def __init__( + self, + *, + tenant_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.PurviewAuditConnectorDataTypes(_Model): + logs: PurviewAuditConnectorDataTypesLogs + + @overload + def __init__( + self, + *, + logs: PurviewAuditConnectorDataTypesLogs + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.PurviewAuditConnectorDataTypesLogs(DataConnectorDataTypeCommon): + state: Union[str, DataTypeState] + + @overload + def __init__( + self, + *, + state: Union[str, DataTypeState] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.PurviewAuditDataConnector(DataConnector, discriminator='PurviewAudit'): + etag: str + id: str + kind: Literal[DataConnectorKind.PURVIEW_AUDIT] + name: str + properties: Optional[PurviewAuditDataConnectorProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[PurviewAuditDataConnectorProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.PurviewAuditDataConnectorProperties(DataConnectorTenantId): + connector_definition_name: Optional[str] + data_types: PurviewAuditConnectorDataTypes + dcr_config: Optional[DCRConfiguration] + source_type: Optional[str] + tenant_id: str + + @overload + def __init__( + self, + *, + connector_definition_name: Optional[str] = ..., + data_types: PurviewAuditConnectorDataTypes, + dcr_config: Optional[DCRConfiguration] = ..., + source_type: Optional[str] = ..., + tenant_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.Query(_Model): + condition: Optional[QueryCondition] + max_page_size: Optional[int] + min_page_size: Optional[int] + sort_by: Optional[QuerySortBy] + + @overload + def __init__( + self, + *, + condition: Optional[QueryCondition] = ..., + max_page_size: Optional[int] = ..., + min_page_size: Optional[int] = ..., + sort_by: Optional[QuerySortBy] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.QueryCondition(_Model): + clauses: list[ConditionClause] + condition_connective: Optional[Union[str, Connective]] + stix_object_type: Optional[str] + + @overload + def __init__( + self, + *, + clauses: list[ConditionClause], + condition_connective: Optional[Union[str, Connective]] = ..., + stix_object_type: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.QueryProperties(_Model): + condition: Optional[ConditionProperties] + + @overload + def __init__( + self, + *, + condition: Optional[ConditionProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.QuerySortBy(_Model): + direction: Optional[Union[str, SortingDirection]] + field: Optional[str] + + @overload + def __init__( + self, + *, + direction: Optional[Union[str, SortingDirection]] = ..., + field: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.Recommendation(ProxyResource): + etag: Optional[str] + id: str + name: str + properties: Optional[RecommendationProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[RecommendationProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.RecommendationPatch(_Model): + properties: Optional[RecommendationPatchProperties] + + @overload + def __init__( + self, + *, + properties: Optional[RecommendationPatchProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.RecommendationPatchProperties(_Model): + state: Optional[Union[str, State]] + + @overload + def __init__( + self, + *, + state: Optional[Union[str, State]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.RecommendationProperties(_Model): + additional_properties: Optional[dict[str, str]] + creation_time_utc: datetime + description: str + last_evaluated_time_utc: datetime + last_modified_time_utc: datetime + recommendation_type_id: str + resource_id: Optional[str] + state: Union[str, State] + suggestions: list[RecommendedSuggestion] + title: str + + @overload + def __init__( + self, + *, + additional_properties: Optional[dict[str, str]] = ..., + creation_time_utc: datetime, + description: str, + last_evaluated_time_utc: datetime, + last_modified_time_utc: datetime, + recommendation_type_id: str, + resource_id: Optional[str] = ..., + state: Union[str, State], + suggestions: list[RecommendedSuggestion], + title: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.RecommendedSuggestion(_Model): + action: str + additional_properties: Optional[dict[str, str]] + description: str + suggestion_type_id: str + title: str + + @overload + def __init__( + self, + *, + action: str, + additional_properties: Optional[dict[str, str]] = ..., + description: str, + suggestion_type_id: str, + title: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ReevaluateResponse(_Model): + last_evaluated_time_utc: Optional[datetime] + + @overload + def __init__( + self, + *, + last_evaluated_time_utc: Optional[datetime] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.RegistryHive(str, Enum, metaclass=CaseInsensitiveEnumMeta): + HKEY_A = "HKEY_A" + HKEY_CLASSES_ROOT = "HKEY_CLASSES_ROOT" + HKEY_CURRENT_CONFIG = "HKEY_CURRENT_CONFIG" + HKEY_CURRENT_USER = "HKEY_CURRENT_USER" + HKEY_CURRENT_USER_LOCAL_SETTINGS = "HKEY_CURRENT_USER_LOCAL_SETTINGS" + HKEY_LOCAL_MACHINE = "HKEY_LOCAL_MACHINE" + HKEY_PERFORMANCE_DATA = "HKEY_PERFORMANCE_DATA" + HKEY_PERFORMANCE_NLSTEXT = "HKEY_PERFORMANCE_NLSTEXT" + HKEY_PERFORMANCE_TEXT = "HKEY_PERFORMANCE_TEXT" + HKEY_USERS = "HKEY_USERS" + + + class azure.mgmt.securityinsight.models.RegistryKeyEntity(Entity, discriminator='RegistryKey'): + id: str + kind: Literal[EntityKind.REGISTRY_KEY] + name: str + properties: Optional[RegistryKeyEntityProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[RegistryKeyEntityProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.RegistryKeyEntityProperties(EntityCommonProperties): + additional_data: dict[str, any] + friendly_name: str + hive: Optional[Union[str, RegistryHive]] + key: Optional[str] + + + class azure.mgmt.securityinsight.models.RegistryValueEntity(Entity, discriminator='RegistryValue'): + id: str + kind: Literal[EntityKind.REGISTRY_VALUE] + name: str + properties: Optional[RegistryValueEntityProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[RegistryValueEntityProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.RegistryValueEntityProperties(EntityCommonProperties): + additional_data: dict[str, any] + friendly_name: str + key_entity_id: Optional[str] + value_data: Optional[str] + value_name: Optional[str] + value_type: Optional[Union[str, RegistryValueKind]] + + + class azure.mgmt.securityinsight.models.RegistryValueKind(str, Enum, metaclass=CaseInsensitiveEnumMeta): + BINARY = "Binary" + D_WORD = "DWord" + EXPAND_STRING = "ExpandString" + MULTI_STRING = "MultiString" + NONE = "None" + Q_WORD = "QWord" + STRING = "String" + UNKNOWN = "Unknown" + + + class azure.mgmt.securityinsight.models.Relation(ProxyResource): + etag: Optional[str] + id: str + name: str + properties: Optional[RelationProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[RelationProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.RelationProperties(_Model): + related_resource_id: str + related_resource_kind: Optional[str] + related_resource_name: Optional[str] + related_resource_type: Optional[str] + + @overload + def __init__( + self, + *, + related_resource_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.Relationship(TIObject, discriminator='Relationship'): + id: str + kind: Literal[TIObjectKind.RELATIONSHIP] + name: str + properties: TIObjectCommonProperties + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[TIObjectCommonProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.RelationshipHint(_Model): + field_name: Optional[str] + source: Optional[str] + + @overload + def __init__( + self, + *, + field_name: Optional[str] = ..., + source: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.Repo(_Model): + branches: Optional[list[str]] + full_name: Optional[str] + installation_id: Optional[int] + url: Optional[str] + + @overload + def __init__( + self, + *, + branches: Optional[list[str]] = ..., + full_name: Optional[str] = ..., + installation_id: Optional[int] = ..., + url: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.RepoType(str, Enum, metaclass=CaseInsensitiveEnumMeta): + AZURE_DEV_OPS = "AzureDevOps" + GITHUB = "Github" + + + class azure.mgmt.securityinsight.models.Repository(_Model): + branch: str + deployment_logs_url: Optional[str] + display_url: Optional[str] + url: str + + @overload + def __init__( + self, + *, + branch: str, + display_url: Optional[str] = ..., + url: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.RepositoryAccess(_Model): + client_id: Optional[str] + code: Optional[str] + installation_id: Optional[str] + kind: Union[str, RepositoryAccessKind] + state: Optional[str] + token: Optional[str] + + @overload + def __init__( + self, + *, + client_id: Optional[str] = ..., + code: Optional[str] = ..., + installation_id: Optional[str] = ..., + kind: Union[str, RepositoryAccessKind], + state: Optional[str] = ..., + token: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.RepositoryAccessKind(str, Enum, metaclass=CaseInsensitiveEnumMeta): + APP = "App" + O_AUTH = "OAuth" + PAT = "PAT" + + + class azure.mgmt.securityinsight.models.RepositoryAccessObject(_Model): + repository_access: RepositoryAccess + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + repository_access: RepositoryAccess + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.RepositoryAccessProperties(_Model): + properties: RepositoryAccessObject + + @overload + def __init__( + self, + *, + properties: RepositoryAccessObject + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.RepositoryResourceInfo(_Model): + azure_dev_ops_resource_info: Optional[AzureDevOpsResourceInfo] + git_hub_resource_info: Optional[GitHubResourceInfo] + webhook: Optional[Webhook] + + @overload + def __init__( + self, + *, + webhook: Optional[Webhook] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.RequiredPermissions(_Model): + action: Optional[bool] + delete: Optional[bool] + read: Optional[bool] + write: Optional[bool] + + @overload + def __init__( + self, + *, + action: Optional[bool] = ..., + delete: Optional[bool] = ..., + read: Optional[bool] = ..., + write: Optional[bool] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.Resource(_Model): + id: Optional[str] + name: Optional[str] + system_data: Optional[SystemData] + type: Optional[str] + + + class azure.mgmt.securityinsight.models.ResourceProvider(_Model): + permissions_display_text: Optional[str] + provider: Optional[Union[str, ProviderName]] + provider_display_name: Optional[str] + required_permissions: Optional[RequiredPermissions] + scope: Optional[Union[str, PermissionProviderScope]] + + @overload + def __init__( + self, + *, + permissions_display_text: Optional[str] = ..., + provider: Optional[Union[str, ProviderName]] = ..., + provider_display_name: Optional[str] = ..., + required_permissions: Optional[RequiredPermissions] = ..., + scope: Optional[Union[str, PermissionProviderScope]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ResourceProviderRequiredPermissions(_Model): + action: Optional[bool] + delete: Optional[bool] + read: Optional[bool] + write: Optional[bool] + + @overload + def __init__( + self, + *, + action: Optional[bool] = ..., + delete: Optional[bool] = ..., + read: Optional[bool] = ..., + write: Optional[bool] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ResourceWithEtag(Resource): + etag: Optional[str] + id: str + name: str + system_data: SystemData + type: str + + @overload + def __init__( + self, + *, + etag: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.RestApiPollerDataConnector(DataConnector, discriminator='RestApiPoller'): + etag: str + id: str + kind: Literal[DataConnectorKind.REST_API_POLLER] + name: str + properties: Optional[RestApiPollerDataConnectorProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[RestApiPollerDataConnectorProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.RestApiPollerDataConnectorProperties(_Model): + add_on_attributes: Optional[dict[str, str]] + auth: CcpAuthConfig + connector_definition_name: str + data_type: Optional[str] + dcr_config: Optional[DCRConfiguration] + is_active: Optional[bool] + paging: Optional[RestApiPollerRequestPagingConfig] + request: RestApiPollerRequestConfig + response: Optional[CcpResponseConfig] + + @overload + def __init__( + self, + *, + add_on_attributes: Optional[dict[str, str]] = ..., + auth: CcpAuthConfig, + connector_definition_name: str, + data_type: Optional[str] = ..., + dcr_config: Optional[DCRConfiguration] = ..., + is_active: Optional[bool] = ..., + paging: Optional[RestApiPollerRequestPagingConfig] = ..., + request: RestApiPollerRequestConfig, + response: Optional[CcpResponseConfig] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.RestApiPollerRequestConfig(_Model): + api_endpoint: str + end_time_attribute_name: Optional[str] + headers: Optional[dict[str, str]] + http_method: Optional[Union[str, HttpMethodVerb]] + is_post_payload_json: Optional[bool] + query_parameters: Optional[dict[str, Any]] + query_parameters_template: Optional[str] + query_time_format: Optional[str] + query_time_interval_attribute_name: Optional[str] + query_time_interval_delimiter: Optional[str] + query_time_interval_prepend: Optional[str] + query_window_in_min: Optional[int] + rate_limit_qps: Optional[int] + retry_count: Optional[int] + start_time_attribute_name: Optional[str] + timeout_in_seconds: Optional[int] + + @overload + def __init__( + self, + *, + api_endpoint: str, + end_time_attribute_name: Optional[str] = ..., + headers: Optional[dict[str, str]] = ..., + http_method: Optional[Union[str, HttpMethodVerb]] = ..., + is_post_payload_json: Optional[bool] = ..., + query_parameters: Optional[dict[str, Any]] = ..., + query_parameters_template: Optional[str] = ..., + query_time_format: Optional[str] = ..., + query_time_interval_attribute_name: Optional[str] = ..., + query_time_interval_delimiter: Optional[str] = ..., + query_time_interval_prepend: Optional[str] = ..., + query_window_in_min: Optional[int] = ..., + rate_limit_qps: Optional[int] = ..., + retry_count: Optional[int] = ..., + start_time_attribute_name: Optional[str] = ..., + timeout_in_seconds: Optional[int] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.RestApiPollerRequestPagingConfig(_Model): + page_size: Optional[int] + page_size_parameter_name: Optional[str] + paging_type: Union[str, RestApiPollerRequestPagingKind] + + @overload + def __init__( + self, + *, + page_size: Optional[int] = ..., + page_size_parameter_name: Optional[str] = ..., + paging_type: Union[str, RestApiPollerRequestPagingKind] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.RestApiPollerRequestPagingKind(str, Enum, metaclass=CaseInsensitiveEnumMeta): + COUNT_BASED_PAGING = "CountBasedPaging" + LINK_HEADER = "LinkHeader" + NEXT_PAGE_TOKEN = "NextPageToken" + NEXT_PAGE_URL = "NextPageUrl" + OFFSET = "Offset" + PERSISTENT_LINK_HEADER = "PersistentLinkHeader" + PERSISTENT_TOKEN = "PersistentToken" + + + class azure.mgmt.securityinsight.models.SampleQueries(_Model): + description: Optional[str] + query: Optional[str] + + @overload + def __init__( + self, + *, + description: Optional[str] = ..., + query: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.SapSolutionUsageStatistic(BillingStatistic, discriminator='SapSolutionUsage'): + etag: str + id: str + kind: Literal[BillingStatisticKind.SAP_SOLUTION_USAGE] + name: str + properties: Optional[SapSolutionUsageStatisticProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[SapSolutionUsageStatisticProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.SapSolutionUsageStatisticProperties(_Model): + active_system_id_count: Optional[int] + + + class azure.mgmt.securityinsight.models.ScheduledAlertRule(AlertRule, discriminator='Scheduled'): + etag: str + id: str + kind: Literal[AlertRuleKind.SCHEDULED] + name: str + properties: Optional[ScheduledAlertRuleProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[ScheduledAlertRuleProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.ScheduledAlertRuleCommonProperties(_Model): + alert_details_override: Optional[AlertDetailsOverride] + custom_details: Optional[dict[str, str]] + entity_mappings: Optional[list[EntityMapping]] + event_grouping_settings: Optional[EventGroupingSettings] + query: Optional[str] + query_frequency: Optional[timedelta] + query_period: Optional[timedelta] + sentinel_entities_mappings: Optional[list[SentinelEntityMapping]] + severity: Optional[Union[str, AlertSeverity]] + trigger_operator: Optional[Union[str, TriggerOperator]] + trigger_threshold: Optional[int] + + @overload + def __init__( + self, + *, + alert_details_override: Optional[AlertDetailsOverride] = ..., + custom_details: Optional[dict[str, str]] = ..., + entity_mappings: Optional[list[EntityMapping]] = ..., + event_grouping_settings: Optional[EventGroupingSettings] = ..., + query: Optional[str] = ..., + query_frequency: Optional[timedelta] = ..., + query_period: Optional[timedelta] = ..., + sentinel_entities_mappings: Optional[list[SentinelEntityMapping]] = ..., + severity: Optional[Union[str, AlertSeverity]] = ..., + trigger_operator: Optional[Union[str, TriggerOperator]] = ..., + trigger_threshold: Optional[int] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ScheduledAlertRuleProperties(ScheduledAlertRuleCommonProperties): + alert_details_override: AlertDetailsOverride + alert_rule_template_name: Optional[str] + custom_details: dict[str, str] + description: Optional[str] + display_name: str + enabled: bool + entity_mappings: list[EntityMapping] + event_grouping_settings: EventGroupingSettings + incident_configuration: Optional[IncidentConfiguration] + last_modified_utc: Optional[datetime] + query: str + query_frequency: timedelta + query_period: timedelta + sentinel_entities_mappings: list[SentinelEntityMapping] + severity: Union[str, AlertSeverity] + sub_techniques: Optional[list[str]] + suppression_duration: timedelta + suppression_enabled: bool + tactics: Optional[list[Union[str, AttackTactic]]] + techniques: Optional[list[str]] + template_version: Optional[str] + trigger_operator: Union[str, TriggerOperator] + trigger_threshold: int + + @overload + def __init__( + self, + *, + alert_details_override: Optional[AlertDetailsOverride] = ..., + alert_rule_template_name: Optional[str] = ..., + custom_details: Optional[dict[str, str]] = ..., + description: Optional[str] = ..., + display_name: str, + enabled: bool, + entity_mappings: Optional[list[EntityMapping]] = ..., + event_grouping_settings: Optional[EventGroupingSettings] = ..., + incident_configuration: Optional[IncidentConfiguration] = ..., + query: Optional[str] = ..., + query_frequency: Optional[timedelta] = ..., + query_period: Optional[timedelta] = ..., + sentinel_entities_mappings: Optional[list[SentinelEntityMapping]] = ..., + severity: Optional[Union[str, AlertSeverity]] = ..., + sub_techniques: Optional[list[str]] = ..., + suppression_duration: timedelta, + suppression_enabled: bool, + tactics: Optional[list[Union[str, AttackTactic]]] = ..., + techniques: Optional[list[str]] = ..., + template_version: Optional[str] = ..., + trigger_operator: Optional[Union[str, TriggerOperator]] = ..., + trigger_threshold: Optional[int] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ScheduledAlertRuleTemplate(AlertRuleTemplate, discriminator='Scheduled'): + id: str + kind: Literal[AlertRuleKind.SCHEDULED] + name: str + properties: Optional[ScheduledAlertRuleTemplateProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[ScheduledAlertRuleTemplateProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.ScheduledAlertRuleTemplateProperties(_Model): + alert_details_override: Optional[AlertDetailsOverride] + alert_rules_created_by_template_count: Optional[int] + created_date_utc: Optional[datetime] + custom_details: Optional[dict[str, str]] + description: Optional[str] + display_name: Optional[str] + entity_mappings: Optional[list[EntityMapping]] + event_grouping_settings: Optional[EventGroupingSettings] + last_updated_date_utc: Optional[datetime] + query: Optional[str] + query_frequency: Optional[timedelta] + query_period: Optional[timedelta] + required_data_connectors: Optional[list[AlertRuleTemplateDataSource]] + sentinel_entities_mappings: Optional[list[SentinelEntityMapping]] + severity: Optional[Union[str, AlertSeverity]] + status: Optional[Union[str, TemplateStatus]] + sub_techniques: Optional[list[str]] + tactics: Optional[list[Union[str, AttackTactic]]] + techniques: Optional[list[str]] + trigger_operator: Optional[Union[str, TriggerOperator]] + trigger_threshold: Optional[int] + version: Optional[str] + + @overload + def __init__( + self, + *, + alert_details_override: Optional[AlertDetailsOverride] = ..., + alert_rules_created_by_template_count: Optional[int] = ..., + custom_details: Optional[dict[str, str]] = ..., + description: Optional[str] = ..., + display_name: Optional[str] = ..., + entity_mappings: Optional[list[EntityMapping]] = ..., + event_grouping_settings: Optional[EventGroupingSettings] = ..., + query: Optional[str] = ..., + query_frequency: Optional[timedelta] = ..., + query_period: Optional[timedelta] = ..., + required_data_connectors: Optional[list[AlertRuleTemplateDataSource]] = ..., + sentinel_entities_mappings: Optional[list[SentinelEntityMapping]] = ..., + severity: Optional[Union[str, AlertSeverity]] = ..., + status: Optional[Union[str, TemplateStatus]] = ..., + sub_techniques: Optional[list[str]] = ..., + tactics: Optional[list[Union[str, AttackTactic]]] = ..., + techniques: Optional[list[str]] = ..., + trigger_operator: Optional[Union[str, TriggerOperator]] = ..., + trigger_threshold: Optional[int] = ..., + version: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.SecurityAlert(Entity, discriminator='SecurityAlert'): + id: str + kind: Literal[EntityKind.SECURITY_ALERT] + name: str + properties: Optional[SecurityAlertProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[SecurityAlertProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.SecurityAlertProperties(EntityCommonProperties): + additional_data: dict[str, any] + alert_display_name: Optional[str] + alert_link: Optional[str] + alert_type: Optional[str] + compromised_entity: Optional[str] + confidence_level: Optional[Union[str, ConfidenceLevel]] + confidence_reasons: Optional[list[SecurityAlertPropertiesConfidenceReasonsItem]] + confidence_score: Optional[float] + confidence_score_status: Optional[Union[str, ConfidenceScoreStatus]] + description: Optional[str] + end_time_utc: Optional[datetime] + friendly_name: str + intent: Optional[Union[str, KillChainIntent]] + processing_end_time: Optional[datetime] + product_component_name: Optional[str] + product_name: Optional[str] + product_version: Optional[str] + provider_alert_id: Optional[str] + remediation_steps: Optional[list[str]] + resource_identifiers: Optional[list[Any]] + severity: Optional[Union[str, AlertSeverity]] + start_time_utc: Optional[datetime] + status: Optional[Union[str, AlertStatus]] + system_alert_id: Optional[str] + tactics: Optional[list[Union[str, AttackTactic]]] + time_generated: Optional[datetime] + vendor_name: Optional[str] + + @overload + def __init__( + self, + *, + severity: Optional[Union[str, AlertSeverity]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.SecurityAlertPropertiesConfidenceReasonsItem(_Model): + reason: Optional[str] + reason_type: Optional[str] + + + class azure.mgmt.securityinsight.models.SecurityAlertTimelineItem(EntityTimelineItem, discriminator='SecurityAlert'): + alert_type: str + azure_resource_id: str + description: Optional[str] + display_name: str + end_time_utc: datetime + intent: Optional[Union[str, KillChainIntent]] + kind: Literal[EntityTimelineKind.SECURITY_ALERT] + product_name: Optional[str] + severity: Union[str, AlertSeverity] + start_time_utc: datetime + techniques: Optional[list[str]] + time_generated: datetime + + @overload + def __init__( + self, + *, + alert_type: str, + azure_resource_id: str, + description: Optional[str] = ..., + display_name: str, + end_time_utc: datetime, + product_name: Optional[str] = ..., + severity: Union[str, AlertSeverity], + start_time_utc: datetime, + techniques: Optional[list[str]] = ..., + time_generated: datetime + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.SecurityGroupEntity(Entity, discriminator='SecurityGroup'): + id: str + kind: Literal[EntityKind.SECURITY_GROUP] + name: str + properties: Optional[SecurityGroupEntityProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[SecurityGroupEntityProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.SecurityGroupEntityProperties(EntityCommonProperties): + additional_data: dict[str, any] + distinguished_name: Optional[str] + friendly_name: str + object_guid: Optional[str] + sid: Optional[str] + + + class azure.mgmt.securityinsight.models.SecurityMLAnalyticsSetting(ProxyResource): + etag: Optional[str] + id: str + kind: str + name: str + system_data: SystemData + type: str + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + kind: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.SecurityMLAnalyticsSettingsDataSource(_Model): + connector_id: Optional[str] + data_types: Optional[list[str]] + + @overload + def __init__( + self, + *, + connector_id: Optional[str] = ..., + data_types: Optional[list[str]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.SecurityMLAnalyticsSettingsKind(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ANOMALY = "Anomaly" + + + class azure.mgmt.securityinsight.models.SentinelEntityMapping(_Model): + column_name: Optional[str] + + @overload + def __init__( + self, + *, + column_name: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.SentinelOnboardingState(ProxyResource): + etag: Optional[str] + id: str + name: str + properties: Optional[SentinelOnboardingStateProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[SentinelOnboardingStateProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.SentinelOnboardingStateProperties(_Model): + customer_managed_key: Optional[bool] + + @overload + def __init__( + self, + *, + customer_managed_key: Optional[bool] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.SentinelOnboardingStatesList(_Model): + value: list[SentinelOnboardingState] + + @overload + def __init__( + self, + *, + value: list[SentinelOnboardingState] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ServicePrincipal(_Model): + app_id: Optional[str] + credentials_expire_on: Optional[datetime] + id: Optional[str] + tenant_id: Optional[str] + + @overload + def __init__( + self, + *, + credentials_expire_on: Optional[datetime] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.SessionAuthModel(CcpAuthConfig, discriminator='Session'): + headers: Optional[dict[str, str]] + is_post_payload_json: Optional[bool] + password: dict[str, str] + query_parameters: Optional[dict[str, Any]] + session_id_name: Optional[str] + session_login_request_uri: Optional[str] + session_timeout_in_minutes: Optional[int] + type: Literal[CcpAuthType.SESSION] + user_name: dict[str, str] + + @overload + def __init__( + self, + *, + headers: Optional[dict[str, str]] = ..., + is_post_payload_json: Optional[bool] = ..., + password: dict[str, str], + query_parameters: Optional[dict[str, Any]] = ..., + session_id_name: Optional[str] = ..., + session_login_request_uri: Optional[str] = ..., + session_timeout_in_minutes: Optional[int] = ..., + user_name: dict[str, str] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.SettingKind(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ANOMALIES = "Anomalies" + ENTITY_ANALYTICS = "EntityAnalytics" + EYES_ON = "EyesOn" + UEBA = "Ueba" + + + class azure.mgmt.securityinsight.models.SettingType(str, Enum, metaclass=CaseInsensitiveEnumMeta): + COPYABLE_LABEL = "CopyableLabel" + INFO_MESSAGE = "InfoMessage" + INSTRUCTION_STEPS_GROUP = "InstructionStepsGroup" + + + class azure.mgmt.securityinsight.models.Settings(ProxyResource): + etag: Optional[str] + id: str + kind: str + name: str + system_data: SystemData + type: str + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + kind: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.SettingsStatus(str, Enum, metaclass=CaseInsensitiveEnumMeta): + FLIGHTING = "Flighting" + PRODUCTION = "Production" + + + class azure.mgmt.securityinsight.models.SortingDirection(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ASC = "ASC" + DESC = "DESC" + + + class azure.mgmt.securityinsight.models.SourceControl(ProxyResource): + etag: Optional[str] + id: str + name: str + properties: SourceControlProperties + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: SourceControlProperties + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.SourceControlProperties(_Model): + content_types: list[Union[str, ContentType]] + description: Optional[str] + display_name: str + id: Optional[str] + last_deployment_info: Optional[DeploymentInfo] + pull_request: Optional[PullRequest] + repo_type: Union[str, RepoType] + repository: Repository + repository_access: Optional[RepositoryAccess] + repository_resource_info: Optional[RepositoryResourceInfo] + service_principal: Optional[ServicePrincipal] + version: Optional[Union[str, Version]] + workload_identity_federation: Optional[WorkloadIdentityFederation] + + @overload + def __init__( + self, + *, + content_types: list[Union[str, ContentType]], + description: Optional[str] = ..., + display_name: str, + repo_type: Union[str, RepoType], + repository: Repository, + repository_access: Optional[RepositoryAccess] = ..., + repository_resource_info: Optional[RepositoryResourceInfo] = ..., + service_principal: Optional[ServicePrincipal] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.SourceKind(str, Enum, metaclass=CaseInsensitiveEnumMeta): + COMMUNITY = "Community" + LOCAL_WORKSPACE = "LocalWorkspace" + SOLUTION = "Solution" + SOURCE_REPOSITORY = "SourceRepository" + + + class azure.mgmt.securityinsight.models.SourceType(str, Enum, metaclass=CaseInsensitiveEnumMeta): + AZURE_STORAGE = "AzureStorage" + LOCAL = "Local" + + + class azure.mgmt.securityinsight.models.State(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ACTIVE = "Active" + COMPLETED_BY_SYSTEM = "CompletedBySystem" + COMPLETED_BY_USER = "CompletedByUser" + DISMISSED = "Dismissed" + IN_PROGRESS = "InProgress" + + + class azure.mgmt.securityinsight.models.Status(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ACTIVE = "Active" + APPROVED = "Approved" + BACKLOG = "Backlog" + CLOSED = "Closed" + FAILED = "Failed" + IN_PROGRESS = "InProgress" + NEW = "New" + SUCCEEDED = "Succeeded" + + + class azure.mgmt.securityinsight.models.SubmissionMailEntity(Entity, discriminator='SubmissionMail'): + id: str + kind: Literal[EntityKind.SUBMISSION_MAIL] + name: str + properties: Optional[SubmissionMailEntityProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[SubmissionMailEntityProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.SubmissionMailEntityProperties(EntityCommonProperties): + additional_data: dict[str, any] + friendly_name: str + network_message_id: Optional[str] + recipient: Optional[str] + report_type: Optional[str] + sender: Optional[str] + sender_ip: Optional[str] + subject: Optional[str] + submission_date: Optional[datetime] + submission_id: Optional[str] + submitter: Optional[str] + timestamp: Optional[datetime] + + + class azure.mgmt.securityinsight.models.SupportTier(str, Enum, metaclass=CaseInsensitiveEnumMeta): + COMMUNITY = "Community" + MICROSOFT = "Microsoft" + PARTNER = "Partner" + + + class azure.mgmt.securityinsight.models.SystemData(_Model): + created_at: Optional[datetime] + created_by: Optional[str] + created_by_type: Optional[Union[str, CreatedByType]] + last_modified_at: Optional[datetime] + last_modified_by: Optional[str] + last_modified_by_type: Optional[Union[str, CreatedByType]] + + @overload + def __init__( + self, + *, + created_at: Optional[datetime] = ..., + created_by: Optional[str] = ..., + created_by_type: Optional[Union[str, CreatedByType]] = ..., + last_modified_at: Optional[datetime] = ..., + last_modified_by: Optional[str] = ..., + last_modified_by_type: Optional[Union[str, CreatedByType]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.TICheckRequirements(DataConnectorsCheckRequirements, discriminator='ThreatIntelligence'): + kind: Literal[DataConnectorKind.THREAT_INTELLIGENCE] + properties: Optional[TICheckRequirementsProperties] + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[TICheckRequirementsProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.TICheckRequirementsProperties(DataConnectorTenantId): + tenant_id: str + + @overload + def __init__( + self, + *, + tenant_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.TIDataConnector(DataConnector, discriminator='ThreatIntelligence'): + etag: str + id: str + kind: Literal[DataConnectorKind.THREAT_INTELLIGENCE] + name: str + properties: Optional[TIDataConnectorProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[TIDataConnectorProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.TIDataConnectorDataTypes(_Model): + indicators: TIDataConnectorDataTypesIndicators + + @overload + def __init__( + self, + *, + indicators: TIDataConnectorDataTypesIndicators + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.TIDataConnectorDataTypesIndicators(DataConnectorDataTypeCommon): + state: Union[str, DataTypeState] + + @overload + def __init__( + self, + *, + state: Union[str, DataTypeState] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.TIDataConnectorProperties(DataConnectorTenantId): + data_types: TIDataConnectorDataTypes + tenant_id: str + tip_lookback_period: Optional[datetime] + + @overload + def __init__( + self, + *, + data_types: TIDataConnectorDataTypes, + tenant_id: str, + tip_lookback_period: Optional[datetime] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.TIObject(Resource): + id: str + kind: str + name: str + properties: Optional[TIObjectCommonProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + kind: str, + properties: Optional[TIObjectCommonProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.TIObjectCommonProperties(_Model): + created_by: Optional[UserInfo] + data: Optional[dict[str, Any]] + first_ingested_time_utc: Optional[datetime] + ingestion_rules_version: Optional[str] + last_ingested_time_utc: Optional[datetime] + last_modified_by: Optional[UserInfo] + last_update_method: Optional[str] + last_updated_date_time_utc: Optional[datetime] + relationship_hints: Optional[list[RelationshipHint]] + source: Optional[str] + + + class azure.mgmt.securityinsight.models.TIObjectKind(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ATTACK_PATTERN = "AttackPattern" + IDENTITY = "Identity" + INDICATOR = "Indicator" + RELATIONSHIP = "Relationship" + THREAT_ACTOR = "ThreatActor" + + + class azure.mgmt.securityinsight.models.TeamInformation(_Model): + description: Optional[str] + name: Optional[str] + primary_channel_url: Optional[str] + team_creation_time_utc: Optional[datetime] + team_id: Optional[str] + + + class azure.mgmt.securityinsight.models.TemplateModel(ProxyResource): + etag: Optional[str] + id: str + name: str + properties: Optional[TemplateProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[TemplateProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.TemplateProperties(_Model): + author: Optional[MetadataAuthor] + categories: Optional[MetadataCategories] + content_id: Optional[str] + content_kind: Optional[Union[str, Kind]] + content_product_id: Optional[str] + content_schema_version: Optional[str] + custom_version: Optional[str] + dependant_templates: Optional[list[TemplateProperties]] + dependencies: Optional[MetadataDependencies] + display_name: Optional[str] + first_publish_date: Optional[date] + icon: Optional[str] + is_deprecated: Optional[Union[str, Flag]] + last_publish_date: Optional[date] + main_template: Optional[Any] + package_id: Optional[str] + package_kind: Optional[Union[str, PackageKind]] + package_name: Optional[str] + package_version: Optional[str] + preview_images: Optional[list[str]] + preview_images_dark: Optional[list[str]] + providers: Optional[list[str]] + source: Optional[MetadataSource] + support: Optional[MetadataSupport] + threat_analysis_tactics: Optional[list[str]] + threat_analysis_techniques: Optional[list[str]] + version: Optional[str] + + @overload + def __init__( + self, + *, + author: Optional[MetadataAuthor] = ..., + categories: Optional[MetadataCategories] = ..., + content_id: Optional[str] = ..., + content_kind: Optional[Union[str, Kind]] = ..., + content_product_id: Optional[str] = ..., + content_schema_version: Optional[str] = ..., + custom_version: Optional[str] = ..., + dependencies: Optional[MetadataDependencies] = ..., + display_name: Optional[str] = ..., + first_publish_date: Optional[date] = ..., + icon: Optional[str] = ..., + last_publish_date: Optional[date] = ..., + main_template: Optional[Any] = ..., + package_id: Optional[str] = ..., + package_kind: Optional[Union[str, PackageKind]] = ..., + package_name: Optional[str] = ..., + package_version: Optional[str] = ..., + preview_images: Optional[list[str]] = ..., + preview_images_dark: Optional[list[str]] = ..., + providers: Optional[list[str]] = ..., + source: Optional[MetadataSource] = ..., + support: Optional[MetadataSupport] = ..., + threat_analysis_tactics: Optional[list[str]] = ..., + threat_analysis_techniques: Optional[list[str]] = ..., + version: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.TemplateStatus(str, Enum, metaclass=CaseInsensitiveEnumMeta): + AVAILABLE = "Available" + INSTALLED = "Installed" + NOT_AVAILABLE = "NotAvailable" + + + class azure.mgmt.securityinsight.models.ThreatActor(TIObject, discriminator='ThreatActor'): + id: str + kind: Literal[TIObjectKind.THREAT_ACTOR] + name: str + properties: TIObjectCommonProperties + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[TIObjectCommonProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.ThreatIntelligence(_Model): + confidence: Optional[float] + provider_name: Optional[str] + report_link: Optional[str] + threat_description: Optional[str] + threat_name: Optional[str] + threat_type: Optional[str] + + + class azure.mgmt.securityinsight.models.ThreatIntelligenceAlertRule(AlertRule, discriminator='ThreatIntelligence'): + etag: str + id: str + kind: Literal[AlertRuleKind.THREAT_INTELLIGENCE] + name: str + properties: Optional[ThreatIntelligenceAlertRuleProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[ThreatIntelligenceAlertRuleProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.ThreatIntelligenceAlertRuleProperties(_Model): + alert_rule_template_name: str + description: Optional[str] + display_name: Optional[str] + enabled: bool + last_modified_utc: Optional[datetime] + severity: Optional[Union[str, AlertSeverity]] + sub_techniques: Optional[list[str]] + tactics: Optional[list[Union[str, AttackTactic]]] + techniques: Optional[list[str]] + + @overload + def __init__( + self, + *, + alert_rule_template_name: str, + enabled: bool + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ThreatIntelligenceAlertRuleTemplate(AlertRuleTemplate, discriminator='ThreatIntelligence'): + id: str + kind: Literal[AlertRuleKind.THREAT_INTELLIGENCE] + name: str + properties: Optional[ThreatIntelligenceAlertRuleTemplateProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[ThreatIntelligenceAlertRuleTemplateProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.ThreatIntelligenceAlertRuleTemplateProperties(AlertRuleTemplateWithMitreProperties): + alert_rules_created_by_template_count: int + created_date_utc: datetime + description: str + display_name: str + last_updated_date_utc: datetime + required_data_connectors: list[AlertRuleTemplateDataSource] + severity: Union[str, AlertSeverity] + status: Union[str, TemplateStatus] + tactics: Union[list[str, AttackTactic]] + techniques: list[str] + + @overload + def __init__( + self, + *, + alert_rules_created_by_template_count: Optional[int] = ..., + description: Optional[str] = ..., + display_name: Optional[str] = ..., + required_data_connectors: Optional[list[AlertRuleTemplateDataSource]] = ..., + severity: Union[str, AlertSeverity], + status: Optional[Union[str, TemplateStatus]] = ..., + tactics: Optional[list[Union[str, AttackTactic]]] = ..., + techniques: Optional[list[str]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ThreatIntelligenceAppendTags(_Model): + threat_intelligence_tags: Optional[list[str]] + + @overload + def __init__( + self, + *, + threat_intelligence_tags: Optional[list[str]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ThreatIntelligenceCount(_Model): + count: int + + + class azure.mgmt.securityinsight.models.ThreatIntelligenceExternalReference(_Model): + description: Optional[str] + external_id: Optional[str] + hashes: Optional[dict[str, str]] + source_name: Optional[str] + url: Optional[str] + + @overload + def __init__( + self, + *, + description: Optional[str] = ..., + external_id: Optional[str] = ..., + hashes: Optional[dict[str, str]] = ..., + source_name: Optional[str] = ..., + url: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ThreatIntelligenceFilteringCriteria(_Model): + ids: Optional[list[str]] + include_disabled: Optional[bool] + keywords: Optional[list[str]] + max_confidence: Optional[int] + max_valid_until: Optional[str] + min_confidence: Optional[int] + min_valid_until: Optional[str] + page_size: Optional[int] + pattern_types: Optional[list[str]] + skip_token: Optional[str] + sort_by: Optional[list[ThreatIntelligenceSortingCriteria]] + sources: Optional[list[str]] + threat_types: Optional[list[str]] + + @overload + def __init__( + self, + *, + ids: Optional[list[str]] = ..., + include_disabled: Optional[bool] = ..., + keywords: Optional[list[str]] = ..., + max_confidence: Optional[int] = ..., + max_valid_until: Optional[str] = ..., + min_confidence: Optional[int] = ..., + min_valid_until: Optional[str] = ..., + page_size: Optional[int] = ..., + pattern_types: Optional[list[str]] = ..., + skip_token: Optional[str] = ..., + sort_by: Optional[list[ThreatIntelligenceSortingCriteria]] = ..., + sources: Optional[list[str]] = ..., + threat_types: Optional[list[str]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ThreatIntelligenceGranularMarkingModel(_Model): + language: Optional[str] + marking_ref: Optional[int] + selectors: Optional[list[str]] + + @overload + def __init__( + self, + *, + language: Optional[str] = ..., + marking_ref: Optional[int] = ..., + selectors: Optional[list[str]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ThreatIntelligenceIndicatorModel(ThreatIntelligenceInformation, discriminator='indicator'): + etag: str + id: str + kind: Literal[ThreatIntelligenceResourceKindEnum.INDICATOR] + name: str + properties: Optional[ThreatIntelligenceIndicatorProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[ThreatIntelligenceIndicatorProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.ThreatIntelligenceIndicatorProperties(EntityCommonProperties): + additional_data: dict[str, any] + confidence: Optional[int] + created: Optional[str] + created_by_ref: Optional[str] + defanged: Optional[bool] + description: Optional[str] + display_name: Optional[str] + extensions: Optional[dict[str, Any]] + external_id: Optional[str] + external_last_updated_time_utc: Optional[str] + external_references: Optional[list[ThreatIntelligenceExternalReference]] + friendly_name: str + granular_markings: Optional[list[ThreatIntelligenceGranularMarkingModel]] + indicator_types: Optional[list[str]] + kill_chain_phases: Optional[list[ThreatIntelligenceKillChainPhase]] + labels: Optional[list[str]] + language: Optional[str] + last_updated_time_utc: Optional[str] + modified: Optional[str] + object_marking_refs: Optional[list[str]] + parsed_pattern: Optional[list[ThreatIntelligenceParsedPattern]] + pattern: Optional[str] + pattern_type: Optional[str] + pattern_version: Optional[str] + revoked: Optional[bool] + source: Optional[str] + threat_intelligence_tags: Optional[list[str]] + threat_types: Optional[list[str]] + valid_from: Optional[str] + valid_until: Optional[str] + + @overload + def __init__( + self, + *, + confidence: Optional[int] = ..., + created: Optional[str] = ..., + created_by_ref: Optional[str] = ..., + defanged: Optional[bool] = ..., + description: Optional[str] = ..., + display_name: Optional[str] = ..., + extensions: Optional[dict[str, Any]] = ..., + external_id: Optional[str] = ..., + external_last_updated_time_utc: Optional[str] = ..., + external_references: Optional[list[ThreatIntelligenceExternalReference]] = ..., + granular_markings: Optional[list[ThreatIntelligenceGranularMarkingModel]] = ..., + indicator_types: Optional[list[str]] = ..., + kill_chain_phases: Optional[list[ThreatIntelligenceKillChainPhase]] = ..., + labels: Optional[list[str]] = ..., + language: Optional[str] = ..., + last_updated_time_utc: Optional[str] = ..., + modified: Optional[str] = ..., + object_marking_refs: Optional[list[str]] = ..., + parsed_pattern: Optional[list[ThreatIntelligenceParsedPattern]] = ..., + pattern: Optional[str] = ..., + pattern_type: Optional[str] = ..., + pattern_version: Optional[str] = ..., + revoked: Optional[bool] = ..., + source: Optional[str] = ..., + threat_intelligence_tags: Optional[list[str]] = ..., + threat_types: Optional[list[str]] = ..., + valid_from: Optional[str] = ..., + valid_until: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ThreatIntelligenceInformation(ProxyResource): + etag: Optional[str] + id: str + kind: str + name: str + system_data: SystemData + type: str + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + kind: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ThreatIntelligenceKillChainPhase(_Model): + kill_chain_name: Optional[str] + phase_name: Optional[str] + + @overload + def __init__( + self, + *, + kill_chain_name: Optional[str] = ..., + phase_name: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ThreatIntelligenceMetric(_Model): + last_updated_time_utc: Optional[str] + pattern_type_metrics: Optional[list[ThreatIntelligenceMetricEntity]] + source_metrics: Optional[list[ThreatIntelligenceMetricEntity]] + threat_type_metrics: Optional[list[ThreatIntelligenceMetricEntity]] + + @overload + def __init__( + self, + *, + last_updated_time_utc: Optional[str] = ..., + pattern_type_metrics: Optional[list[ThreatIntelligenceMetricEntity]] = ..., + source_metrics: Optional[list[ThreatIntelligenceMetricEntity]] = ..., + threat_type_metrics: Optional[list[ThreatIntelligenceMetricEntity]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ThreatIntelligenceMetricEntity(_Model): + metric_name: Optional[str] + metric_value: Optional[int] + + @overload + def __init__( + self, + *, + metric_name: Optional[str] = ..., + metric_value: Optional[int] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ThreatIntelligenceMetrics(_Model): + properties: Optional[ThreatIntelligenceMetric] + + @overload + def __init__( + self, + *, + properties: Optional[ThreatIntelligenceMetric] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ThreatIntelligenceMetricsList(_Model): + value: list[ThreatIntelligenceMetrics] + + @overload + def __init__( + self, + *, + value: list[ThreatIntelligenceMetrics] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ThreatIntelligenceParsedPattern(_Model): + pattern_type_key: Optional[str] + pattern_type_values: Optional[list[ThreatIntelligenceParsedPatternTypeValue]] + + @overload + def __init__( + self, + *, + pattern_type_key: Optional[str] = ..., + pattern_type_values: Optional[list[ThreatIntelligenceParsedPatternTypeValue]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ThreatIntelligenceParsedPatternTypeValue(_Model): + value: Optional[str] + value_type: Optional[str] + + @overload + def __init__( + self, + *, + value: Optional[str] = ..., + value_type: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ThreatIntelligenceResourceKindEnum(str, Enum, metaclass=CaseInsensitiveEnumMeta): + INDICATOR = "indicator" + + + class azure.mgmt.securityinsight.models.ThreatIntelligenceSortingCriteria(_Model): + item_key: Optional[str] + sort_order: Optional[Union[str, ThreatIntelligenceSortingCriteriaEnum]] + + @overload + def __init__( + self, + *, + item_key: Optional[str] = ..., + sort_order: Optional[Union[str, ThreatIntelligenceSortingCriteriaEnum]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ThreatIntelligenceSortingCriteriaEnum(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ASCENDING = "ascending" + DESCENDING = "descending" + UNSORTED = "unsorted" + + + class azure.mgmt.securityinsight.models.TiTaxiiCheckRequirements(DataConnectorsCheckRequirements, discriminator='ThreatIntelligenceTaxii'): + kind: Literal[DataConnectorKind.THREAT_INTELLIGENCE_TAXII] + properties: Optional[TiTaxiiCheckRequirementsProperties] + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[TiTaxiiCheckRequirementsProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.TiTaxiiCheckRequirementsProperties(DataConnectorTenantId): + tenant_id: str + + @overload + def __init__( + self, + *, + tenant_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.TiTaxiiDataConnector(DataConnector, discriminator='ThreatIntelligenceTaxii'): + etag: str + id: str + kind: Literal[DataConnectorKind.THREAT_INTELLIGENCE_TAXII] + name: str + properties: Optional[TiTaxiiDataConnectorProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[TiTaxiiDataConnectorProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.TiTaxiiDataConnectorDataTypes(_Model): + taxii_client: TiTaxiiDataConnectorDataTypesTaxiiClient + + @overload + def __init__( + self, + *, + taxii_client: TiTaxiiDataConnectorDataTypesTaxiiClient + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.TiTaxiiDataConnectorDataTypesTaxiiClient(DataConnectorDataTypeCommon): + state: Union[str, DataTypeState] + + @overload + def __init__( + self, + *, + state: Union[str, DataTypeState] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.TiTaxiiDataConnectorProperties(DataConnectorTenantId): + collection_id: Optional[str] + data_types: TiTaxiiDataConnectorDataTypes + friendly_name: Optional[str] + password: Optional[str] + polling_frequency: Union[str, PollingFrequency] + taxii_lookback_period: Optional[datetime] + taxii_server: Optional[str] + tenant_id: str + user_name: Optional[str] + workspace_id: Optional[str] + + @overload + def __init__( + self, + *, + collection_id: Optional[str] = ..., + data_types: TiTaxiiDataConnectorDataTypes, + friendly_name: Optional[str] = ..., + password: Optional[str] = ..., + polling_frequency: Union[str, PollingFrequency], + taxii_lookback_period: Optional[datetime] = ..., + taxii_server: Optional[str] = ..., + tenant_id: str, + user_name: Optional[str] = ..., + workspace_id: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.TiType(str, Enum, metaclass=CaseInsensitiveEnumMeta): + MAIN = "main" + + + class azure.mgmt.securityinsight.models.TimelineAggregation(_Model): + count: int + kind: Union[str, EntityTimelineKind] + + @overload + def __init__( + self, + *, + count: int, + kind: Union[str, EntityTimelineKind] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.TimelineError(_Model): + error_message: str + kind: Union[str, EntityTimelineKind] + query_id: Optional[str] + + @overload + def __init__( + self, + *, + error_message: str, + kind: Union[str, EntityTimelineKind], + query_id: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.TimelineResultsMetadata(_Model): + aggregations: list[TimelineAggregation] + errors: Optional[list[TimelineError]] + total_count: int + + @overload + def __init__( + self, + *, + aggregations: list[TimelineAggregation], + errors: Optional[list[TimelineError]] = ..., + total_count: int + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.TriggerOperator(str, Enum, metaclass=CaseInsensitiveEnumMeta): + EQUAL = "Equal" + GREATER_THAN = "GreaterThan" + LESS_THAN = "LessThan" + NOT_EQUAL = "NotEqual" + + + class azure.mgmt.securityinsight.models.TriggeredAnalyticsRuleRun(ProxyResource): + etag: Optional[str] + id: str + name: str + properties: TriggeredAnalyticsRuleRunProperties + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: TriggeredAnalyticsRuleRunProperties + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.TriggeredAnalyticsRuleRunProperties(_Model): + execution_time_utc: datetime + provisioning_state: Union[str, ProvisioningState] + rule_id: str + rule_run_additional_data: Optional[dict[str, Any]] + triggered_analytics_rule_run_id: str + + @overload + def __init__( + self, + *, + execution_time_utc: datetime, + rule_id: str, + rule_run_additional_data: Optional[dict[str, Any]] = ..., + triggered_analytics_rule_run_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.TriggersOn(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ALERTS = "Alerts" + INCIDENTS = "Incidents" + + + class azure.mgmt.securityinsight.models.TriggersWhen(str, Enum, metaclass=CaseInsensitiveEnumMeta): + CREATED = "Created" + UPDATED = "Updated" + + + class azure.mgmt.securityinsight.models.Ueba(Settings, discriminator='Ueba'): + etag: str + id: str + kind: Literal[SettingKind.UEBA] + name: str + properties: Optional[UebaProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[UebaProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.UebaDataSources(str, Enum, metaclass=CaseInsensitiveEnumMeta): + AUDIT_LOGS = "AuditLogs" + AZURE_ACTIVITY = "AzureActivity" + SECURITY_EVENT = "SecurityEvent" + SIGNIN_LOGS = "SigninLogs" + + + class azure.mgmt.securityinsight.models.UebaProperties(_Model): + data_sources: Optional[list[Union[str, UebaDataSources]]] + + @overload + def __init__( + self, + *, + data_sources: Optional[list[Union[str, UebaDataSources]]] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.UrlEntity(Entity, discriminator='Url'): + id: str + kind: Literal[EntityKind.URL] + name: str + properties: Optional[UrlEntityProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[UrlEntityProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.UrlEntityProperties(EntityCommonProperties): + additional_data: dict[str, any] + friendly_name: str + url: Optional[str] + + + class azure.mgmt.securityinsight.models.UserInfo(_Model): + email: Optional[str] + name: Optional[str] + object_id: Optional[str] + + @overload + def __init__( + self, + *, + object_id: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.ValidationError(_Model): + error_messages: Optional[list[str]] + record_index: Optional[int] + + @overload + def __init__( + self, + *, + record_index: Optional[int] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.Version(str, Enum, metaclass=CaseInsensitiveEnumMeta): + V1 = "V1" + V2 = "V2" + + + class azure.mgmt.securityinsight.models.Warning(_Model): + warning: Optional[WarningBody] + + + class azure.mgmt.securityinsight.models.WarningBody(_Model): + code: Optional[Union[str, WarningCode]] + details: Optional[list[WarningBody]] + message: Optional[str] + + + class azure.mgmt.securityinsight.models.WarningCode(str, Enum, metaclass=CaseInsensitiveEnumMeta): + SOURCE_CONTROL_DELETED_WITH_WARNINGS = "SourceControl_DeletedWithWarnings" + SOURCE_CONTROL_WARNING_DELETE_PIPELINE_FROM_AZURE_DEV_OPS = "SourceControlWarning_DeletePipelineFromAzureDevOps" + SOURCE_CONTROL_WARNING_DELETE_ROLE_ASSIGNMENT = "SourceControlWarning_DeleteRoleAssignment" + SOURCE_CONTROL_WARNING_DELETE_SERVICE_PRINCIPAL = "SourceControlWarning_DeleteServicePrincipal" + SOURCE_CONTROL_WARNING_DELETE_WORKFLOW_AND_SECRET_FROM_GIT_HUB = "SourceControlWarning_DeleteWorkflowAndSecretFromGitHub" + + + class azure.mgmt.securityinsight.models.Watchlist(ProxyResource): + etag: Optional[str] + id: str + name: str + properties: Optional[WatchlistProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[WatchlistProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.WatchlistItem(ProxyResource): + etag: Optional[str] + id: str + name: str + properties: Optional[WatchlistItemProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + etag: Optional[str] = ..., + properties: Optional[WatchlistItemProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.WatchlistItemProperties(_Model): + created: Optional[datetime] + created_by: Optional[UserInfo] + entity_mapping: Optional[Any] + is_deleted: Optional[bool] + items_key_value: Any + tenant_id: Optional[str] + updated: Optional[datetime] + updated_by: Optional[UserInfo] + watchlist_item_id: Optional[str] + watchlist_item_type: Optional[str] + + @overload + def __init__( + self, + *, + created: Optional[datetime] = ..., + created_by: Optional[UserInfo] = ..., + entity_mapping: Optional[Any] = ..., + is_deleted: Optional[bool] = ..., + items_key_value: Any, + tenant_id: Optional[str] = ..., + updated: Optional[datetime] = ..., + updated_by: Optional[UserInfo] = ..., + watchlist_item_id: Optional[str] = ..., + watchlist_item_type: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.WatchlistProperties(_Model): + content_type: Optional[str] + created: Optional[datetime] + created_by: Optional[UserInfo] + default_duration: Optional[timedelta] + description: Optional[str] + display_name: str + is_deleted: Optional[bool] + items_search_key: str + labels: Optional[list[str]] + number_of_lines_to_skip: Optional[int] + provider: str + provisioning_state: Optional[Union[str, WatchlistProvisioningState]] + raw_content: Optional[str] + source: Optional[str] + source_type: Optional[Union[str, SourceType]] + tenant_id: Optional[str] + updated: Optional[datetime] + updated_by: Optional[UserInfo] + upload_status: Optional[str] + watchlist_alias: Optional[str] + watchlist_id: Optional[str] + watchlist_type: Optional[str] + + @overload + def __init__( + self, + *, + content_type: Optional[str] = ..., + created: Optional[datetime] = ..., + created_by: Optional[UserInfo] = ..., + default_duration: Optional[timedelta] = ..., + description: Optional[str] = ..., + display_name: str, + is_deleted: Optional[bool] = ..., + items_search_key: str, + labels: Optional[list[str]] = ..., + number_of_lines_to_skip: Optional[int] = ..., + provider: str, + raw_content: Optional[str] = ..., + source: Optional[str] = ..., + source_type: Optional[Union[str, SourceType]] = ..., + tenant_id: Optional[str] = ..., + updated: Optional[datetime] = ..., + updated_by: Optional[UserInfo] = ..., + upload_status: Optional[str] = ..., + watchlist_alias: Optional[str] = ..., + watchlist_id: Optional[str] = ..., + watchlist_type: Optional[str] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.WatchlistProvisioningState(str, Enum, metaclass=CaseInsensitiveEnumMeta): + CANCELED = "Canceled" + DELETING = "Deleting" + FAILED = "Failed" + IN_PROGRESS = "InProgress" + NEW = "New" + SUCCEEDED = "Succeeded" + UPLOADING = "Uploading" + + + class azure.mgmt.securityinsight.models.Webhook(_Model): + rotate_webhook_secret: Optional[bool] + webhook_id: Optional[str] + webhook_secret_update_time: Optional[datetime] + webhook_url: Optional[str] + + @overload + def __init__( + self, + *, + rotate_webhook_secret: Optional[bool] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.WorkloadIdentityFederation(_Model): + app_id: Optional[str] + id: Optional[str] + issuer: Optional[str] + subject: Optional[str] + tenant_id: Optional[str] + + + class azure.mgmt.securityinsight.models.WorkspaceManagerAssignment(ProxyResource): + etag: Optional[str] + id: str + name: str + properties: Optional[WorkspaceManagerAssignmentProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[WorkspaceManagerAssignmentProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.WorkspaceManagerAssignmentProperties(_Model): + items_property: list[AssignmentItem] + last_job_end_time: Optional[datetime] + last_job_provisioning_state: Optional[Union[str, JobProvisioningState]] + target_resource_name: str + + @overload + def __init__( + self, + *, + items_property: list[AssignmentItem], + target_resource_name: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.WorkspaceManagerConfiguration(ProxyResource): + etag: Optional[str] + id: str + name: str + properties: Optional[WorkspaceManagerConfigurationProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[WorkspaceManagerConfigurationProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.WorkspaceManagerConfigurationProperties(_Model): + mode: Union[str, Mode] + + @overload + def __init__( + self, + *, + mode: Union[str, Mode] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.WorkspaceManagerGroup(ProxyResource): + etag: Optional[str] + id: str + name: str + properties: Optional[WorkspaceManagerGroupProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[WorkspaceManagerGroupProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.WorkspaceManagerGroupProperties(_Model): + description: Optional[str] + display_name: str + member_resource_names: list[str] + + @overload + def __init__( + self, + *, + description: Optional[str] = ..., + display_name: str, + member_resource_names: list[str] + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + + class azure.mgmt.securityinsight.models.WorkspaceManagerMember(ProxyResource): + etag: Optional[str] + id: str + name: str + properties: Optional[WorkspaceManagerMemberProperties] + system_data: SystemData + type: str + + def __getattr__(self, name: str) -> Any: ... + + @overload + def __init__( + self, + *, + properties: Optional[WorkspaceManagerMemberProperties] = ... + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + def __setattr__( + self, + key: str, + value: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.models.WorkspaceManagerMemberProperties(_Model): + target_workspace_resource_id: str + target_workspace_tenant_id: str + + @overload + def __init__( + self, + *, + target_workspace_resource_id: str, + target_workspace_tenant_id: str + ) -> None: ... + + @overload + def __init__(self, mapping: Mapping[str, Any]) -> None: ... + + +namespace azure.mgmt.securityinsight.operations + + class azure.mgmt.securityinsight.operations.ActionsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + rule_id: str, + action_id: str, + action: ActionRequest, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ActionResponse: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + rule_id: str, + action_id: str, + action: ActionRequest, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ActionResponse: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + rule_id: str, + action_id: str, + action: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ActionResponse: ... + + @distributed_trace + def delete( + self, + resource_group_name: str, + workspace_name: str, + rule_id: str, + action_id: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace + def get( + self, + resource_group_name: str, + workspace_name: str, + rule_id: str, + action_id: str, + **kwargs: Any + ) -> ActionResponse: ... + + @distributed_trace + def list_by_alert_rule( + self, + resource_group_name: str, + workspace_name: str, + rule_id: str, + **kwargs: Any + ) -> ItemPaged[ActionResponse]: ... + + + class azure.mgmt.securityinsight.operations.AlertRuleOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def begin_trigger_rule_run( + self, + resource_group_name: str, + workspace_name: str, + rule_id: str, + analytics_rule_run_trigger_parameter: AnalyticsRuleRunTrigger, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> LROPoller[None]: ... + + @overload + def begin_trigger_rule_run( + self, + resource_group_name: str, + workspace_name: str, + rule_id: str, + analytics_rule_run_trigger_parameter: AnalyticsRuleRunTrigger, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> LROPoller[None]: ... + + @overload + def begin_trigger_rule_run( + self, + resource_group_name: str, + workspace_name: str, + rule_id: str, + analytics_rule_run_trigger_parameter: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> LROPoller[None]: ... + + + class azure.mgmt.securityinsight.operations.AlertRuleTemplatesOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace + def get( + self, + resource_group_name: str, + workspace_name: str, + alert_rule_template_id: str, + **kwargs: Any + ) -> AlertRuleTemplate: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs: Any + ) -> ItemPaged[AlertRuleTemplate]: ... + + + class azure.mgmt.securityinsight.operations.AlertRulesOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + rule_id: str, + alert_rule: AlertRule, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> AlertRule: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + rule_id: str, + alert_rule: AlertRule, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> AlertRule: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + rule_id: str, + alert_rule: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> AlertRule: ... + + @distributed_trace + def delete( + self, + resource_group_name: str, + workspace_name: str, + rule_id: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace + def get( + self, + resource_group_name: str, + workspace_name: str, + rule_id: str, + **kwargs: Any + ) -> AlertRule: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs: Any + ) -> ItemPaged[AlertRule]: ... + + + class azure.mgmt.securityinsight.operations.AutomationRulesOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + automation_rule_id: str, + automation_rule_to_upsert: Optional[AutomationRule] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> AutomationRule: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + automation_rule_id: str, + automation_rule_to_upsert: Optional[AutomationRule] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> AutomationRule: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + automation_rule_id: str, + automation_rule_to_upsert: Optional[IO[bytes]] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> AutomationRule: ... + + @distributed_trace + def delete( + self, + resource_group_name: str, + workspace_name: str, + automation_rule_id: str, + **kwargs: Any + ) -> Any: ... + + @distributed_trace + def get( + self, + resource_group_name: str, + workspace_name: str, + automation_rule_id: str, + **kwargs: Any + ) -> AutomationRule: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs: Any + ) -> ItemPaged[AutomationRule]: ... + + + class azure.mgmt.securityinsight.operations.BillingStatisticsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'billing_statistic_name', 'accept']}, api_versions_list=['2025-10-01-preview']) + def get( + self, + resource_group_name: str, + workspace_name: str, + billing_statistic_name: str, + **kwargs: Any + ) -> BillingStatistic: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'accept']}, api_versions_list=['2025-10-01-preview']) + def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs: Any + ) -> ItemPaged[BillingStatistic]: ... + + + class azure.mgmt.securityinsight.operations.BookmarkOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def expand( + self, + resource_group_name: str, + workspace_name: str, + bookmark_id: str, + parameters: BookmarkExpandParameters, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> BookmarkExpandResponse: ... + + @overload + def expand( + self, + resource_group_name: str, + workspace_name: str, + bookmark_id: str, + parameters: BookmarkExpandParameters, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> BookmarkExpandResponse: ... + + @overload + def expand( + self, + resource_group_name: str, + workspace_name: str, + bookmark_id: str, + parameters: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> BookmarkExpandResponse: ... + + + class azure.mgmt.securityinsight.operations.BookmarkRelationsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + bookmark_id: str, + relation_name: str, + relation: Relation, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Relation: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + bookmark_id: str, + relation_name: str, + relation: Relation, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Relation: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + bookmark_id: str, + relation_name: str, + relation: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Relation: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'bookmark_id', 'relation_name']}, api_versions_list=['2025-10-01-preview']) + def delete( + self, + resource_group_name: str, + workspace_name: str, + bookmark_id: str, + relation_name: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'bookmark_id', 'relation_name', 'accept']}, api_versions_list=['2025-10-01-preview']) + def get( + self, + resource_group_name: str, + workspace_name: str, + bookmark_id: str, + relation_name: str, + **kwargs: Any + ) -> Relation: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'bookmark_id', 'filter', 'orderby', 'top', 'skip_token', 'accept']}, api_versions_list=['2025-10-01-preview']) + def list( + self, + resource_group_name: str, + workspace_name: str, + bookmark_id: str, + *, + filter: Optional[str] = ..., + orderby: Optional[str] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> ItemPaged[Relation]: ... + + + class azure.mgmt.securityinsight.operations.BookmarksOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + bookmark_id: str, + bookmark: Bookmark, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Bookmark: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + bookmark_id: str, + bookmark: Bookmark, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Bookmark: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + bookmark_id: str, + bookmark: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Bookmark: ... + + @distributed_trace + def delete( + self, + resource_group_name: str, + workspace_name: str, + bookmark_id: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace + def get( + self, + resource_group_name: str, + workspace_name: str, + bookmark_id: str, + **kwargs: Any + ) -> Bookmark: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs: Any + ) -> ItemPaged[Bookmark]: ... + + + class azure.mgmt.securityinsight.operations.ContentPackageOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def install( + self, + resource_group_name: str, + workspace_name: str, + package_id: str, + package_installation_properties: PackageModel, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> PackageModel: ... + + @overload + def install( + self, + resource_group_name: str, + workspace_name: str, + package_id: str, + package_installation_properties: PackageModel, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> PackageModel: ... + + @overload + def install( + self, + resource_group_name: str, + workspace_name: str, + package_id: str, + package_installation_properties: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> PackageModel: ... + + @distributed_trace + def uninstall( + self, + resource_group_name: str, + workspace_name: str, + package_id: str, + **kwargs: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.operations.ContentPackagesOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace + def get( + self, + resource_group_name: str, + workspace_name: str, + package_id: str, + **kwargs: Any + ) -> PackageModel: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + *, + count: Optional[bool] = ..., + filter: Optional[str] = ..., + orderby: Optional[str] = ..., + search: Optional[str] = ..., + skip: Optional[int] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> ItemPaged[PackageModel]: ... + + + class azure.mgmt.securityinsight.operations.ContentTemplateOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace + def delete( + self, + resource_group_name: str, + workspace_name: str, + template_id: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace + def get( + self, + resource_group_name: str, + workspace_name: str, + template_id: str, + **kwargs: Any + ) -> TemplateModel: ... + + @overload + def install( + self, + resource_group_name: str, + workspace_name: str, + template_id: str, + template_installation_properties: TemplateModel, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> TemplateModel: ... + + @overload + def install( + self, + resource_group_name: str, + workspace_name: str, + template_id: str, + template_installation_properties: TemplateModel, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> TemplateModel: ... + + @overload + def install( + self, + resource_group_name: str, + workspace_name: str, + template_id: str, + template_installation_properties: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> TemplateModel: ... + + + class azure.mgmt.securityinsight.operations.ContentTemplatesOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + *, + count: Optional[bool] = ..., + expand: Optional[str] = ..., + filter: Optional[str] = ..., + orderby: Optional[str] = ..., + search: Optional[str] = ..., + skip: Optional[int] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> ItemPaged[TemplateModel]: ... + + + class azure.mgmt.securityinsight.operations.DataConnectorDefinitionsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + data_connector_definition_name: str, + connector_definition_input: DataConnectorDefinition, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> DataConnectorDefinition: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + data_connector_definition_name: str, + connector_definition_input: DataConnectorDefinition, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> DataConnectorDefinition: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + data_connector_definition_name: str, + connector_definition_input: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> DataConnectorDefinition: ... + + @distributed_trace + def delete( + self, + resource_group_name: str, + workspace_name: str, + data_connector_definition_name: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace + def get( + self, + resource_group_name: str, + workspace_name: str, + data_connector_definition_name: str, + **kwargs: Any + ) -> DataConnectorDefinition: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs: Any + ) -> ItemPaged[DataConnectorDefinition]: ... + + + class azure.mgmt.securityinsight.operations.DataConnectorsCheckRequirementsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def post( + self, + resource_group_name: str, + workspace_name: str, + data_connectors_check_requirements: DataConnectorsCheckRequirements, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> DataConnectorRequirementsState: ... + + @overload + def post( + self, + resource_group_name: str, + workspace_name: str, + data_connectors_check_requirements: DataConnectorsCheckRequirements, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> DataConnectorRequirementsState: ... + + @overload + def post( + self, + resource_group_name: str, + workspace_name: str, + data_connectors_check_requirements: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> DataConnectorRequirementsState: ... + + + class azure.mgmt.securityinsight.operations.DataConnectorsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def connect( + self, + resource_group_name: str, + workspace_name: str, + data_connector_id: str, + connect_body: DataConnectorConnectBody, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> None: ... + + @overload + def connect( + self, + resource_group_name: str, + workspace_name: str, + data_connector_id: str, + connect_body: DataConnectorConnectBody, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> None: ... + + @overload + def connect( + self, + resource_group_name: str, + workspace_name: str, + data_connector_id: str, + connect_body: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> None: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + data_connector_id: str, + data_connector: DataConnector, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> DataConnector: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + data_connector_id: str, + data_connector: DataConnector, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> DataConnector: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + data_connector_id: str, + data_connector: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> DataConnector: ... + + @distributed_trace + def delete( + self, + resource_group_name: str, + workspace_name: str, + data_connector_id: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'data_connector_id']}, api_versions_list=['2025-10-01-preview']) + def disconnect( + self, + resource_group_name: str, + workspace_name: str, + data_connector_id: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace + def get( + self, + resource_group_name: str, + workspace_name: str, + data_connector_id: str, + **kwargs: Any + ) -> DataConnector: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs: Any + ) -> ItemPaged[DataConnector]: ... + + + class azure.mgmt.securityinsight.operations.EntitiesGetTimelineOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def list( + self, + resource_group_name: str, + workspace_name: str, + entity_id: str, + parameters: EntityTimelineParameters, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EntityTimelineResponse: ... + + @overload + def list( + self, + resource_group_name: str, + workspace_name: str, + entity_id: str, + parameters: EntityTimelineParameters, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EntityTimelineResponse: ... + + @overload + def list( + self, + resource_group_name: str, + workspace_name: str, + entity_id: str, + parameters: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EntityTimelineResponse: ... + + + class azure.mgmt.securityinsight.operations.EntitiesOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def expand( + self, + resource_group_name: str, + workspace_name: str, + entity_id: str, + parameters: EntityExpandParameters, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EntityExpandResponse: ... + + @overload + def expand( + self, + resource_group_name: str, + workspace_name: str, + entity_id: str, + parameters: EntityExpandParameters, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EntityExpandResponse: ... + + @overload + def expand( + self, + resource_group_name: str, + workspace_name: str, + entity_id: str, + parameters: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EntityExpandResponse: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'entity_id', 'accept']}, api_versions_list=['2025-10-01-preview']) + def get( + self, + resource_group_name: str, + workspace_name: str, + entity_id: str, + **kwargs: Any + ) -> Entity: ... + + @overload + def get_insights( + self, + resource_group_name: str, + workspace_name: str, + entity_id: str, + parameters: EntityGetInsightsParameters, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EntityGetInsightsResponse: ... + + @overload + def get_insights( + self, + resource_group_name: str, + workspace_name: str, + entity_id: str, + parameters: EntityGetInsightsParameters, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EntityGetInsightsResponse: ... + + @overload + def get_insights( + self, + resource_group_name: str, + workspace_name: str, + entity_id: str, + parameters: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EntityGetInsightsResponse: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'accept']}, api_versions_list=['2025-10-01-preview']) + def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs: Any + ) -> ItemPaged[Entity]: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'entity_id', 'kind', 'accept']}, api_versions_list=['2025-10-01-preview']) + def queries( + self, + resource_group_name: str, + workspace_name: str, + entity_id: str, + *, + kind: Union[str, EntityItemQueryKind], + **kwargs: Any + ) -> ItemPaged[EntityQueryItem]: ... + + @overload + def run_playbook( + self, + resource_group_name: str, + workspace_name: str, + entity_identifier: str, + request_body: Optional[EntityManualTriggerRequestBody] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> None: ... + + @overload + def run_playbook( + self, + resource_group_name: str, + workspace_name: str, + entity_identifier: str, + request_body: Optional[EntityManualTriggerRequestBody] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> None: ... + + @overload + def run_playbook( + self, + resource_group_name: str, + workspace_name: str, + entity_identifier: str, + request_body: Optional[IO[bytes]] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> None: ... + + + class azure.mgmt.securityinsight.operations.EntitiesRelationsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + entity_id: str, + *, + filter: Optional[str] = ..., + orderby: Optional[str] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> ItemPaged[Relation]: ... + + + class azure.mgmt.securityinsight.operations.EntityQueriesOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + entity_query_id: str, + entity_query: CustomEntityQuery, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EntityQuery: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + entity_query_id: str, + entity_query: CustomEntityQuery, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EntityQuery: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + entity_query_id: str, + entity_query: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> EntityQuery: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'entity_query_id']}, api_versions_list=['2025-10-01-preview']) + def delete( + self, + resource_group_name: str, + workspace_name: str, + entity_query_id: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'entity_query_id', 'accept']}, api_versions_list=['2025-10-01-preview']) + def get( + self, + resource_group_name: str, + workspace_name: str, + entity_query_id: str, + **kwargs: Any + ) -> EntityQuery: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'kind', 'accept']}, api_versions_list=['2025-10-01-preview']) + def list( + self, + resource_group_name: str, + workspace_name: str, + *, + kind: Optional[Union[str, EntityQueryTemplateKind]] = ..., + **kwargs: Any + ) -> ItemPaged[EntityQuery]: ... + + + class azure.mgmt.securityinsight.operations.EntityQueryTemplatesOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'entity_query_template_id', 'accept']}, api_versions_list=['2025-10-01-preview']) + def get( + self, + resource_group_name: str, + workspace_name: str, + entity_query_template_id: str, + **kwargs: Any + ) -> EntityQueryTemplate: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'kind', 'accept']}, api_versions_list=['2025-10-01-preview']) + def list( + self, + resource_group_name: str, + workspace_name: str, + *, + kind: Optional[Union[str, EntityQueryTemplateKind]] = ..., + **kwargs: Any + ) -> ItemPaged[EntityQueryTemplate]: ... + + + class azure.mgmt.securityinsight.operations.EntityRelationsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'entity_id', 'relation_name', 'accept']}, api_versions_list=['2025-10-01-preview']) + def get_relation( + self, + resource_group_name: str, + workspace_name: str, + entity_id: str, + relation_name: str, + **kwargs: Any + ) -> Relation: ... + + + class azure.mgmt.securityinsight.operations.FileImportsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'file_import_id', 'accept']}, api_versions_list=['2025-10-01-preview']) + def begin_delete( + self, + resource_group_name: str, + workspace_name: str, + file_import_id: str, + **kwargs: Any + ) -> LROPoller[FileImport]: ... + + @overload + def create( + self, + resource_group_name: str, + workspace_name: str, + file_import_id: str, + file_import: FileImport, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> FileImport: ... + + @overload + def create( + self, + resource_group_name: str, + workspace_name: str, + file_import_id: str, + file_import: FileImport, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> FileImport: ... + + @overload + def create( + self, + resource_group_name: str, + workspace_name: str, + file_import_id: str, + file_import: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> FileImport: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'file_import_id', 'accept']}, api_versions_list=['2025-10-01-preview']) + def get( + self, + resource_group_name: str, + workspace_name: str, + file_import_id: str, + **kwargs: Any + ) -> FileImport: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'filter', 'orderby', 'top', 'skip_token', 'accept']}, api_versions_list=['2025-10-01-preview']) + def list( + self, + resource_group_name: str, + workspace_name: str, + *, + filter: Optional[str] = ..., + orderby: Optional[str] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> ItemPaged[FileImport]: ... + + + class azure.mgmt.securityinsight.operations.GetOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace + def single_recommendation( + self, + resource_group_name: str, + workspace_name: str, + recommendation_id: str, + **kwargs: Any + ) -> Recommendation: ... + + + class azure.mgmt.securityinsight.operations.GetRecommendationsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs: Any + ) -> ItemPaged[Recommendation]: ... + + + class azure.mgmt.securityinsight.operations.GetTriggeredAnalyticsRuleRunsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs: Any + ) -> ItemPaged[TriggeredAnalyticsRuleRun]: ... + + + class azure.mgmt.securityinsight.operations.HuntCommentsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + hunt_comment_id: str, + hunt_comment: HuntComment, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> HuntComment: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + hunt_comment_id: str, + hunt_comment: HuntComment, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> HuntComment: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + hunt_comment_id: str, + hunt_comment: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> HuntComment: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'hunt_id', 'hunt_comment_id']}, api_versions_list=['2025-10-01-preview']) + def delete( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + hunt_comment_id: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'hunt_id', 'hunt_comment_id', 'accept']}, api_versions_list=['2025-10-01-preview']) + def get( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + hunt_comment_id: str, + **kwargs: Any + ) -> HuntComment: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'hunt_id', 'filter', 'orderby', 'top', 'skip_token', 'accept']}, api_versions_list=['2025-10-01-preview']) + def list( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + *, + filter: Optional[str] = ..., + orderby: Optional[str] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> ItemPaged[HuntComment]: ... + + + class azure.mgmt.securityinsight.operations.HuntRelationsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + hunt_relation_id: str, + hunt_relation: HuntRelation, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> HuntRelation: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + hunt_relation_id: str, + hunt_relation: HuntRelation, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> HuntRelation: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + hunt_relation_id: str, + hunt_relation: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> HuntRelation: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'hunt_id', 'hunt_relation_id']}, api_versions_list=['2025-10-01-preview']) + def delete( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + hunt_relation_id: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'hunt_id', 'hunt_relation_id', 'accept']}, api_versions_list=['2025-10-01-preview']) + def get( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + hunt_relation_id: str, + **kwargs: Any + ) -> HuntRelation: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'hunt_id', 'filter', 'orderby', 'top', 'skip_token', 'accept']}, api_versions_list=['2025-10-01-preview']) + def list( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + *, + filter: Optional[str] = ..., + orderby: Optional[str] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> ItemPaged[HuntRelation]: ... + + + class azure.mgmt.securityinsight.operations.HuntsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + hunt: Hunt, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Hunt: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + hunt: Hunt, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Hunt: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + hunt: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Hunt: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'hunt_id']}, api_versions_list=['2025-10-01-preview']) + def delete( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'hunt_id', 'accept']}, api_versions_list=['2025-10-01-preview']) + def get( + self, + resource_group_name: str, + workspace_name: str, + hunt_id: str, + **kwargs: Any + ) -> Hunt: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'filter', 'orderby', 'top', 'skip_token', 'accept']}, api_versions_list=['2025-10-01-preview']) + def list( + self, + resource_group_name: str, + workspace_name: str, + *, + filter: Optional[str] = ..., + orderby: Optional[str] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> ItemPaged[Hunt]: ... + + + class azure.mgmt.securityinsight.operations.IncidentCommentsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + incident_comment_id: str, + incident_comment: IncidentComment, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> IncidentComment: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + incident_comment_id: str, + incident_comment: IncidentComment, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> IncidentComment: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + incident_comment_id: str, + incident_comment: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> IncidentComment: ... + + @distributed_trace + def delete( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + incident_comment_id: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace + def get( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + incident_comment_id: str, + **kwargs: Any + ) -> IncidentComment: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + *, + filter: Optional[str] = ..., + orderby: Optional[str] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> ItemPaged[IncidentComment]: ... + + + class azure.mgmt.securityinsight.operations.IncidentRelationsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + relation_name: str, + relation: Relation, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Relation: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + relation_name: str, + relation: Relation, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Relation: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + relation_name: str, + relation: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Relation: ... + + @distributed_trace + def delete( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + relation_name: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace + def get( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + relation_name: str, + **kwargs: Any + ) -> Relation: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + *, + filter: Optional[str] = ..., + orderby: Optional[str] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> ItemPaged[Relation]: ... + + + class azure.mgmt.securityinsight.operations.IncidentTasksOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + incident_task_id: str, + incident_task: IncidentTask, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> IncidentTask: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + incident_task_id: str, + incident_task: IncidentTask, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> IncidentTask: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + incident_task_id: str, + incident_task: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> IncidentTask: ... + + @distributed_trace + def delete( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + incident_task_id: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace + def get( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + incident_task_id: str, + **kwargs: Any + ) -> IncidentTask: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + **kwargs: Any + ) -> ItemPaged[IncidentTask]: ... + + + class azure.mgmt.securityinsight.operations.IncidentsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + incident: Incident, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Incident: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + incident: Incident, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Incident: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + incident: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Incident: ... + + @distributed_trace + def delete( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace + def get( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + **kwargs: Any + ) -> Incident: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + *, + filter: Optional[str] = ..., + orderby: Optional[str] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> ItemPaged[Incident]: ... + + @distributed_trace + def list_alerts( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + **kwargs: Any + ) -> IncidentAlertList: ... + + @distributed_trace + def list_bookmarks( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + **kwargs: Any + ) -> IncidentBookmarkList: ... + + @distributed_trace + def list_entities( + self, + resource_group_name: str, + workspace_name: str, + incident_id: str, + **kwargs: Any + ) -> IncidentEntitiesResponse: ... + + @overload + def run_playbook( + self, + resource_group_name: str, + workspace_name: str, + incident_identifier: str, + request_body: Optional[ManualTriggerRequestBody] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Any: ... + + @overload + def run_playbook( + self, + resource_group_name: str, + workspace_name: str, + incident_identifier: str, + request_body: Optional[ManualTriggerRequestBody] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Any: ... + + @overload + def run_playbook( + self, + resource_group_name: str, + workspace_name: str, + incident_identifier: str, + request_body: Optional[IO[bytes]] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Any: ... + + + class azure.mgmt.securityinsight.operations.MetadataOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def create( + self, + resource_group_name: str, + workspace_name: str, + metadata_name: str, + metadata: MetadataModel, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> MetadataModel: ... + + @overload + def create( + self, + resource_group_name: str, + workspace_name: str, + metadata_name: str, + metadata: MetadataModel, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> MetadataModel: ... + + @overload + def create( + self, + resource_group_name: str, + workspace_name: str, + metadata_name: str, + metadata: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> MetadataModel: ... + + @distributed_trace + def delete( + self, + resource_group_name: str, + workspace_name: str, + metadata_name: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace + def get( + self, + resource_group_name: str, + workspace_name: str, + metadata_name: str, + **kwargs: Any + ) -> MetadataModel: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + *, + filter: Optional[str] = ..., + orderby: Optional[str] = ..., + skip: Optional[int] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> ItemPaged[MetadataModel]: ... + + @overload + def update( + self, + resource_group_name: str, + workspace_name: str, + metadata_name: str, + metadata_patch: MetadataPatch, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> MetadataModel: ... + + @overload + def update( + self, + resource_group_name: str, + workspace_name: str, + metadata_name: str, + metadata_patch: MetadataPatch, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> MetadataModel: ... + + @overload + def update( + self, + resource_group_name: str, + workspace_name: str, + metadata_name: str, + metadata_patch: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> MetadataModel: ... + + + class azure.mgmt.securityinsight.operations.OfficeConsentsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'consent_id']}, api_versions_list=['2025-10-01-preview']) + def delete( + self, + resource_group_name: str, + workspace_name: str, + consent_id: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'consent_id', 'accept']}, api_versions_list=['2025-10-01-preview']) + def get( + self, + resource_group_name: str, + workspace_name: str, + consent_id: str, + **kwargs: Any + ) -> OfficeConsent: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'accept']}, api_versions_list=['2025-10-01-preview']) + def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs: Any + ) -> ItemPaged[OfficeConsent]: ... + + + class azure.mgmt.securityinsight.operations.Operations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace + def list(self, **kwargs: Any) -> ItemPaged[Operation]: ... + + + class azure.mgmt.securityinsight.operations.ProductPackageOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace + def get( + self, + resource_group_name: str, + workspace_name: str, + package_id: str, + **kwargs: Any + ) -> ProductPackageModel: ... + + + class azure.mgmt.securityinsight.operations.ProductPackagesOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + *, + filter: Optional[str] = ..., + orderby: Optional[str] = ..., + search: Optional[str] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> ItemPaged[ProductPackageModel]: ... + + + class azure.mgmt.securityinsight.operations.ProductSettingsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'settings_name']}, api_versions_list=['2025-10-01-preview']) + def delete( + self, + resource_group_name: str, + workspace_name: str, + settings_name: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'settings_name', 'accept']}, api_versions_list=['2025-10-01-preview']) + def get( + self, + resource_group_name: str, + workspace_name: str, + settings_name: str, + **kwargs: Any + ) -> Settings: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'accept']}, api_versions_list=['2025-10-01-preview']) + def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs: Any + ) -> ItemPaged[Settings]: ... + + @overload + def update( + self, + resource_group_name: str, + workspace_name: str, + settings_name: str, + settings: Settings, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Settings: ... + + @overload + def update( + self, + resource_group_name: str, + workspace_name: str, + settings_name: str, + settings: Settings, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Settings: ... + + @overload + def update( + self, + resource_group_name: str, + workspace_name: str, + settings_name: str, + settings: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Settings: ... + + + class azure.mgmt.securityinsight.operations.ProductTemplateOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace + def get( + self, + resource_group_name: str, + workspace_name: str, + template_id: str, + **kwargs: Any + ) -> ProductTemplateModel: ... + + + class azure.mgmt.securityinsight.operations.ProductTemplatesOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + *, + count: Optional[bool] = ..., + filter: Optional[str] = ..., + orderby: Optional[str] = ..., + search: Optional[str] = ..., + skip: Optional[int] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> ItemPaged[ProductTemplateModel]: ... + + + class azure.mgmt.securityinsight.operations.ReevaluateOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace + def recommendation( + self, + resource_group_name: str, + workspace_name: str, + recommendation_id: str, + **kwargs: Any + ) -> ReevaluateResponse: ... + + + class azure.mgmt.securityinsight.operations.SecurityMLAnalyticsSettingsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + settings_resource_name: str, + security_ml_analytics_setting: SecurityMLAnalyticsSetting, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> SecurityMLAnalyticsSetting: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + settings_resource_name: str, + security_ml_analytics_setting: SecurityMLAnalyticsSetting, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> SecurityMLAnalyticsSetting: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + settings_resource_name: str, + security_ml_analytics_setting: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> SecurityMLAnalyticsSetting: ... + + @distributed_trace + def delete( + self, + resource_group_name: str, + workspace_name: str, + settings_resource_name: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace + def get( + self, + resource_group_name: str, + workspace_name: str, + settings_resource_name: str, + **kwargs: Any + ) -> SecurityMLAnalyticsSetting: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs: Any + ) -> ItemPaged[SecurityMLAnalyticsSetting]: ... + + + class azure.mgmt.securityinsight.operations.SentinelOnboardingStatesOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def create( + self, + resource_group_name: str, + workspace_name: str, + sentinel_onboarding_state_name: str, + sentinel_onboarding_state_parameter: Optional[SentinelOnboardingState] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> SentinelOnboardingState: ... + + @overload + def create( + self, + resource_group_name: str, + workspace_name: str, + sentinel_onboarding_state_name: str, + sentinel_onboarding_state_parameter: Optional[SentinelOnboardingState] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> SentinelOnboardingState: ... + + @overload + def create( + self, + resource_group_name: str, + workspace_name: str, + sentinel_onboarding_state_name: str, + sentinel_onboarding_state_parameter: Optional[IO[bytes]] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> SentinelOnboardingState: ... + + @distributed_trace + def delete( + self, + resource_group_name: str, + workspace_name: str, + sentinel_onboarding_state_name: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace + def get( + self, + resource_group_name: str, + workspace_name: str, + sentinel_onboarding_state_name: str, + **kwargs: Any + ) -> SentinelOnboardingState: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs: Any + ) -> SentinelOnboardingStatesList: ... + + + class azure.mgmt.securityinsight.operations.SourceControlOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def list_repositories( + self, + resource_group_name: str, + workspace_name: str, + repository_access: RepositoryAccessProperties, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ItemPaged[Repo]: ... + + @overload + def list_repositories( + self, + resource_group_name: str, + workspace_name: str, + repository_access: RepositoryAccessProperties, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ItemPaged[Repo]: ... + + @overload + def list_repositories( + self, + resource_group_name: str, + workspace_name: str, + repository_access: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ItemPaged[Repo]: ... + + + class azure.mgmt.securityinsight.operations.SourceControlsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def create( + self, + resource_group_name: str, + workspace_name: str, + source_control_id: str, + source_control: SourceControl, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> SourceControl: ... + + @overload + def create( + self, + resource_group_name: str, + workspace_name: str, + source_control_id: str, + source_control: SourceControl, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> SourceControl: ... + + @overload + def create( + self, + resource_group_name: str, + workspace_name: str, + source_control_id: str, + source_control: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> SourceControl: ... + + @overload + def delete( + self, + resource_group_name: str, + workspace_name: str, + source_control_id: str, + repository_access: RepositoryAccessProperties, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Warning: ... + + @overload + def delete( + self, + resource_group_name: str, + workspace_name: str, + source_control_id: str, + repository_access: RepositoryAccessProperties, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Warning: ... + + @overload + def delete( + self, + resource_group_name: str, + workspace_name: str, + source_control_id: str, + repository_access: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Warning: ... + + @distributed_trace + def get( + self, + resource_group_name: str, + workspace_name: str, + source_control_id: str, + **kwargs: Any + ) -> SourceControl: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs: Any + ) -> ItemPaged[SourceControl]: ... + + + class azure.mgmt.securityinsight.operations.ThreatIntelligenceIndicatorMetricsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + **kwargs: Any + ) -> ThreatIntelligenceMetricsList: ... + + + class azure.mgmt.securityinsight.operations.ThreatIntelligenceIndicatorOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def append_tags( + self, + resource_group_name: str, + workspace_name: str, + name: str, + threat_intelligence_append_tags: ThreatIntelligenceAppendTags, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> None: ... + + @overload + def append_tags( + self, + resource_group_name: str, + workspace_name: str, + name: str, + threat_intelligence_append_tags: ThreatIntelligenceAppendTags, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> None: ... + + @overload + def append_tags( + self, + resource_group_name: str, + workspace_name: str, + name: str, + threat_intelligence_append_tags: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> None: ... + + @overload + def create( + self, + resource_group_name: str, + workspace_name: str, + name: str, + threat_intelligence_properties: ThreatIntelligenceIndicatorModel, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ThreatIntelligenceInformation: ... + + @overload + def create( + self, + resource_group_name: str, + workspace_name: str, + name: str, + threat_intelligence_properties: ThreatIntelligenceIndicatorModel, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ThreatIntelligenceInformation: ... + + @overload + def create( + self, + resource_group_name: str, + workspace_name: str, + name: str, + threat_intelligence_properties: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ThreatIntelligenceInformation: ... + + @overload + def create_indicator( + self, + resource_group_name: str, + workspace_name: str, + threat_intelligence_properties: ThreatIntelligenceIndicatorModel, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ThreatIntelligenceInformation: ... + + @overload + def create_indicator( + self, + resource_group_name: str, + workspace_name: str, + threat_intelligence_properties: ThreatIntelligenceIndicatorModel, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ThreatIntelligenceInformation: ... + + @overload + def create_indicator( + self, + resource_group_name: str, + workspace_name: str, + threat_intelligence_properties: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ThreatIntelligenceInformation: ... + + @distributed_trace + def delete( + self, + resource_group_name: str, + workspace_name: str, + name: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace + def get( + self, + resource_group_name: str, + workspace_name: str, + name: str, + **kwargs: Any + ) -> ThreatIntelligenceInformation: ... + + @overload + def query_indicators( + self, + resource_group_name: str, + workspace_name: str, + threat_intelligence_filtering_criteria: ThreatIntelligenceFilteringCriteria, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ItemPaged[ThreatIntelligenceInformation]: ... + + @overload + def query_indicators( + self, + resource_group_name: str, + workspace_name: str, + threat_intelligence_filtering_criteria: ThreatIntelligenceFilteringCriteria, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ItemPaged[ThreatIntelligenceInformation]: ... + + @overload + def query_indicators( + self, + resource_group_name: str, + workspace_name: str, + threat_intelligence_filtering_criteria: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ItemPaged[ThreatIntelligenceInformation]: ... + + @overload + def replace_tags( + self, + resource_group_name: str, + workspace_name: str, + name: str, + threat_intelligence_replace_tags: ThreatIntelligenceIndicatorModel, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ThreatIntelligenceInformation: ... + + @overload + def replace_tags( + self, + resource_group_name: str, + workspace_name: str, + name: str, + threat_intelligence_replace_tags: ThreatIntelligenceIndicatorModel, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ThreatIntelligenceInformation: ... + + @overload + def replace_tags( + self, + resource_group_name: str, + workspace_name: str, + name: str, + threat_intelligence_replace_tags: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ThreatIntelligenceInformation: ... + + + class azure.mgmt.securityinsight.operations.ThreatIntelligenceIndicatorsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + *, + filter: Optional[str] = ..., + orderby: Optional[str] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> ItemPaged[ThreatIntelligenceInformation]: ... + + + class azure.mgmt.securityinsight.operations.ThreatIntelligenceOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def count( + self, + resource_group_name: str, + workspace_name: str, + ti_type: Union[str, TiType], + query: Optional[CountQuery] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ThreatIntelligenceCount: ... + + @overload + def count( + self, + resource_group_name: str, + workspace_name: str, + ti_type: Union[str, TiType], + query: Optional[CountQuery] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ThreatIntelligenceCount: ... + + @overload + def count( + self, + resource_group_name: str, + workspace_name: str, + ti_type: Union[str, TiType], + query: Optional[IO[bytes]] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ThreatIntelligenceCount: ... + + @overload + def query( + self, + resource_group_name: str, + workspace_name: str, + ti_type: Union[str, TiType], + query: Optional[Query] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ItemPaged[TIObject]: ... + + @overload + def query( + self, + resource_group_name: str, + workspace_name: str, + ti_type: Union[str, TiType], + query: Optional[Query] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ItemPaged[TIObject]: ... + + @overload + def query( + self, + resource_group_name: str, + workspace_name: str, + ti_type: Union[str, TiType], + query: Optional[IO[bytes]] = None, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> ItemPaged[TIObject]: ... + + + class azure.mgmt.securityinsight.operations.TriggeredAnalyticsRuleRunOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace + def get( + self, + resource_group_name: str, + workspace_name: str, + rule_run_id: str, + **kwargs: Any + ) -> TriggeredAnalyticsRuleRun: ... + + + class azure.mgmt.securityinsight.operations.UpdateOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def recommendation( + self, + resource_group_name: str, + workspace_name: str, + recommendation_id: str, + recommendation_patch: RecommendationPatch, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Recommendation: ... + + @overload + def recommendation( + self, + resource_group_name: str, + workspace_name: str, + recommendation_id: str, + recommendation_patch: RecommendationPatch, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Recommendation: ... + + @overload + def recommendation( + self, + resource_group_name: str, + workspace_name: str, + recommendation_id: str, + recommendation_patch: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> Recommendation: ... + + + class azure.mgmt.securityinsight.operations.WatchlistItemsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + watchlist_alias: str, + watchlist_item_id: str, + watchlist_item: WatchlistItem, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> WatchlistItem: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + watchlist_alias: str, + watchlist_item_id: str, + watchlist_item: WatchlistItem, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> WatchlistItem: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + watchlist_alias: str, + watchlist_item_id: str, + watchlist_item: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> WatchlistItem: ... + + @distributed_trace + def delete( + self, + resource_group_name: str, + workspace_name: str, + watchlist_alias: str, + watchlist_item_id: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace + def get( + self, + resource_group_name: str, + workspace_name: str, + watchlist_alias: str, + watchlist_item_id: str, + **kwargs: Any + ) -> WatchlistItem: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + watchlist_alias: str, + *, + skip_token: Optional[str] = ..., + **kwargs: Any + ) -> ItemPaged[WatchlistItem]: ... + + + class azure.mgmt.securityinsight.operations.WatchlistsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def begin_create_or_update( + self, + resource_group_name: str, + workspace_name: str, + watchlist_alias: str, + watchlist: Watchlist, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> LROPoller[Watchlist]: ... + + @overload + def begin_create_or_update( + self, + resource_group_name: str, + workspace_name: str, + watchlist_alias: str, + watchlist: Watchlist, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> LROPoller[Watchlist]: ... + + @overload + def begin_create_or_update( + self, + resource_group_name: str, + workspace_name: str, + watchlist_alias: str, + watchlist: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> LROPoller[Watchlist]: ... + + @distributed_trace + def begin_delete( + self, + resource_group_name: str, + workspace_name: str, + watchlist_alias: str, + **kwargs: Any + ) -> LROPoller[Watchlist]: ... + + @distributed_trace + def get( + self, + resource_group_name: str, + workspace_name: str, + watchlist_alias: str, + **kwargs: Any + ) -> Watchlist: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + *, + skip_token: Optional[str] = ..., + **kwargs: Any + ) -> ItemPaged[Watchlist]: ... + + + class azure.mgmt.securityinsight.operations.WorkspaceManagerAssignmentJobsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @distributed_trace + def create( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_assignment_name: str, + **kwargs: Any + ) -> Job: ... + + @distributed_trace + def delete( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_assignment_name: str, + job_name: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace + def get( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_assignment_name: str, + job_name: str, + **kwargs: Any + ) -> Job: ... + + @distributed_trace + def list( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_assignment_name: str, + *, + orderby: Optional[str] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> ItemPaged[Job]: ... + + + class azure.mgmt.securityinsight.operations.WorkspaceManagerAssignmentsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_assignment_name: str, + workspace_manager_assignment: WorkspaceManagerAssignment, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> WorkspaceManagerAssignment: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_assignment_name: str, + workspace_manager_assignment: WorkspaceManagerAssignment, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> WorkspaceManagerAssignment: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_assignment_name: str, + workspace_manager_assignment: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> WorkspaceManagerAssignment: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'workspace_manager_assignment_name']}, api_versions_list=['2025-10-01-preview']) + def delete( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_assignment_name: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'workspace_manager_assignment_name', 'accept']}, api_versions_list=['2025-10-01-preview']) + def get( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_assignment_name: str, + **kwargs: Any + ) -> WorkspaceManagerAssignment: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'orderby', 'top', 'skip_token', 'accept']}, api_versions_list=['2025-10-01-preview']) + def list( + self, + resource_group_name: str, + workspace_name: str, + *, + orderby: Optional[str] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> ItemPaged[WorkspaceManagerAssignment]: ... + + + class azure.mgmt.securityinsight.operations.WorkspaceManagerConfigurationsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_configuration_name: str, + workspace_manager_configuration: WorkspaceManagerConfiguration, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> WorkspaceManagerConfiguration: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_configuration_name: str, + workspace_manager_configuration: WorkspaceManagerConfiguration, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> WorkspaceManagerConfiguration: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_configuration_name: str, + workspace_manager_configuration: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> WorkspaceManagerConfiguration: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'workspace_manager_configuration_name']}, api_versions_list=['2025-10-01-preview']) + def delete( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_configuration_name: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'workspace_manager_configuration_name', 'accept']}, api_versions_list=['2025-10-01-preview']) + def get( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_configuration_name: str, + **kwargs: Any + ) -> WorkspaceManagerConfiguration: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'orderby', 'top', 'skip_token', 'accept']}, api_versions_list=['2025-10-01-preview']) + def list( + self, + resource_group_name: str, + workspace_name: str, + *, + orderby: Optional[str] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> ItemPaged[WorkspaceManagerConfiguration]: ... + + + class azure.mgmt.securityinsight.operations.WorkspaceManagerGroupsOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_group_name: str, + workspace_manager_group: WorkspaceManagerGroup, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> WorkspaceManagerGroup: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_group_name: str, + workspace_manager_group: WorkspaceManagerGroup, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> WorkspaceManagerGroup: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_group_name: str, + workspace_manager_group: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> WorkspaceManagerGroup: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'workspace_manager_group_name']}, api_versions_list=['2025-10-01-preview']) + def delete( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_group_name: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'workspace_manager_group_name', 'accept']}, api_versions_list=['2025-10-01-preview']) + def get( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_group_name: str, + **kwargs: Any + ) -> WorkspaceManagerGroup: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'orderby', 'top', 'skip_token', 'accept']}, api_versions_list=['2025-10-01-preview']) + def list( + self, + resource_group_name: str, + workspace_name: str, + *, + orderby: Optional[str] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> ItemPaged[WorkspaceManagerGroup]: ... + + + class azure.mgmt.securityinsight.operations.WorkspaceManagerMembersOperations: + + def __init__( + self, + *args, + **kwargs + ) -> None: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_member_name: str, + workspace_manager_member: WorkspaceManagerMember, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> WorkspaceManagerMember: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_member_name: str, + workspace_manager_member: WorkspaceManagerMember, + *, + content_type: str = "application/json", + **kwargs: Any + ) -> WorkspaceManagerMember: ... + + @overload + def create_or_update( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_member_name: str, + workspace_manager_member: IO[bytes], + *, + content_type: str = "application/json", + **kwargs: Any + ) -> WorkspaceManagerMember: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'workspace_manager_member_name']}, api_versions_list=['2025-10-01-preview']) + def delete( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_member_name: str, + **kwargs: Any + ) -> None: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'workspace_manager_member_name', 'accept']}, api_versions_list=['2025-10-01-preview']) + def get( + self, + resource_group_name: str, + workspace_name: str, + workspace_manager_member_name: str, + **kwargs: Any + ) -> WorkspaceManagerMember: ... + + @distributed_trace + @api_version_validation(method_added_on='2025-10-01-preview', params_added_on={'2025-10-01-preview': ['api_version', 'subscription_id', 'resource_group_name', 'workspace_name', 'orderby', 'top', 'skip_token', 'accept']}, api_versions_list=['2025-10-01-preview']) + def list( + self, + resource_group_name: str, + workspace_name: str, + *, + orderby: Optional[str] = ..., + skip_token: Optional[str] = ..., + top: Optional[int] = ..., + **kwargs: Any + ) -> ItemPaged[WorkspaceManagerMember]: ... + + +namespace azure.mgmt.securityinsight.types + + class azure.mgmt.securityinsight.types.AADCheckRequirements(TypedDict, total=False): + key "kind": Required[Literal[DataConnectorKind.AZURE_ACTIVE_DIRECTORY]] + key "properties": ForwardRef('AADCheckRequirementsProperties', module='types') + kind: Literal[DataConnectorKind.AZURE_ACTIVE_DIRECTORY] + properties: AADCheckRequirementsProperties + + + class azure.mgmt.securityinsight.types.AADCheckRequirementsProperties(DataConnectorTenantId): + key "tenantId": Required[str] + tenantId: str + + + class azure.mgmt.securityinsight.types.AADDataConnector(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[DataConnectorKind.AZURE_ACTIVE_DIRECTORY]] + key "name": str + key "properties": ForwardRef('AADDataConnectorProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[DataConnectorKind.AZURE_ACTIVE_DIRECTORY] + name: str + properties: AADDataConnectorProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.AADDataConnectorProperties(TypedDict, total=False): + key "dataTypes": ForwardRef('AlertsDataTypeOfDataConnector', module='types') + key "tenantId": Required[str] + dataTypes: AlertsDataTypeOfDataConnector + tenantId: str + + + class azure.mgmt.securityinsight.types.AATPCheckRequirements(TypedDict, total=False): + key "kind": Required[Literal[DataConnectorKind.AZURE_ADVANCED_THREAT_PROTECTION]] + key "properties": ForwardRef('AATPCheckRequirementsProperties', module='types') + kind: Literal[DataConnectorKind.AZURE_ADVANCED_THREAT_PROTECTION] + properties: AATPCheckRequirementsProperties + + + class azure.mgmt.securityinsight.types.AATPCheckRequirementsProperties(DataConnectorTenantId): + key "tenantId": Required[str] + tenantId: str + + + class azure.mgmt.securityinsight.types.AATPDataConnector(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[DataConnectorKind.AZURE_ADVANCED_THREAT_PROTECTION]] + key "name": str + key "properties": ForwardRef('AATPDataConnectorProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[DataConnectorKind.AZURE_ADVANCED_THREAT_PROTECTION] + name: str + properties: AATPDataConnectorProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.AATPDataConnectorProperties(TypedDict, total=False): + key "dataTypes": ForwardRef('AlertsDataTypeOfDataConnector', module='types') + key "tenantId": Required[str] + dataTypes: AlertsDataTypeOfDataConnector + tenantId: str + + + class azure.mgmt.securityinsight.types.ASCCheckRequirements(TypedDict, total=False): + key "kind": Required[Literal[DataConnectorKind.AZURE_SECURITY_CENTER]] + key "properties": ForwardRef('ASCCheckRequirementsProperties', module='types') + kind: Literal[DataConnectorKind.AZURE_SECURITY_CENTER] + properties: ASCCheckRequirementsProperties + + + class azure.mgmt.securityinsight.types.ASCCheckRequirementsProperties(TypedDict, total=False): + key "subscriptionId": str + subscriptionId: str + + + class azure.mgmt.securityinsight.types.ASCDataConnector(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[DataConnectorKind.AZURE_SECURITY_CENTER]] + key "name": str + key "properties": ForwardRef('ASCDataConnectorProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[DataConnectorKind.AZURE_SECURITY_CENTER] + name: str + properties: ASCDataConnectorProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.ASCDataConnectorProperties(DataConnectorWithAlertsProperties): + key "dataTypes": ForwardRef('AlertsDataTypeOfDataConnector', module='types') + key "subscriptionId": str + dataTypes: AlertsDataTypeOfDataConnector + subscriptionId: str + + + class azure.mgmt.securityinsight.types.AWSAuthModel(TypedDict, total=False): + key "externalId": str + key "roleArn": Required[str] + key "type": Required[Literal[CcpAuthType.AWS]] + externalId: str + roleArn: str + type: Literal[CcpAuthType.AWS] + + + class azure.mgmt.securityinsight.types.ActionPropertiesBase(TypedDict, total=False): + key "logicAppResourceId": Required[str] + logicAppResourceId: str + + + class azure.mgmt.securityinsight.types.ActionRequest(ResourceWithEtag): + key "etag": str + key "id": str + key "name": str + key "properties": ForwardRef('ActionRequestProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + name: str + properties: ActionRequestProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.ActionRequestProperties(ActionPropertiesBase): + key "logicAppResourceId": Required[str] + key "triggerUri": Required[str] + logicAppResourceId: str + triggerUri: str + + + class azure.mgmt.securityinsight.types.ActionType(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ADD_INCIDENT_TASK = "AddIncidentTask" + MODIFY_PROPERTIES = "ModifyProperties" + RUN_PLAYBOOK = "RunPlaybook" + + + class azure.mgmt.securityinsight.types.ActivityCustomEntityQuery(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[CustomEntityQueryKind.ACTIVITY]] + key "name": str + key "properties": ForwardRef('ActivityEntityQueriesProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[CustomEntityQueryKind.ACTIVITY] + name: str + properties: ActivityEntityQueriesProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.ActivityEntityQueriesProperties(TypedDict, total=False): + key "content": str + key "createdTimeUtc": str + key "description": str + key "enabled": bool + key "inputEntityType": Union[str, EntityType] + key "lastModifiedTimeUtc": str + key "queryDefinitions": ForwardRef('ActivityEntityQueriesPropertiesQueryDefinitions', module='types') + key "templateName": str + key "title": str + content: str + createdTimeUtc: str + description: str + enabled: bool + entitiesFilter: dict[str, list[str]] + inputEntityType: Union[str, EntityType] + lastModifiedTimeUtc: str + queryDefinitions: ActivityEntityQueriesPropertiesQueryDefinitions + requiredInputFieldsSets: list[list[str]] + templateName: str + title: str + + + class azure.mgmt.securityinsight.types.ActivityEntityQueriesPropertiesQueryDefinitions(TypedDict, total=False): + key "query": str + query: str + + + class azure.mgmt.securityinsight.types.AddIncidentTaskActionProperties(TypedDict, total=False): + key "description": str + key "title": Required[str] + description: str + title: str + + + class azure.mgmt.securityinsight.types.AlertDetailsOverride(TypedDict, total=False): + key "alertDescriptionFormat": str + key "alertDisplayNameFormat": str + key "alertSeverityColumnName": str + key "alertTacticsColumnName": str + alertDescriptionFormat: str + alertDisplayNameFormat: str + alertDynamicProperties: list[AlertPropertyMapping] + alertSeverityColumnName: str + alertTacticsColumnName: str + + + class azure.mgmt.securityinsight.types.AlertPropertyMapping(TypedDict, total=False): + key "alertProperty": Union[str, AlertProperty] + key "value": str + alertProperty: Union[str, AlertProperty] + value: str + + + class azure.mgmt.securityinsight.types.AlertRuleKind(str, Enum, metaclass=CaseInsensitiveEnumMeta): + FUSION = "Fusion" + MICROSOFT_SECURITY_INCIDENT_CREATION = "MicrosoftSecurityIncidentCreation" + ML_BEHAVIOR_ANALYTICS = "MLBehaviorAnalytics" + NRT = "NRT" + SCHEDULED = "Scheduled" + THREAT_INTELLIGENCE = "ThreatIntelligence" + + + class azure.mgmt.securityinsight.types.AlertsDataTypeOfDataConnector(TypedDict, total=False): + key "alerts": Required[DataConnectorDataTypeCommon] + alerts: DataConnectorDataTypeCommon + + + class azure.mgmt.securityinsight.types.AnalyticsRuleRunTrigger(TypedDict, total=False): + key "properties": Required[AnalyticsRuleRunTriggerProperties] + properties: AnalyticsRuleRunTriggerProperties + + + class azure.mgmt.securityinsight.types.AnalyticsRuleRunTriggerProperties(TypedDict, total=False): + key "executionTimeUtc": Required[str] + executionTimeUtc: str + + + class azure.mgmt.securityinsight.types.Anomalies(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[SettingKind.ANOMALIES]] + key "name": str + key "properties": ForwardRef('AnomaliesSettingsProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[SettingKind.ANOMALIES] + name: str + properties: AnomaliesSettingsProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.AnomaliesSettingsProperties(TypedDict, total=False): + key "isEnabled": bool + isEnabled: bool + + + class azure.mgmt.securityinsight.types.AnomalySecurityMLAnalyticsSettings(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[SecurityMLAnalyticsSettingsKind.ANOMALY]] + key "name": str + key "properties": ForwardRef('AnomalySecurityMLAnalyticsSettingsProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[SecurityMLAnalyticsSettingsKind.ANOMALY] + name: str + properties: AnomalySecurityMLAnalyticsSettingsProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.AnomalySecurityMLAnalyticsSettingsProperties(TypedDict, total=False): + key "anomalySettingsVersion": int + key "anomalyVersion": Required[str] + key "customizableObservations": Any + key "description": str + key "displayName": Required[str] + key "enabled": Required[bool] + key "frequency": Required[str] + key "isDefaultSettings": Required[bool] + key "lastModifiedUtc": str + key "settingsDefinitionId": str + key "settingsStatus": Required[Union[str, SettingsStatus]] + anomalySettingsVersion: int + anomalyVersion: str + customizableObservations: Any + description: str + displayName: str + enabled: bool + frequency: str + isDefaultSettings: bool + lastModifiedUtc: str + requiredDataConnectors: list[SecurityMLAnalyticsSettingsDataSource] + settingsDefinitionId: str + settingsStatus: Union[str, SettingsStatus] + tactics: list[Union[str, AttackTactic]] + techniques: list[str] + + + class azure.mgmt.securityinsight.types.ApiKeyAuthModel(TypedDict, total=False): + key "apiKey": Required[str] + key "apiKeyIdentifier": str + key "apiKeyName": Required[str] + key "isApiKeyInPostPayload": bool + key "type": Required[Literal[CcpAuthType.API_KEY]] + apiKey: str + apiKeyIdentifier: str + apiKeyName: str + isApiKeyInPostPayload: bool + type: Literal[CcpAuthType.API_KEY] + + + class azure.mgmt.securityinsight.types.ApiPollingParameters(TypedDict, total=False): + key "connectorUiConfig": ForwardRef('CodelessUiConnectorConfigProperties', module='types') + key "pollingConfig": ForwardRef('CodelessConnectorPollingConfigProperties', module='types') + connectorUiConfig: CodelessUiConnectorConfigProperties + pollingConfig: CodelessConnectorPollingConfigProperties + + + class azure.mgmt.securityinsight.types.AssignmentItem(TypedDict, total=False): + key "resourceId": str + resourceId: str + + + class azure.mgmt.securityinsight.types.AutomationRule(ProxyResource): + key "etag": str + key "id": str + key "name": str + key "properties": Required[AutomationRuleProperties] + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + name: str + properties: AutomationRuleProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.AutomationRuleAddIncidentTaskAction(TypedDict, total=False): + key "actionConfiguration": ForwardRef('AddIncidentTaskActionProperties', module='types') + key "actionType": Required[Literal[ActionType.ADD_INCIDENT_TASK]] + key "order": Required[int] + actionConfiguration: AddIncidentTaskActionProperties + actionType: Literal[ActionType.ADD_INCIDENT_TASK] + order: int + + + class azure.mgmt.securityinsight.types.AutomationRuleBooleanCondition(TypedDict, total=False): + key "operator": Union[str, AutomationRuleBooleanConditionSupportedOperator] + innerConditions: list[AutomationRuleCondition] + operator: Union[str, AutomationRuleBooleanConditionSupportedOperator] + + + class azure.mgmt.securityinsight.types.AutomationRuleModifyPropertiesAction(TypedDict, total=False): + key "actionConfiguration": ForwardRef('IncidentPropertiesAction', module='types') + key "actionType": Required[Literal[ActionType.MODIFY_PROPERTIES]] + key "order": Required[int] + actionConfiguration: IncidentPropertiesAction + actionType: Literal[ActionType.MODIFY_PROPERTIES] + order: int + + + class azure.mgmt.securityinsight.types.AutomationRuleProperties(TypedDict, total=False): + key "actions": Required[list[AutomationRuleAction]] + key "createdBy": ForwardRef('ClientInfo', module='types') + key "createdTimeUtc": str + key "displayName": Required[str] + key "lastModifiedBy": ForwardRef('ClientInfo', module='types') + key "lastModifiedTimeUtc": str + key "order": Required[int] + key "triggeringLogic": Required[AutomationRuleTriggeringLogic] + actions: list[AutomationRuleAction] + createdBy: ClientInfo + createdTimeUtc: str + displayName: str + lastModifiedBy: ClientInfo + lastModifiedTimeUtc: str + order: int + triggeringLogic: AutomationRuleTriggeringLogic + + + class azure.mgmt.securityinsight.types.AutomationRulePropertyArrayChangedValuesCondition(TypedDict, total=False): + key "arrayType": Union[str, AutomationRulePropertyArrayChangedConditionSupportedArrayType] + key "changeType": Union[str, AutomationRulePropertyArrayChangedConditionSupportedChangeType] + arrayType: Union[str, AutomationRulePropertyArrayChangedConditionSupportedArrayType] + changeType: Union[str, AutomationRulePropertyArrayChangedConditionSupportedChangeType] + + + class azure.mgmt.securityinsight.types.AutomationRulePropertyArrayValuesCondition(TypedDict, total=False): + key "arrayConditionType": Union[str, AutomationRulePropertyArrayConditionSupportedArrayConditionType] + key "arrayType": Union[str, AutomationRulePropertyArrayConditionSupportedArrayType] + arrayConditionType: Union[str, AutomationRulePropertyArrayConditionSupportedArrayConditionType] + arrayType: Union[str, AutomationRulePropertyArrayConditionSupportedArrayType] + itemConditions: list[AutomationRuleCondition] + + + class azure.mgmt.securityinsight.types.AutomationRulePropertyValuesChangedCondition(TypedDict, total=False): + key "changeType": Union[str, AutomationRulePropertyChangedConditionSupportedChangedType] + key "operator": Union[str, AutomationRulePropertyConditionSupportedOperator] + key "propertyName": Union[str, AutomationRulePropertyChangedConditionSupportedPropertyType] + changeType: Union[str, AutomationRulePropertyChangedConditionSupportedChangedType] + operator: Union[str, AutomationRulePropertyConditionSupportedOperator] + propertyName: Union[str, AutomationRulePropertyChangedConditionSupportedPropertyType] + propertyValues: list[str] + + + class azure.mgmt.securityinsight.types.AutomationRulePropertyValuesCondition(TypedDict, total=False): + key "operator": Union[str, AutomationRulePropertyConditionSupportedOperator] + key "propertyName": Union[str, AutomationRulePropertyConditionSupportedProperty] + operator: Union[str, AutomationRulePropertyConditionSupportedOperator] + propertyName: Union[str, AutomationRulePropertyConditionSupportedProperty] + propertyValues: list[str] + + + class azure.mgmt.securityinsight.types.AutomationRuleRunPlaybookAction(TypedDict, total=False): + key "actionConfiguration": ForwardRef('PlaybookActionProperties', module='types') + key "actionType": Required[Literal[ActionType.RUN_PLAYBOOK]] + key "order": Required[int] + actionConfiguration: PlaybookActionProperties + actionType: Literal[ActionType.RUN_PLAYBOOK] + order: int + + + class azure.mgmt.securityinsight.types.AutomationRuleTriggeringLogic(TypedDict, total=False): + key "expirationTimeUtc": str + key "isEnabled": Required[bool] + key "triggersOn": Required[Union[str, TriggersOn]] + key "triggersWhen": Required[Union[str, TriggersWhen]] + conditions: list[AutomationRuleCondition] + expirationTimeUtc: str + isEnabled: bool + triggersOn: Union[str, TriggersOn] + triggersWhen: Union[str, TriggersWhen] + + + class azure.mgmt.securityinsight.types.Availability(TypedDict, total=False): + key "isPreview": bool + key "status": Literal[1] + isPreview: bool + status: Literal[1] + + + class azure.mgmt.securityinsight.types.AwsCloudTrailCheckRequirements(TypedDict, total=False): + key "kind": Required[Literal[DataConnectorKind.AMAZON_WEB_SERVICES_CLOUD_TRAIL]] + kind: Literal[DataConnectorKind.AMAZON_WEB_SERVICES_CLOUD_TRAIL] + + + class azure.mgmt.securityinsight.types.AwsCloudTrailDataConnector(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[DataConnectorKind.AMAZON_WEB_SERVICES_CLOUD_TRAIL]] + key "name": str + key "properties": ForwardRef('AwsCloudTrailDataConnectorProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[DataConnectorKind.AMAZON_WEB_SERVICES_CLOUD_TRAIL] + name: str + properties: AwsCloudTrailDataConnectorProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.AwsCloudTrailDataConnectorDataTypes(TypedDict, total=False): + key "logs": Required[AwsCloudTrailDataConnectorDataTypesLogs] + logs: AwsCloudTrailDataConnectorDataTypesLogs + + + class azure.mgmt.securityinsight.types.AwsCloudTrailDataConnectorDataTypesLogs(DataConnectorDataTypeCommon): + key "state": Required[Union[str, DataTypeState]] + state: Union[str, DataTypeState] + + + class azure.mgmt.securityinsight.types.AwsCloudTrailDataConnectorProperties(TypedDict, total=False): + key "awsRoleArn": str + key "dataTypes": Required[AwsCloudTrailDataConnectorDataTypes] + awsRoleArn: str + dataTypes: AwsCloudTrailDataConnectorDataTypes + + + class azure.mgmt.securityinsight.types.AwsS3CheckRequirements(TypedDict, total=False): + key "kind": Required[Literal[DataConnectorKind.AMAZON_WEB_SERVICES_S3]] + kind: Literal[DataConnectorKind.AMAZON_WEB_SERVICES_S3] + + + class azure.mgmt.securityinsight.types.AwsS3DataConnector(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[DataConnectorKind.AMAZON_WEB_SERVICES_S3]] + key "name": str + key "properties": ForwardRef('AwsS3DataConnectorProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[DataConnectorKind.AMAZON_WEB_SERVICES_S3] + name: str + properties: AwsS3DataConnectorProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.AwsS3DataConnectorDataTypes(TypedDict, total=False): + key "logs": Required[AwsS3DataConnectorDataTypesLogs] + logs: AwsS3DataConnectorDataTypesLogs + + + class azure.mgmt.securityinsight.types.AwsS3DataConnectorDataTypesLogs(DataConnectorDataTypeCommon): + key "state": Required[Union[str, DataTypeState]] + state: Union[str, DataTypeState] + + + class azure.mgmt.securityinsight.types.AwsS3DataConnectorProperties(TypedDict, total=False): + key "dataTypes": Required[AwsS3DataConnectorDataTypes] + key "destinationTable": Required[str] + key "roleArn": Required[str] + key "sqsUrls": Required[list[str]] + dataTypes: AwsS3DataConnectorDataTypes + destinationTable: str + roleArn: str + sqsUrls: list[str] + + + class azure.mgmt.securityinsight.types.AzureDevOpsResourceInfo(TypedDict, total=False): + key "pipelineId": str + key "serviceConnectionId": str + pipelineId: str + serviceConnectionId: str + + + class azure.mgmt.securityinsight.types.BasicAuthModel(TypedDict, total=False): + key "password": Required[str] + key "type": Required[Literal[CcpAuthType.BASIC]] + key "userName": Required[str] + password: str + type: Literal[CcpAuthType.BASIC] + userName: str + + + class azure.mgmt.securityinsight.types.Bookmark(ProxyResource): + key "etag": str + key "id": str + key "name": str + key "properties": ForwardRef('BookmarkProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + name: str + properties: BookmarkProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.BookmarkEntityMappings(TypedDict, total=False): + key "entityType": str + entityType: str + fieldMappings: list[EntityFieldMapping] + + + class azure.mgmt.securityinsight.types.BookmarkExpandParameters(TypedDict, total=False): + key "endTime": str + key "expansionId": str + key "startTime": str + endTime: str + expansionId: str + startTime: str + + + class azure.mgmt.securityinsight.types.BookmarkProperties(TypedDict, total=False): + key "created": str + key "createdBy": ForwardRef('UserInfo', module='types') + key "displayName": Required[str] + key "eventTime": str + key "incidentInfo": ForwardRef('IncidentInfo', module='types') + key "notes": str + key "query": Required[str] + key "queryEndTime": str + key "queryResult": str + key "queryStartTime": str + key "updated": str + key "updatedBy": ForwardRef('UserInfo', module='types') + created: str + createdBy: UserInfo + displayName: str + entityMappings: list[BookmarkEntityMappings] + eventTime: str + incidentInfo: IncidentInfo + labels: list[str] + notes: str + query: str + queryEndTime: str + queryResult: str + queryStartTime: str + tactics: list[Union[str, AttackTactic]] + techniques: list[str] + updated: str + updatedBy: UserInfo + + + class azure.mgmt.securityinsight.types.BooleanConditionProperties(TypedDict, total=False): + key "conditionProperties": ForwardRef('AutomationRuleBooleanCondition', module='types') + key "conditionType": Required[Literal[ConditionType.BOOLEAN]] + conditionProperties: AutomationRuleBooleanCondition + conditionType: Literal[ConditionType.BOOLEAN] + + + class azure.mgmt.securityinsight.types.CcpAuthType(str, Enum, metaclass=CaseInsensitiveEnumMeta): + API_KEY = "APIKey" + AWS = "AWS" + BASIC = "Basic" + GCP = "GCP" + GIT_HUB = "GitHub" + JWT_TOKEN = "JwtToken" + NONE = "None" + ORACLE = "Oracle" + O_AUTH2 = "OAuth2" + SERVICE_BUS = "ServiceBus" + SESSION = "Session" + + + class azure.mgmt.securityinsight.types.CcpResponseConfig(TypedDict, total=False): + key "compressionAlgo": str + key "convertChildPropertiesToArray": Optional[bool] + key "csvDelimiter": str + key "csvEscape": Optional[str] + key "eventsJsonPaths": Required[list[str]] + key "format": str + key "hasCsvBoundary": Optional[bool] + key "hasCsvHeader": Optional[bool] + key "isGzipCompressed": bool + key "successStatusJsonPath": str + key "successStatusValue": Optional[str] + compressionAlgo: str + convertChildPropertiesToArray: bool + csvDelimiter: str + csvEscape: str + eventsJsonPaths: list[str] + format: str + hasCsvBoundary: bool + hasCsvHeader: bool + isGzipCompressed: bool + successStatusJsonPath: str + successStatusValue: str + + + class azure.mgmt.securityinsight.types.ClientInfo(TypedDict, total=False): + key "email": str + key "name": str + key "objectId": str + key "userPrincipalName": str + email: str + name: str + objectId: str + userPrincipalName: str + + + class azure.mgmt.securityinsight.types.CodelessApiPollingDataConnector(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[DataConnectorKind.API_POLLING]] + key "name": str + key "properties": ForwardRef('ApiPollingParameters', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[DataConnectorKind.API_POLLING] + name: str + properties: ApiPollingParameters + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.CodelessConnectorPollingAuthProperties(TypedDict, total=False): + key "apiKeyIdentifier": str + key "apiKeyName": str + key "authType": Required[str] + key "authorizationEndpoint": str + key "authorizationEndpointQueryParameters": Any + key "flowName": str + key "isApiKeyInPostPayload": str + key "isClientSecretInHeader": bool + key "redirectionEndpoint": str + key "scope": str + key "tokenEndpoint": str + key "tokenEndpointHeaders": Any + key "tokenEndpointQueryParameters": Any + apiKeyIdentifier: str + apiKeyName: str + authType: str + authorizationEndpoint: str + authorizationEndpointQueryParameters: Any + flowName: str + isApiKeyInPostPayload: str + isClientSecretInHeader: bool + redirectionEndpoint: str + scope: str + tokenEndpoint: str + tokenEndpointHeaders: Any + tokenEndpointQueryParameters: Any + + + class azure.mgmt.securityinsight.types.CodelessConnectorPollingConfigProperties(TypedDict, total=False): + key "auth": Required[CodelessConnectorPollingAuthProperties] + key "isActive": bool + key "paging": ForwardRef('CodelessConnectorPollingPagingProperties', module='types') + key "request": Required[CodelessConnectorPollingRequestProperties] + key "response": ForwardRef('CodelessConnectorPollingResponseProperties', module='types') + auth: CodelessConnectorPollingAuthProperties + isActive: bool + paging: CodelessConnectorPollingPagingProperties + request: CodelessConnectorPollingRequestProperties + response: CodelessConnectorPollingResponseProperties + + + class azure.mgmt.securityinsight.types.CodelessConnectorPollingPagingProperties(TypedDict, total=False): + key "nextPageParaName": str + key "nextPageTokenJsonPath": str + key "pageCountAttributePath": str + key "pageSize": int + key "pageSizeParaName": str + key "pageTimeStampAttributePath": str + key "pageTotalCountAttributePath": str + key "pagingType": Required[str] + key "searchTheLatestTimeStampFromEventsList": str + nextPageParaName: str + nextPageTokenJsonPath: str + pageCountAttributePath: str + pageSize: int + pageSizeParaName: str + pageTimeStampAttributePath: str + pageTotalCountAttributePath: str + pagingType: str + searchTheLatestTimeStampFromEventsList: str + + + class azure.mgmt.securityinsight.types.CodelessConnectorPollingRequestProperties(TypedDict, total=False): + key "apiEndpoint": Required[str] + key "endTimeAttributeName": str + key "headers": Any + key "httpMethod": Required[str] + key "queryParameters": Any + key "queryParametersTemplate": str + key "queryTimeFormat": Required[str] + key "queryWindowInMin": Required[int] + key "rateLimitQps": int + key "retryCount": int + key "startTimeAttributeName": str + key "timeoutInSeconds": int + apiEndpoint: str + endTimeAttributeName: str + headers: Any + httpMethod: str + queryParameters: Any + queryParametersTemplate: str + queryTimeFormat: str + queryWindowInMin: int + rateLimitQps: int + retryCount: int + startTimeAttributeName: str + timeoutInSeconds: int + + + class azure.mgmt.securityinsight.types.CodelessConnectorPollingResponseProperties(TypedDict, total=False): + key "eventsJsonPaths": Required[list[str]] + key "isGzipCompressed": bool + key "successStatusJsonPath": str + key "successStatusValue": str + eventsJsonPaths: list[str] + isGzipCompressed: bool + successStatusJsonPath: str + successStatusValue: str + + + class azure.mgmt.securityinsight.types.CodelessParameters(TypedDict, total=False): + key "connectorUiConfig": ForwardRef('CodelessUiConnectorConfigProperties', module='types') + connectorUiConfig: CodelessUiConnectorConfigProperties + + + class azure.mgmt.securityinsight.types.CodelessUiConnectorConfigProperties(TypedDict, total=False): + key "availability": Required[Availability] + key "connectivityCriteria": Required[list[CodelessUiConnectorConfigPropertiesConnectivityCriteriaItem]] + key "customImage": str + key "dataTypes": Required[list[CodelessUiConnectorConfigPropertiesDataTypesItem]] + key "descriptionMarkdown": Required[str] + key "graphQueries": Required[list[CodelessUiConnectorConfigPropertiesGraphQueriesItem]] + key "graphQueriesTableName": Required[str] + key "instructionSteps": Required[list[CodelessUiConnectorConfigPropertiesInstructionStepsItem]] + key "permissions": Required[Permissions] + key "publisher": Required[str] + key "sampleQueries": Required[list[CodelessUiConnectorConfigPropertiesSampleQueriesItem]] + key "title": Required[str] + availability: Availability + connectivityCriteria: list[CodelessUiConnectorConfigPropertiesConnectivityCriteriaItem] + customImage: str + dataTypes: list[CodelessUiConnectorConfigPropertiesDataTypesItem] + descriptionMarkdown: str + graphQueries: list[CodelessUiConnectorConfigPropertiesGraphQueriesItem] + graphQueriesTableName: str + instructionSteps: list[CodelessUiConnectorConfigPropertiesInstructionStepsItem] + permissions: Permissions + publisher: str + sampleQueries: list[CodelessUiConnectorConfigPropertiesSampleQueriesItem] + title: str + + + class azure.mgmt.securityinsight.types.CodelessUiConnectorConfigPropertiesConnectivityCriteriaItem(ConnectivityCriteria): + key "type": Union[str, ConnectivityType] + type: Union[str, ConnectivityType] + value: list[str] + + + class azure.mgmt.securityinsight.types.CodelessUiConnectorConfigPropertiesDataTypesItem(LastDataReceivedDataType): + key "lastDataReceivedQuery": str + key "name": str + lastDataReceivedQuery: str + name: str + + + class azure.mgmt.securityinsight.types.CodelessUiConnectorConfigPropertiesGraphQueriesItem(GraphQueries): + key "baseQuery": str + key "legend": str + key "metricName": str + baseQuery: str + legend: str + metricName: str + + + class azure.mgmt.securityinsight.types.CodelessUiConnectorConfigPropertiesInstructionStepsItem(InstructionSteps): + key "description": str + key "title": str + description: str + instructions: list[InstructionStepsInstructionsItem] + title: str + + + class azure.mgmt.securityinsight.types.CodelessUiConnectorConfigPropertiesSampleQueriesItem(SampleQueries): + key "description": str + key "query": str + description: str + query: str + + + class azure.mgmt.securityinsight.types.CodelessUiDataConnector(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[DataConnectorKind.GENERIC_UI]] + key "name": str + key "properties": ForwardRef('CodelessParameters', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[DataConnectorKind.GENERIC_UI] + name: str + properties: CodelessParameters + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.ConditionClause(TypedDict, total=False): + key "clauseConnective": Union[str, Connective] + key "field": Required[str] + key "operator": Required[Union[str, Operator]] + key "values": Required[list[str]] + clauseConnective: Union[str, Connective] + field: str + operator: Union[str, Operator] + values: list[str] + + + class azure.mgmt.securityinsight.types.ConditionProperties(TypedDict, total=False): + key "clauses": Required[list[ConditionClause]] + key "conditionConnective": Union[str, Connective] + key "stixObjectType": str + clauses: list[ConditionClause] + conditionConnective: Union[str, Connective] + stixObjectType: str + + + class azure.mgmt.securityinsight.types.ConditionType(str, Enum, metaclass=CaseInsensitiveEnumMeta): + BOOLEAN = "Boolean" + PROPERTY = "Property" + PROPERTY_ARRAY = "PropertyArray" + PROPERTY_ARRAY_CHANGED = "PropertyArrayChanged" + PROPERTY_CHANGED = "PropertyChanged" + + + class azure.mgmt.securityinsight.types.ConnectivityCriteria(TypedDict, total=False): + key "type": Union[str, ConnectivityType] + type: Union[str, ConnectivityType] + value: list[str] + + + class azure.mgmt.securityinsight.types.ConnectivityCriterion(TypedDict, total=False): + key "type": Required[str] + type: str + value: list[str] + + + class azure.mgmt.securityinsight.types.ConnectorDataType(TypedDict, total=False): + key "lastDataReceivedQuery": Required[str] + key "name": Required[str] + lastDataReceivedQuery: str + name: str + + + class azure.mgmt.securityinsight.types.ConnectorDefinitionsAvailability(TypedDict, total=False): + key "isPreview": bool + key "status": int + isPreview: bool + status: int + + + class azure.mgmt.securityinsight.types.ConnectorDefinitionsPermissions(TypedDict, total=False): + customs: list[CustomPermissionDetails] + licenses: list[str] + resourceProvider: list[ConnectorDefinitionsResourceProvider] + tenant: list[str] + + + class azure.mgmt.securityinsight.types.ConnectorDefinitionsResourceProvider(TypedDict, total=False): + key "permissionsDisplayText": Required[str] + key "provider": Required[str] + key "providerDisplayName": Required[str] + key "requiredPermissions": Required[ResourceProviderRequiredPermissions] + key "scope": Required[Union[str, ProviderPermissionsScope]] + permissionsDisplayText: str + provider: str + providerDisplayName: str + requiredPermissions: ResourceProviderRequiredPermissions + scope: Union[str, ProviderPermissionsScope] + + + class azure.mgmt.securityinsight.types.ConnectorInstructionModelBase(TypedDict, total=False): + key "parameters": Any + key "type": Required[Union[str, SettingType]] + parameters: Any + type: Union[str, SettingType] + + + class azure.mgmt.securityinsight.types.CountQuery(TypedDict, total=False): + key "properties": ForwardRef('QueryProperties', module='types') + properties: QueryProperties + + + class azure.mgmt.securityinsight.types.CustomEntityQuery(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[CustomEntityQueryKind.ACTIVITY]] + key "name": str + key "properties": ForwardRef('ActivityEntityQueriesProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[CustomEntityQueryKind.ACTIVITY] + name: str + properties: ActivityEntityQueriesProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.CustomEntityQueryKind(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ACTIVITY = "Activity" + + + class azure.mgmt.securityinsight.types.CustomPermissionDetails(TypedDict, total=False): + key "description": Required[str] + key "name": Required[str] + description: str + name: str + + + class azure.mgmt.securityinsight.types.CustomizableConnectionsConfig(TypedDict, total=False): + key "templateSpecName": Required[str] + key "templateSpecVersion": Required[str] + templateSpecName: str + templateSpecVersion: str + + + class azure.mgmt.securityinsight.types.CustomizableConnectorDefinition(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[DataConnectorDefinitionKind.CUSTOMIZABLE]] + key "name": str + key "properties": ForwardRef('CustomizableConnectorDefinitionProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[DataConnectorDefinitionKind.CUSTOMIZABLE] + name: str + properties: CustomizableConnectorDefinitionProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.CustomizableConnectorDefinitionProperties(TypedDict, total=False): + key "connectionsConfig": ForwardRef('CustomizableConnectionsConfig', module='types') + key "connectorUiConfig": Required[CustomizableConnectorUiConfig] + key "createdTimeUtc": str + key "lastModifiedUtc": str + connectionsConfig: CustomizableConnectionsConfig + connectorUiConfig: CustomizableConnectorUiConfig + createdTimeUtc: str + lastModifiedUtc: str + + + class azure.mgmt.securityinsight.types.CustomizableConnectorUiConfig(TypedDict, total=False): + key "availability": ForwardRef('ConnectorDefinitionsAvailability', module='types') + key "connectivityCriteria": Required[list[ConnectivityCriterion]] + key "dataTypes": Required[list[ConnectorDataType]] + key "descriptionMarkdown": Required[str] + key "graphQueries": Required[list[GraphQuery]] + key "id": str + key "instructionSteps": Required[list[InstructionStep]] + key "isConnectivityCriteriasMatchSome": bool + key "logo": str + key "permissions": Required[ConnectorDefinitionsPermissions] + key "publisher": Required[str] + key "title": Required[str] + availability: ConnectorDefinitionsAvailability + connectivityCriteria: list[ConnectivityCriterion] + dataTypes: list[ConnectorDataType] + descriptionMarkdown: str + graphQueries: list[GraphQuery] + id: str + instructionSteps: list[InstructionStep] + isConnectivityCriteriasMatchSome: bool + logo: str + permissions: ConnectorDefinitionsPermissions + publisher: str + title: str + + + class azure.mgmt.securityinsight.types.Customs(CustomsPermission): + key "description": str + key "name": str + description: str + name: str + + + class azure.mgmt.securityinsight.types.CustomsPermission(TypedDict, total=False): + key "description": str + key "name": str + description: str + name: str + + + class azure.mgmt.securityinsight.types.DCRConfiguration(TypedDict, total=False): + key "dataCollectionEndpoint": Required[str] + key "dataCollectionRuleImmutableId": Required[str] + key "streamName": Required[str] + dataCollectionEndpoint: str + dataCollectionRuleImmutableId: str + streamName: str + + + class azure.mgmt.securityinsight.types.DataConnectorConnectBody(TypedDict, total=False): + key "apiKey": str + key "authorizationCode": str + key "clientId": str + key "clientSecret": str + key "dataCollectionEndpoint": str + key "dataCollectionRuleImmutableId": str + key "kind": Union[str, ConnectAuthKind] + key "outputStream": str + key "password": str + key "userName": str + apiKey: str + authorizationCode: str + clientId: str + clientSecret: str + dataCollectionEndpoint: str + dataCollectionRuleImmutableId: str + kind: Union[str, ConnectAuthKind] + outputStream: str + password: str + requestConfigUserInputValues: list[Any] + userName: str + + + class azure.mgmt.securityinsight.types.DataConnectorDataTypeCommon(TypedDict, total=False): + key "state": Required[Union[str, DataTypeState]] + state: Union[str, DataTypeState] + + + class azure.mgmt.securityinsight.types.DataConnectorDefinition(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[DataConnectorDefinitionKind.CUSTOMIZABLE]] + key "name": str + key "properties": ForwardRef('CustomizableConnectorDefinitionProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[DataConnectorDefinitionKind.CUSTOMIZABLE] + name: str + properties: CustomizableConnectorDefinitionProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.DataConnectorDefinitionKind(str, Enum, metaclass=CaseInsensitiveEnumMeta): + CUSTOMIZABLE = "Customizable" + + + class azure.mgmt.securityinsight.types.DataConnectorKind(str, Enum, metaclass=CaseInsensitiveEnumMeta): + AMAZON_WEB_SERVICES_CLOUD_TRAIL = "AmazonWebServicesCloudTrail" + AMAZON_WEB_SERVICES_S3 = "AmazonWebServicesS3" + API_POLLING = "APIPolling" + AZURE_ACTIVE_DIRECTORY = "AzureActiveDirectory" + AZURE_ADVANCED_THREAT_PROTECTION = "AzureAdvancedThreatProtection" + AZURE_SECURITY_CENTER = "AzureSecurityCenter" + DYNAMICS365 = "Dynamics365" + GCP = "GCP" + GENERIC_UI = "GenericUI" + IOT = "IOT" + MICROSOFT_CLOUD_APP_SECURITY = "MicrosoftCloudAppSecurity" + MICROSOFT_DEFENDER_ADVANCED_THREAT_PROTECTION = "MicrosoftDefenderAdvancedThreatProtection" + MICROSOFT_PURVIEW_INFORMATION_PROTECTION = "MicrosoftPurviewInformationProtection" + MICROSOFT_THREAT_INTELLIGENCE = "MicrosoftThreatIntelligence" + MICROSOFT_THREAT_PROTECTION = "MicrosoftThreatProtection" + OFFICE365 = "Office365" + OFFICE365_PROJECT = "Office365Project" + OFFICE_ATP = "OfficeATP" + OFFICE_IRM = "OfficeIRM" + OFFICE_POWER_BI = "OfficePowerBI" + PREMIUM_MICROSOFT_DEFENDER_FOR_THREAT_INTELLIGENCE = "PremiumMicrosoftDefenderForThreatIntelligence" + PURVIEW_AUDIT = "PurviewAudit" + REST_API_POLLER = "RestApiPoller" + THREAT_INTELLIGENCE = "ThreatIntelligence" + THREAT_INTELLIGENCE_TAXII = "ThreatIntelligenceTaxii" + + + class azure.mgmt.securityinsight.types.DataConnectorTenantId(TypedDict, total=False): + key "tenantId": Required[str] + tenantId: str + + + class azure.mgmt.securityinsight.types.DataConnectorWithAlertsProperties(TypedDict, total=False): + key "dataTypes": ForwardRef('AlertsDataTypeOfDataConnector', module='types') + dataTypes: AlertsDataTypeOfDataConnector + + + class azure.mgmt.securityinsight.types.Deployment(TypedDict, total=False): + key "deploymentId": str + key "deploymentLogsUrl": str + key "deploymentResult": Union[str, DeploymentResult] + key "deploymentState": Union[str, DeploymentState] + key "deploymentTime": str + deploymentId: str + deploymentLogsUrl: str + deploymentResult: Union[str, DeploymentResult] + deploymentState: Union[str, DeploymentState] + deploymentTime: str + + + class azure.mgmt.securityinsight.types.DeploymentInfo(TypedDict, total=False): + key "deployment": ForwardRef('Deployment', module='types') + key "deploymentFetchStatus": Union[str, DeploymentFetchStatus] + key "message": str + deployment: Deployment + deploymentFetchStatus: Union[str, DeploymentFetchStatus] + message: str + + + class azure.mgmt.securityinsight.types.Dynamics365CheckRequirements(TypedDict, total=False): + key "kind": Required[Literal[DataConnectorKind.DYNAMICS365]] + key "properties": ForwardRef('Dynamics365CheckRequirementsProperties', module='types') + kind: Literal[DataConnectorKind.DYNAMICS365] + properties: Dynamics365CheckRequirementsProperties + + + class azure.mgmt.securityinsight.types.Dynamics365CheckRequirementsProperties(DataConnectorTenantId): + key "tenantId": Required[str] + tenantId: str + + + class azure.mgmt.securityinsight.types.Dynamics365DataConnector(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[DataConnectorKind.DYNAMICS365]] + key "name": str + key "properties": ForwardRef('Dynamics365DataConnectorProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[DataConnectorKind.DYNAMICS365] + name: str + properties: Dynamics365DataConnectorProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.Dynamics365DataConnectorDataTypes(TypedDict, total=False): + key "dynamics365CdsActivities": Required[Dynamics365DataConnectorDataTypesDynamics365CdsActivities] + dynamics365CdsActivities: Dynamics365DataConnectorDataTypesDynamics365CdsActivities + + + class azure.mgmt.securityinsight.types.Dynamics365DataConnectorDataTypesDynamics365CdsActivities(DataConnectorDataTypeCommon): + key "state": Required[Union[str, DataTypeState]] + state: Union[str, DataTypeState] + + + class azure.mgmt.securityinsight.types.Dynamics365DataConnectorProperties(DataConnectorTenantId): + key "dataTypes": Required[Dynamics365DataConnectorDataTypes] + key "tenantId": Required[str] + dataTypes: Dynamics365DataConnectorDataTypes + tenantId: str + + + class azure.mgmt.securityinsight.types.EnrichmentDomainBody(TypedDict, total=False): + key "domain": str + domain: str + + + class azure.mgmt.securityinsight.types.EnrichmentIpAddressBody(TypedDict, total=False): + key "ipAddress": str + ipAddress: str + + + class azure.mgmt.securityinsight.types.EntityAnalytics(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[SettingKind.ENTITY_ANALYTICS]] + key "name": str + key "properties": ForwardRef('EntityAnalyticsProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[SettingKind.ENTITY_ANALYTICS] + name: str + properties: EntityAnalyticsProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.EntityAnalyticsProperties(TypedDict, total=False): + entityProviders: list[Union[str, EntityProviders]] + + + class azure.mgmt.securityinsight.types.EntityCommonProperties(TypedDict, total=False): + key "friendlyName": str + additionalData: dict[str, Any] + friendlyName: str + + + class azure.mgmt.securityinsight.types.EntityExpandParameters(TypedDict, total=False): + key "endTime": str + key "expansionId": str + key "startTime": str + endTime: str + expansionId: str + startTime: str + + + class azure.mgmt.securityinsight.types.EntityFieldMapping(TypedDict, total=False): + key "identifier": str + key "value": str + identifier: str + value: str + + + class azure.mgmt.securityinsight.types.EntityGetInsightsParameters(TypedDict, total=False): + key "addDefaultExtendedTimeRange": bool + key "endTime": Required[str] + key "startTime": Required[str] + addDefaultExtendedTimeRange: bool + endTime: str + insightQueryIds: list[str] + startTime: str + + + class azure.mgmt.securityinsight.types.EntityManualTriggerRequestBody(TypedDict, total=False): + key "incidentArmId": str + key "logicAppsResourceId": Required[str] + key "tenantId": str + incidentArmId: str + logicAppsResourceId: str + tenantId: str + + + class azure.mgmt.securityinsight.types.EntityMapping(TypedDict, total=False): + key "entityType": Union[str, EntityMappingType] + entityType: Union[str, EntityMappingType] + fieldMappings: list[FieldMapping] + + + class azure.mgmt.securityinsight.types.EntityTimelineParameters(TypedDict, total=False): + key "endTime": Required[str] + key "numberOfBucket": int + key "startTime": Required[str] + endTime: str + kinds: list[Union[str, EntityTimelineKind]] + numberOfBucket: int + startTime: str + + + class azure.mgmt.securityinsight.types.EventGroupingSettings(TypedDict, total=False): + key "aggregationKind": Union[str, EventGroupingAggregationKind] + aggregationKind: Union[str, EventGroupingAggregationKind] + + + class azure.mgmt.securityinsight.types.EyesOn(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[SettingKind.EYES_ON]] + key "name": str + key "properties": ForwardRef('EyesOnSettingsProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[SettingKind.EYES_ON] + name: str + properties: EyesOnSettingsProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.EyesOnSettingsProperties(TypedDict, total=False): + key "isEnabled": bool + isEnabled: bool + + + class azure.mgmt.securityinsight.types.FieldMapping(TypedDict, total=False): + key "columnName": str + key "identifier": str + columnName: str + identifier: str + + + class azure.mgmt.securityinsight.types.FileImport(ProxyResource): + key "id": str + key "name": str + key "properties": ForwardRef('FileImportProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + id: str + name: str + properties: FileImportProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.FileImportProperties(TypedDict, total=False): + key "contentType": Required[Union[str, FileImportContentType]] + key "createdTimeUTC": str + key "errorFile": ForwardRef('FileMetadata', module='types') + key "filesValidUntilTimeUTC": str + key "importFile": Required[FileMetadata] + key "importValidUntilTimeUTC": str + key "ingestedRecordCount": int + key "ingestionMode": Required[Union[str, IngestionMode]] + key "source": Required[str] + key "state": Union[str, FileImportState] + key "totalRecordCount": int + key "validRecordCount": int + contentType: Union[str, FileImportContentType] + createdTimeUTC: str + errorFile: FileMetadata + errorsPreview: list[ValidationError] + filesValidUntilTimeUTC: str + importFile: FileMetadata + importValidUntilTimeUTC: str + ingestedRecordCount: int + ingestionMode: Union[str, IngestionMode] + source: str + state: Union[str, FileImportState] + totalRecordCount: int + validRecordCount: int + + + class azure.mgmt.securityinsight.types.FileMetadata(TypedDict, total=False): + key "deleteStatus": Union[str, DeleteStatus] + key "fileContentUri": str + key "fileFormat": Union[str, FileFormat] + key "fileName": str + key "fileSize": int + deleteStatus: Union[str, DeleteStatus] + fileContentUri: str + fileFormat: Union[str, FileFormat] + fileName: str + fileSize: int + + + class azure.mgmt.securityinsight.types.FusionAlertRule(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[AlertRuleKind.FUSION]] + key "name": str + key "properties": ForwardRef('FusionAlertRuleProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[AlertRuleKind.FUSION] + name: str + properties: FusionAlertRuleProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.FusionAlertRuleProperties(TypedDict, total=False): + key "alertRuleTemplateName": Required[str] + key "description": str + key "displayName": str + key "enabled": Required[bool] + key "lastModifiedUtc": str + key "severity": Union[str, AlertSeverity] + alertRuleTemplateName: str + description: str + displayName: str + enabled: bool + lastModifiedUtc: str + scenarioExclusionPatterns: list[FusionScenarioExclusionPattern] + severity: Union[str, AlertSeverity] + sourceSettings: list[FusionSourceSettings] + subTechniques: list[str] + tactics: list[Union[str, AttackTactic]] + techniques: list[str] + + + class azure.mgmt.securityinsight.types.FusionScenarioExclusionPattern(TypedDict, total=False): + key "dateAddedInUTC": Required[str] + key "exclusionPattern": Required[str] + dateAddedInUTC: str + exclusionPattern: str + + + class azure.mgmt.securityinsight.types.FusionSourceSettings(TypedDict, total=False): + key "enabled": Required[bool] + key "sourceName": Required[str] + enabled: bool + sourceName: str + sourceSubTypes: list[FusionSourceSubTypeSetting] + + + class azure.mgmt.securityinsight.types.FusionSourceSubTypeSetting(TypedDict, total=False): + key "enabled": Required[bool] + key "severityFilters": Required[FusionSubTypeSeverityFilter] + key "sourceSubTypeDisplayName": str + key "sourceSubTypeName": Required[str] + enabled: bool + severityFilters: FusionSubTypeSeverityFilter + sourceSubTypeDisplayName: str + sourceSubTypeName: str + + + class azure.mgmt.securityinsight.types.FusionSubTypeSeverityFilter(TypedDict, total=False): + key "isSupported": bool + filters: list[FusionSubTypeSeverityFiltersItem] + isSupported: bool + + + class azure.mgmt.securityinsight.types.FusionSubTypeSeverityFiltersItem(TypedDict, total=False): + key "enabled": Required[bool] + key "severity": Required[Union[str, AlertSeverity]] + enabled: bool + severity: Union[str, AlertSeverity] + + + class azure.mgmt.securityinsight.types.GCPAuthModel(TypedDict, total=False): + key "projectNumber": Required[str] + key "serviceAccountEmail": Required[str] + key "type": Required[Literal[CcpAuthType.GCP]] + key "workloadIdentityProviderId": Required[str] + projectNumber: str + serviceAccountEmail: str + type: Literal[CcpAuthType.GCP] + workloadIdentityProviderId: str + + + class azure.mgmt.securityinsight.types.GCPAuthProperties(TypedDict, total=False): + key "projectNumber": Required[str] + key "serviceAccountEmail": Required[str] + key "workloadIdentityProviderId": Required[str] + projectNumber: str + serviceAccountEmail: str + workloadIdentityProviderId: str + + + class azure.mgmt.securityinsight.types.GCPDataConnector(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[DataConnectorKind.GCP]] + key "name": str + key "properties": ForwardRef('GCPDataConnectorProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[DataConnectorKind.GCP] + name: str + properties: GCPDataConnectorProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.GCPDataConnectorProperties(TypedDict, total=False): + key "auth": Required[GCPAuthProperties] + key "connectorDefinitionName": Required[str] + key "dcrConfig": ForwardRef('DCRConfiguration', module='types') + key "request": Required[GCPRequestProperties] + auth: GCPAuthProperties + connectorDefinitionName: str + dcrConfig: DCRConfiguration + request: GCPRequestProperties + + + class azure.mgmt.securityinsight.types.GCPRequestProperties(TypedDict, total=False): + key "projectId": Required[str] + key "subscriptionNames": Required[list[str]] + projectId: str + subscriptionNames: list[str] + + + class azure.mgmt.securityinsight.types.GenericBlobSbsAuthModel(TypedDict, total=False): + key "type": Required[Literal[CcpAuthType.SERVICE_BUS]] + credentialsConfig: dict[str, str] + storageAccountCredentialsConfig: dict[str, str] + type: Literal[CcpAuthType.SERVICE_BUS] + + + class azure.mgmt.securityinsight.types.GitHubAuthModel(TypedDict, total=False): + key "installationId": str + key "type": Required[Literal[CcpAuthType.GIT_HUB]] + installationId: str + type: Literal[CcpAuthType.GIT_HUB] + + + class azure.mgmt.securityinsight.types.GitHubResourceInfo(TypedDict, total=False): + key "appInstallationId": str + appInstallationId: str + + + class azure.mgmt.securityinsight.types.GraphQueries(TypedDict, total=False): + key "baseQuery": str + key "legend": str + key "metricName": str + baseQuery: str + legend: str + metricName: str + + + class azure.mgmt.securityinsight.types.GraphQuery(TypedDict, total=False): + key "baseQuery": Required[str] + key "legend": Required[str] + key "metricName": Required[str] + baseQuery: str + legend: str + metricName: str + + + class azure.mgmt.securityinsight.types.GroupingConfiguration(TypedDict, total=False): + key "enabled": Required[bool] + key "lookbackDuration": Required[str] + key "matchingMethod": Required[Union[str, MatchingMethod]] + key "reopenClosedIncident": Required[bool] + enabled: bool + groupByAlertDetails: list[Union[str, AlertDetail]] + groupByCustomDetails: list[str] + groupByEntities: list[Union[str, EntityMappingType]] + lookbackDuration: str + matchingMethod: Union[str, MatchingMethod] + reopenClosedIncident: bool + + + class azure.mgmt.securityinsight.types.Hunt(ProxyResource): + key "etag": str + key "id": str + key "name": str + key "properties": ForwardRef('HuntProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + name: str + properties: HuntProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.HuntComment(ProxyResource): + key "etag": str + key "id": str + key "name": str + key "properties": ForwardRef('HuntCommentProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + name: str + properties: HuntCommentProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.HuntCommentProperties(TypedDict, total=False): + key "message": Required[str] + message: str + + + class azure.mgmt.securityinsight.types.HuntOwner(TypedDict, total=False): + key "assignedTo": str + key "email": str + key "objectId": Optional[str] + key "ownerType": Union[str, OwnerType] + key "userPrincipalName": str + assignedTo: str + email: str + objectId: str + ownerType: Union[str, OwnerType] + userPrincipalName: str + + + class azure.mgmt.securityinsight.types.HuntProperties(TypedDict, total=False): + key "description": Required[str] + key "displayName": Required[str] + key "hypothesisStatus": Union[str, HypothesisStatus] + key "owner": ForwardRef('HuntOwner', module='types') + key "status": Union[str, Status] + attackTactics: list[Union[str, AttackTactic]] + attackTechniques: list[str] + description: str + displayName: str + hypothesisStatus: Union[str, HypothesisStatus] + labels: list[str] + owner: HuntOwner + status: Union[str, Status] + + + class azure.mgmt.securityinsight.types.HuntRelation(ProxyResource): + key "id": str + key "name": str + key "properties": ForwardRef('HuntRelationProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + id: str + name: str + properties: HuntRelationProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.HuntRelationProperties(TypedDict, total=False): + key "relatedResourceId": Required[str] + key "relatedResourceKind": str + key "relatedResourceName": str + key "relationType": str + labels: list[str] + relatedResourceId: str + relatedResourceKind: str + relatedResourceName: str + relationType: str + + + class azure.mgmt.securityinsight.types.Incident(ProxyResource): + key "etag": str + key "id": str + key "name": str + key "properties": ForwardRef('IncidentProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + name: str + properties: IncidentProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.IncidentAdditionalData(TypedDict, total=False): + key "alertsCount": int + key "bookmarksCount": int + key "commentsCount": int + key "mergedIncidentNumber": str + key "mergedIncidentUrl": str + key "providerIncidentUrl": str + alertProductNames: list[str] + alertsCount: int + bookmarksCount: int + commentsCount: int + mergedIncidentNumber: str + mergedIncidentUrl: str + providerIncidentUrl: str + tactics: list[Union[str, AttackTactic]] + techniques: list[str] + + + class azure.mgmt.securityinsight.types.IncidentComment(ProxyResource): + key "etag": str + key "id": str + key "name": str + key "properties": ForwardRef('IncidentCommentProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + name: str + properties: IncidentCommentProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.IncidentCommentProperties(TypedDict, total=False): + key "author": ForwardRef('ClientInfo', module='types') + key "createdTimeUtc": str + key "lastModifiedTimeUtc": str + key "message": Required[str] + author: ClientInfo + createdTimeUtc: str + lastModifiedTimeUtc: str + message: str + + + class azure.mgmt.securityinsight.types.IncidentConfiguration(TypedDict, total=False): + key "createIncident": Required[bool] + key "groupingConfiguration": ForwardRef('GroupingConfiguration', module='types') + createIncident: bool + groupingConfiguration: GroupingConfiguration + + + class azure.mgmt.securityinsight.types.IncidentInfo(TypedDict, total=False): + key "incidentId": str + key "relationName": str + key "severity": Union[str, IncidentSeverity] + key "title": str + incidentId: str + relationName: str + severity: Union[str, IncidentSeverity] + title: str + + + class azure.mgmt.securityinsight.types.IncidentLabel(TypedDict, total=False): + key "labelName": Required[str] + key "labelType": Union[str, IncidentLabelType] + labelName: str + labelType: Union[str, IncidentLabelType] + + + class azure.mgmt.securityinsight.types.IncidentOwnerInfo(TypedDict, total=False): + key "assignedTo": str + key "email": str + key "objectId": str + key "ownerType": Union[str, OwnerType] + key "userPrincipalName": str + assignedTo: str + email: str + objectId: str + ownerType: Union[str, OwnerType] + userPrincipalName: str + + + class azure.mgmt.securityinsight.types.IncidentProperties(TypedDict, total=False): + key "additionalData": ForwardRef('IncidentAdditionalData', module='types') + key "classification": Union[str, IncidentClassification] + key "classificationComment": str + key "classificationReason": Union[str, IncidentClassificationReason] + key "createdTimeUtc": str + key "description": str + key "firstActivityTimeUtc": str + key "incidentNumber": int + key "incidentUrl": str + key "lastActivityTimeUtc": str + key "lastModifiedTimeUtc": str + key "owner": ForwardRef('IncidentOwnerInfo', module='types') + key "providerIncidentId": str + key "providerName": str + key "severity": Required[Union[str, IncidentSeverity]] + key "status": Required[Union[str, IncidentStatus]] + key "teamInformation": ForwardRef('TeamInformation', module='types') + key "title": Required[str] + additionalData: IncidentAdditionalData + classification: Union[str, IncidentClassification] + classificationComment: str + classificationReason: Union[str, IncidentClassificationReason] + createdTimeUtc: str + description: str + firstActivityTimeUtc: str + incidentNumber: int + incidentUrl: str + labels: list[IncidentLabel] + lastActivityTimeUtc: str + lastModifiedTimeUtc: str + owner: IncidentOwnerInfo + providerIncidentId: str + providerName: str + relatedAnalyticRuleIds: list[str] + severity: Union[str, IncidentSeverity] + status: Union[str, IncidentStatus] + teamInformation: TeamInformation + title: str + + + class azure.mgmt.securityinsight.types.IncidentPropertiesAction(TypedDict, total=False): + key "classification": Union[str, IncidentClassification] + key "classificationComment": str + key "classificationReason": Union[str, IncidentClassificationReason] + key "owner": ForwardRef('IncidentOwnerInfo', module='types') + key "severity": Union[str, IncidentSeverity] + key "status": Union[str, IncidentStatus] + classification: Union[str, IncidentClassification] + classificationComment: str + classificationReason: Union[str, IncidentClassificationReason] + labels: list[IncidentLabel] + owner: IncidentOwnerInfo + severity: Union[str, IncidentSeverity] + status: Union[str, IncidentStatus] + + + class azure.mgmt.securityinsight.types.IncidentTask(ProxyResource): + key "etag": str + key "id": str + key "name": str + key "properties": Required[IncidentTaskProperties] + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + name: str + properties: IncidentTaskProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.IncidentTaskProperties(TypedDict, total=False): + key "createdBy": ForwardRef('ClientInfo', module='types') + key "createdTimeUtc": str + key "description": str + key "lastModifiedBy": ForwardRef('ClientInfo', module='types') + key "lastModifiedTimeUtc": str + key "status": Required[Union[str, IncidentTaskStatus]] + key "title": Required[str] + createdBy: ClientInfo + createdTimeUtc: str + description: str + lastModifiedBy: ClientInfo + lastModifiedTimeUtc: str + status: Union[str, IncidentTaskStatus] + title: str + + + class azure.mgmt.securityinsight.types.InstructionStep(TypedDict, total=False): + key "description": str + key "title": str + description: str + innerSteps: list[InstructionStep] + instructions: list[InstructionStepDetails] + title: str + + + class azure.mgmt.securityinsight.types.InstructionStepDetails(TypedDict, total=False): + key "parameters": Required[Any] + key "type": Required[str] + parameters: Any + type: str + + + class azure.mgmt.securityinsight.types.InstructionSteps(TypedDict, total=False): + key "description": str + key "title": str + description: str + instructions: list[InstructionStepsInstructionsItem] + title: str + + + class azure.mgmt.securityinsight.types.InstructionStepsInstructionsItem(ConnectorInstructionModelBase): + key "parameters": Any + key "type": Required[Union[str, SettingType]] + parameters: Any + type: Union[str, SettingType] + + + class azure.mgmt.securityinsight.types.IoTCheckRequirements(TypedDict, total=False): + key "kind": Required[Literal[DataConnectorKind.IOT]] + key "properties": ForwardRef('IoTCheckRequirementsProperties', module='types') + kind: Literal[DataConnectorKind.IOT] + properties: IoTCheckRequirementsProperties + + + class azure.mgmt.securityinsight.types.IoTCheckRequirementsProperties(TypedDict, total=False): + key "subscriptionId": str + subscriptionId: str + + + class azure.mgmt.securityinsight.types.IoTDataConnector(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[DataConnectorKind.IOT]] + key "name": str + key "properties": ForwardRef('IoTDataConnectorProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[DataConnectorKind.IOT] + name: str + properties: IoTDataConnectorProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.IoTDataConnectorProperties(DataConnectorWithAlertsProperties): + key "dataTypes": ForwardRef('AlertsDataTypeOfDataConnector', module='types') + key "subscriptionId": str + dataTypes: AlertsDataTypeOfDataConnector + subscriptionId: str + + + class azure.mgmt.securityinsight.types.JwtAuthModel(TypedDict, total=False): + key "isCredentialsInHeaders": Optional[bool] + key "isJsonRequest": Optional[bool] + key "password": Required[dict[str, str]] + key "requestTimeoutInSeconds": int + key "tokenEndpoint": Required[str] + key "type": Required[Literal[CcpAuthType.JWT_TOKEN]] + key "userName": Required[dict[str, str]] + headers: dict[str, str] + isCredentialsInHeaders: bool + isJsonRequest: bool + password: dict[str, str] + queryParameters: dict[str, str] + requestTimeoutInSeconds: int + tokenEndpoint: str + type: Literal[CcpAuthType.JWT_TOKEN] + userName: dict[str, str] + + + class azure.mgmt.securityinsight.types.LastDataReceivedDataType(TypedDict, total=False): + key "lastDataReceivedQuery": str + key "name": str + lastDataReceivedQuery: str + name: str + + + class azure.mgmt.securityinsight.types.MCASCheckRequirements(TypedDict, total=False): + key "kind": Required[Literal[DataConnectorKind.MICROSOFT_CLOUD_APP_SECURITY]] + key "properties": ForwardRef('MCASCheckRequirementsProperties', module='types') + kind: Literal[DataConnectorKind.MICROSOFT_CLOUD_APP_SECURITY] + properties: MCASCheckRequirementsProperties + + + class azure.mgmt.securityinsight.types.MCASCheckRequirementsProperties(DataConnectorTenantId): + key "tenantId": Required[str] + tenantId: str + + + class azure.mgmt.securityinsight.types.MCASDataConnector(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[DataConnectorKind.MICROSOFT_CLOUD_APP_SECURITY]] + key "name": str + key "properties": ForwardRef('MCASDataConnectorProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[DataConnectorKind.MICROSOFT_CLOUD_APP_SECURITY] + name: str + properties: MCASDataConnectorProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.MCASDataConnectorDataTypes(AlertsDataTypeOfDataConnector): + key "alerts": Required[DataConnectorDataTypeCommon] + key "discoveryLogs": ForwardRef('DataConnectorDataTypeCommon', module='types') + alerts: DataConnectorDataTypeCommon + discoveryLogs: DataConnectorDataTypeCommon + + + class azure.mgmt.securityinsight.types.MCASDataConnectorProperties(DataConnectorTenantId): + key "dataTypes": Required[MCASDataConnectorDataTypes] + key "tenantId": Required[str] + dataTypes: MCASDataConnectorDataTypes + tenantId: str + + + class azure.mgmt.securityinsight.types.MDATPCheckRequirements(TypedDict, total=False): + key "kind": Required[Literal[DataConnectorKind.MICROSOFT_DEFENDER_ADVANCED_THREAT_PROTECTION]] + key "properties": ForwardRef('MDATPCheckRequirementsProperties', module='types') + kind: Literal[DataConnectorKind.MICROSOFT_DEFENDER_ADVANCED_THREAT_PROTECTION] + properties: MDATPCheckRequirementsProperties + + + class azure.mgmt.securityinsight.types.MDATPCheckRequirementsProperties(DataConnectorTenantId): + key "tenantId": Required[str] + tenantId: str + + + class azure.mgmt.securityinsight.types.MDATPDataConnector(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[DataConnectorKind.MICROSOFT_DEFENDER_ADVANCED_THREAT_PROTECTION]] + key "name": str + key "properties": ForwardRef('MDATPDataConnectorProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[DataConnectorKind.MICROSOFT_DEFENDER_ADVANCED_THREAT_PROTECTION] + name: str + properties: MDATPDataConnectorProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.MDATPDataConnectorProperties(TypedDict, total=False): + key "dataTypes": ForwardRef('AlertsDataTypeOfDataConnector', module='types') + key "tenantId": Required[str] + dataTypes: AlertsDataTypeOfDataConnector + tenantId: str + + + class azure.mgmt.securityinsight.types.MLBehaviorAnalyticsAlertRule(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[AlertRuleKind.ML_BEHAVIOR_ANALYTICS]] + key "name": str + key "properties": ForwardRef('MLBehaviorAnalyticsAlertRuleProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[AlertRuleKind.ML_BEHAVIOR_ANALYTICS] + name: str + properties: MLBehaviorAnalyticsAlertRuleProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.MLBehaviorAnalyticsAlertRuleProperties(TypedDict, total=False): + key "alertRuleTemplateName": Required[str] + key "description": str + key "displayName": str + key "enabled": Required[bool] + key "lastModifiedUtc": str + key "severity": Union[str, AlertSeverity] + alertRuleTemplateName: str + description: str + displayName: str + enabled: bool + lastModifiedUtc: str + severity: Union[str, AlertSeverity] + subTechniques: list[str] + tactics: list[Union[str, AttackTactic]] + techniques: list[str] + + + class azure.mgmt.securityinsight.types.MSTICheckRequirements(TypedDict, total=False): + key "kind": Required[Literal[DataConnectorKind.MICROSOFT_THREAT_INTELLIGENCE]] + key "properties": ForwardRef('MSTICheckRequirementsProperties', module='types') + kind: Literal[DataConnectorKind.MICROSOFT_THREAT_INTELLIGENCE] + properties: MSTICheckRequirementsProperties + + + class azure.mgmt.securityinsight.types.MSTICheckRequirementsProperties(DataConnectorTenantId): + key "tenantId": Required[str] + tenantId: str + + + class azure.mgmt.securityinsight.types.MSTIDataConnector(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[DataConnectorKind.MICROSOFT_THREAT_INTELLIGENCE]] + key "name": str + key "properties": ForwardRef('MSTIDataConnectorProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[DataConnectorKind.MICROSOFT_THREAT_INTELLIGENCE] + name: str + properties: MSTIDataConnectorProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.MSTIDataConnectorDataTypes(TypedDict, total=False): + key "microsoftEmergingThreatFeed": Required[MSTIDataConnectorDataTypesMicrosoftEmergingThreatFeed] + microsoftEmergingThreatFeed: MSTIDataConnectorDataTypesMicrosoftEmergingThreatFeed + + + class azure.mgmt.securityinsight.types.MSTIDataConnectorDataTypesMicrosoftEmergingThreatFeed(DataConnectorDataTypeCommon): + key "lookbackPeriod": Required[str] + key "state": Required[Union[str, DataTypeState]] + lookbackPeriod: str + state: Union[str, DataTypeState] + + + class azure.mgmt.securityinsight.types.MSTIDataConnectorProperties(DataConnectorTenantId): + key "dataTypes": Required[MSTIDataConnectorDataTypes] + key "tenantId": Required[str] + dataTypes: MSTIDataConnectorDataTypes + tenantId: str + + + class azure.mgmt.securityinsight.types.MTPCheckRequirementsProperties(DataConnectorTenantId): + key "tenantId": Required[str] + tenantId: str + + + class azure.mgmt.securityinsight.types.MTPDataConnector(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[DataConnectorKind.MICROSOFT_THREAT_PROTECTION]] + key "name": str + key "properties": ForwardRef('MTPDataConnectorProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[DataConnectorKind.MICROSOFT_THREAT_PROTECTION] + name: str + properties: MTPDataConnectorProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.MTPDataConnectorDataTypes(TypedDict, total=False): + key "alerts": ForwardRef('MTPDataConnectorDataTypesAlerts', module='types') + key "incidents": Required[MTPDataConnectorDataTypesIncidents] + alerts: MTPDataConnectorDataTypesAlerts + incidents: MTPDataConnectorDataTypesIncidents + + + class azure.mgmt.securityinsight.types.MTPDataConnectorDataTypesAlerts(DataConnectorDataTypeCommon): + key "state": Required[Union[str, DataTypeState]] + state: Union[str, DataTypeState] + + + class azure.mgmt.securityinsight.types.MTPDataConnectorDataTypesIncidents(DataConnectorDataTypeCommon): + key "state": Required[Union[str, DataTypeState]] + state: Union[str, DataTypeState] + + + class azure.mgmt.securityinsight.types.MTPDataConnectorProperties(DataConnectorTenantId): + key "dataTypes": Required[MTPDataConnectorDataTypes] + key "filteredProviders": ForwardRef('MtpFilteredProviders', module='types') + key "tenantId": Required[str] + dataTypes: MTPDataConnectorDataTypes + filteredProviders: MtpFilteredProviders + tenantId: str + + + class azure.mgmt.securityinsight.types.ManualTriggerRequestBody(TypedDict, total=False): + key "logicAppsResourceId": Required[str] + key "tenantId": str + logicAppsResourceId: str + tenantId: str + + + class azure.mgmt.securityinsight.types.MetadataAuthor(TypedDict, total=False): + key "email": str + key "link": str + key "name": str + email: str + link: str + name: str + + + class azure.mgmt.securityinsight.types.MetadataCategories(TypedDict, total=False): + domains: list[str] + verticals: list[str] + + + class azure.mgmt.securityinsight.types.MetadataDependencies(TypedDict, total=False): + key "contentId": str + key "kind": Union[str, Kind] + key "name": str + key "operator": Union[str, MetadataDependencyOperator] + key "version": str + contentId: str + criteria: list[MetadataDependencies] + kind: Union[str, Kind] + name: str + operator: Union[str, MetadataDependencyOperator] + version: str + + + class azure.mgmt.securityinsight.types.MetadataModel(ProxyResource): + key "etag": str + key "id": str + key "name": str + key "properties": ForwardRef('MetadataProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + name: str + properties: MetadataProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.MetadataPatch(ResourceWithEtag): + key "etag": str + key "id": str + key "name": str + key "properties": ForwardRef('MetadataPropertiesPatch', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + name: str + properties: MetadataPropertiesPatch + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.MetadataProperties(TypedDict, total=False): + key "author": ForwardRef('MetadataAuthor', module='types') + key "categories": ForwardRef('MetadataCategories', module='types') + key "contentId": str + key "contentSchemaVersion": str + key "customVersion": str + key "dependencies": ForwardRef('MetadataDependencies', module='types') + key "firstPublishDate": str + key "icon": str + key "kind": Required[str] + key "lastPublishDate": str + key "parentId": Required[str] + key "source": ForwardRef('MetadataSource', module='types') + key "support": ForwardRef('MetadataSupport', module='types') + key "version": str + author: MetadataAuthor + categories: MetadataCategories + contentId: str + contentSchemaVersion: str + customVersion: str + dependencies: MetadataDependencies + firstPublishDate: str + icon: str + kind: str + lastPublishDate: str + parentId: str + previewImages: list[str] + previewImagesDark: list[str] + providers: list[str] + source: MetadataSource + support: MetadataSupport + threatAnalysisTactics: list[str] + threatAnalysisTechniques: list[str] + version: str + + + class azure.mgmt.securityinsight.types.MetadataPropertiesPatch(TypedDict, total=False): + key "author": ForwardRef('MetadataAuthor', module='types') + key "categories": ForwardRef('MetadataCategories', module='types') + key "contentId": str + key "contentSchemaVersion": str + key "customVersion": str + key "dependencies": ForwardRef('MetadataDependencies', module='types') + key "firstPublishDate": str + key "icon": str + key "kind": str + key "lastPublishDate": str + key "parentId": str + key "source": ForwardRef('MetadataSource', module='types') + key "support": ForwardRef('MetadataSupport', module='types') + key "version": str + author: MetadataAuthor + categories: MetadataCategories + contentId: str + contentSchemaVersion: str + customVersion: str + dependencies: MetadataDependencies + firstPublishDate: str + icon: str + kind: str + lastPublishDate: str + parentId: str + previewImages: list[str] + previewImagesDark: list[str] + providers: list[str] + source: MetadataSource + support: MetadataSupport + threatAnalysisTactics: list[str] + threatAnalysisTechniques: list[str] + version: str + + + class azure.mgmt.securityinsight.types.MetadataSource(TypedDict, total=False): + key "kind": Required[Union[str, SourceKind]] + key "name": str + key "sourceId": str + kind: Union[str, SourceKind] + name: str + sourceId: str + + + class azure.mgmt.securityinsight.types.MetadataSupport(TypedDict, total=False): + key "email": str + key "link": str + key "name": str + key "tier": Required[Union[str, SupportTier]] + email: str + link: str + name: str + tier: Union[str, SupportTier] + + + class azure.mgmt.securityinsight.types.MicrosoftPurviewInformationProtectionCheckRequirements(TypedDict, total=False): + key "kind": Required[Literal[DataConnectorKind.MICROSOFT_PURVIEW_INFORMATION_PROTECTION]] + key "properties": ForwardRef('MicrosoftPurviewInformationProtectionCheckRequirementsProperties', module='types') + kind: Literal[DataConnectorKind.MICROSOFT_PURVIEW_INFORMATION_PROTECTION] + properties: MicrosoftPurviewInformationProtectionCheckRequirementsProperties + + + class azure.mgmt.securityinsight.types.MicrosoftPurviewInformationProtectionCheckRequirementsProperties(DataConnectorTenantId): + key "tenantId": Required[str] + tenantId: str + + + class azure.mgmt.securityinsight.types.MicrosoftPurviewInformationProtectionConnectorDataTypes(TypedDict, total=False): + key "logs": Required[MicrosoftPurviewInformationProtectionConnectorDataTypesLogs] + logs: MicrosoftPurviewInformationProtectionConnectorDataTypesLogs + + + class azure.mgmt.securityinsight.types.MicrosoftPurviewInformationProtectionConnectorDataTypesLogs(DataConnectorDataTypeCommon): + key "state": Required[Union[str, DataTypeState]] + state: Union[str, DataTypeState] + + + class azure.mgmt.securityinsight.types.MicrosoftPurviewInformationProtectionDataConnector(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[DataConnectorKind.MICROSOFT_PURVIEW_INFORMATION_PROTECTION]] + key "name": str + key "properties": ForwardRef('MicrosoftPurviewInformationProtectionDataConnectorProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[DataConnectorKind.MICROSOFT_PURVIEW_INFORMATION_PROTECTION] + name: str + properties: MicrosoftPurviewInformationProtectionDataConnectorProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.MicrosoftPurviewInformationProtectionDataConnectorProperties(DataConnectorTenantId): + key "dataTypes": Required[MicrosoftPurviewInformationProtectionConnectorDataTypes] + key "tenantId": Required[str] + dataTypes: MicrosoftPurviewInformationProtectionConnectorDataTypes + tenantId: str + + + class azure.mgmt.securityinsight.types.MicrosoftSecurityIncidentCreationAlertRule(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[AlertRuleKind.MICROSOFT_SECURITY_INCIDENT_CREATION]] + key "name": str + key "properties": ForwardRef('MicrosoftSecurityIncidentCreationAlertRuleProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[AlertRuleKind.MICROSOFT_SECURITY_INCIDENT_CREATION] + name: str + properties: MicrosoftSecurityIncidentCreationAlertRuleProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.MicrosoftSecurityIncidentCreationAlertRuleCommonProperties(TypedDict, total=False): + key "productFilter": Required[Union[str, MicrosoftSecurityProductName]] + displayNamesExcludeFilter: list[str] + displayNamesFilter: list[str] + productFilter: Union[str, MicrosoftSecurityProductName] + severitiesFilter: list[Union[str, AlertSeverity]] + + + class azure.mgmt.securityinsight.types.MicrosoftSecurityIncidentCreationAlertRuleProperties(MicrosoftSecurityIncidentCreationAlertRuleCommonProperties): + key "alertRuleTemplateName": str + key "description": str + key "displayName": Required[str] + key "enabled": Required[bool] + key "lastModifiedUtc": str + key "productFilter": Required[Union[str, MicrosoftSecurityProductName]] + alertRuleTemplateName: str + description: str + displayName: str + displayNamesExcludeFilter: list[str] + displayNamesFilter: list[str] + enabled: bool + lastModifiedUtc: str + productFilter: Union[str, MicrosoftSecurityProductName] + severitiesFilter: list[Union[str, AlertSeverity]] + + + class azure.mgmt.securityinsight.types.MtpCheckRequirements(TypedDict, total=False): + key "kind": Required[Literal[DataConnectorKind.MICROSOFT_THREAT_PROTECTION]] + key "properties": ForwardRef('MTPCheckRequirementsProperties', module='types') + kind: Literal[DataConnectorKind.MICROSOFT_THREAT_PROTECTION] + properties: MTPCheckRequirementsProperties + + + class azure.mgmt.securityinsight.types.MtpFilteredProviders(TypedDict, total=False): + key "alerts": Required[list[Union[str, MtpProvider]]] + alerts: list[Union[str, MtpProvider]] + + + class azure.mgmt.securityinsight.types.NoneAuthModel(TypedDict, total=False): + key "type": Required[Literal[CcpAuthType.NONE]] + type: Literal[CcpAuthType.NONE] + + + class azure.mgmt.securityinsight.types.NrtAlertRule(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[AlertRuleKind.NRT]] + key "name": str + key "properties": ForwardRef('NrtAlertRuleProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[AlertRuleKind.NRT] + name: str + properties: NrtAlertRuleProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.NrtAlertRuleProperties(TypedDict, total=False): + key "alertDetailsOverride": ForwardRef('AlertDetailsOverride', module='types') + key "alertRuleTemplateName": str + key "description": str + key "displayName": Required[str] + key "enabled": Required[bool] + key "eventGroupingSettings": ForwardRef('EventGroupingSettings', module='types') + key "incidentConfiguration": ForwardRef('IncidentConfiguration', module='types') + key "lastModifiedUtc": str + key "query": Required[str] + key "severity": Required[Union[str, AlertSeverity]] + key "suppressionDuration": Required[str] + key "suppressionEnabled": Required[bool] + key "templateVersion": str + alertDetailsOverride: AlertDetailsOverride + alertRuleTemplateName: str + customDetails: dict[str, str] + description: str + displayName: str + enabled: bool + entityMappings: list[EntityMapping] + eventGroupingSettings: EventGroupingSettings + incidentConfiguration: IncidentConfiguration + lastModifiedUtc: str + query: str + sentinelEntitiesMappings: list[SentinelEntityMapping] + severity: Union[str, AlertSeverity] + subTechniques: list[str] + suppressionDuration: str + suppressionEnabled: bool + tactics: list[Union[str, AttackTactic]] + techniques: list[str] + templateVersion: str + + + class azure.mgmt.securityinsight.types.OAuthModel(TypedDict, total=False): + key "accessTokenPrepend": str + key "authorizationCode": str + key "authorizationEndpoint": str + key "clientId": Required[str] + key "clientSecret": Required[str] + key "grantType": Required[str] + key "isCredentialsInHeaders": Optional[bool] + key "isJwtBearerFlow": bool + key "redirectUri": str + key "scope": str + key "tokenEndpoint": Required[str] + key "type": Required[Literal[CcpAuthType.O_AUTH2]] + accessTokenPrepend: str + authorizationCode: str + authorizationEndpoint: str + authorizationEndpointHeaders: dict[str, str] + authorizationEndpointQueryParameters: dict[str, str] + clientId: str + clientSecret: str + grantType: str + isCredentialsInHeaders: bool + isJwtBearerFlow: bool + redirectUri: str + scope: str + tokenEndpoint: str + tokenEndpointHeaders: dict[str, str] + tokenEndpointQueryParameters: dict[str, str] + type: Literal[CcpAuthType.O_AUTH2] + + + class azure.mgmt.securityinsight.types.Office365ProjectCheckRequirements(TypedDict, total=False): + key "kind": Required[Literal[DataConnectorKind.OFFICE365_PROJECT]] + key "properties": ForwardRef('Office365ProjectCheckRequirementsProperties', module='types') + kind: Literal[DataConnectorKind.OFFICE365_PROJECT] + properties: Office365ProjectCheckRequirementsProperties + + + class azure.mgmt.securityinsight.types.Office365ProjectCheckRequirementsProperties(DataConnectorTenantId): + key "tenantId": Required[str] + tenantId: str + + + class azure.mgmt.securityinsight.types.Office365ProjectConnectorDataTypes(TypedDict, total=False): + key "logs": Required[Office365ProjectConnectorDataTypesLogs] + logs: Office365ProjectConnectorDataTypesLogs + + + class azure.mgmt.securityinsight.types.Office365ProjectConnectorDataTypesLogs(DataConnectorDataTypeCommon): + key "state": Required[Union[str, DataTypeState]] + state: Union[str, DataTypeState] + + + class azure.mgmt.securityinsight.types.Office365ProjectDataConnector(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[DataConnectorKind.OFFICE365_PROJECT]] + key "name": str + key "properties": ForwardRef('Office365ProjectDataConnectorProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[DataConnectorKind.OFFICE365_PROJECT] + name: str + properties: Office365ProjectDataConnectorProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.Office365ProjectDataConnectorProperties(DataConnectorTenantId): + key "dataTypes": Required[Office365ProjectConnectorDataTypes] + key "tenantId": Required[str] + dataTypes: Office365ProjectConnectorDataTypes + tenantId: str + + + class azure.mgmt.securityinsight.types.OfficeATPCheckRequirements(TypedDict, total=False): + key "kind": Required[Literal[DataConnectorKind.OFFICE_ATP]] + key "properties": ForwardRef('OfficeATPCheckRequirementsProperties', module='types') + kind: Literal[DataConnectorKind.OFFICE_ATP] + properties: OfficeATPCheckRequirementsProperties + + + class azure.mgmt.securityinsight.types.OfficeATPCheckRequirementsProperties(DataConnectorTenantId): + key "tenantId": Required[str] + tenantId: str + + + class azure.mgmt.securityinsight.types.OfficeATPDataConnector(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[DataConnectorKind.OFFICE_ATP]] + key "name": str + key "properties": ForwardRef('OfficeATPDataConnectorProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[DataConnectorKind.OFFICE_ATP] + name: str + properties: OfficeATPDataConnectorProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.OfficeATPDataConnectorProperties(TypedDict, total=False): + key "dataTypes": ForwardRef('AlertsDataTypeOfDataConnector', module='types') + key "tenantId": Required[str] + dataTypes: AlertsDataTypeOfDataConnector + tenantId: str + + + class azure.mgmt.securityinsight.types.OfficeDataConnector(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[DataConnectorKind.OFFICE365]] + key "name": str + key "properties": ForwardRef('OfficeDataConnectorProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[DataConnectorKind.OFFICE365] + name: str + properties: OfficeDataConnectorProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.OfficeDataConnectorDataTypes(TypedDict, total=False): + key "exchange": Required[OfficeDataConnectorDataTypesExchange] + key "sharePoint": Required[OfficeDataConnectorDataTypesSharePoint] + key "teams": Required[OfficeDataConnectorDataTypesTeams] + exchange: OfficeDataConnectorDataTypesExchange + sharePoint: OfficeDataConnectorDataTypesSharePoint + teams: OfficeDataConnectorDataTypesTeams + + + class azure.mgmt.securityinsight.types.OfficeDataConnectorDataTypesExchange(DataConnectorDataTypeCommon): + key "state": Required[Union[str, DataTypeState]] + state: Union[str, DataTypeState] + + + class azure.mgmt.securityinsight.types.OfficeDataConnectorDataTypesSharePoint(DataConnectorDataTypeCommon): + key "state": Required[Union[str, DataTypeState]] + state: Union[str, DataTypeState] + + + class azure.mgmt.securityinsight.types.OfficeDataConnectorDataTypesTeams(DataConnectorDataTypeCommon): + key "state": Required[Union[str, DataTypeState]] + state: Union[str, DataTypeState] + + + class azure.mgmt.securityinsight.types.OfficeDataConnectorProperties(DataConnectorTenantId): + key "dataTypes": Required[OfficeDataConnectorDataTypes] + key "tenantId": Required[str] + dataTypes: OfficeDataConnectorDataTypes + tenantId: str + + + class azure.mgmt.securityinsight.types.OfficeIRMCheckRequirements(TypedDict, total=False): + key "kind": Required[Literal[DataConnectorKind.OFFICE_IRM]] + key "properties": ForwardRef('OfficeIRMCheckRequirementsProperties', module='types') + kind: Literal[DataConnectorKind.OFFICE_IRM] + properties: OfficeIRMCheckRequirementsProperties + + + class azure.mgmt.securityinsight.types.OfficeIRMCheckRequirementsProperties(DataConnectorTenantId): + key "tenantId": Required[str] + tenantId: str + + + class azure.mgmt.securityinsight.types.OfficeIRMDataConnector(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[DataConnectorKind.OFFICE_IRM]] + key "name": str + key "properties": ForwardRef('OfficeIRMDataConnectorProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[DataConnectorKind.OFFICE_IRM] + name: str + properties: OfficeIRMDataConnectorProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.OfficeIRMDataConnectorProperties(TypedDict, total=False): + key "dataTypes": ForwardRef('AlertsDataTypeOfDataConnector', module='types') + key "tenantId": Required[str] + dataTypes: AlertsDataTypeOfDataConnector + tenantId: str + + + class azure.mgmt.securityinsight.types.OfficePowerBICheckRequirements(TypedDict, total=False): + key "kind": Required[Literal[DataConnectorKind.OFFICE_POWER_BI]] + key "properties": ForwardRef('OfficePowerBICheckRequirementsProperties', module='types') + kind: Literal[DataConnectorKind.OFFICE_POWER_BI] + properties: OfficePowerBICheckRequirementsProperties + + + class azure.mgmt.securityinsight.types.OfficePowerBICheckRequirementsProperties(DataConnectorTenantId): + key "tenantId": Required[str] + tenantId: str + + + class azure.mgmt.securityinsight.types.OfficePowerBIConnectorDataTypes(TypedDict, total=False): + key "logs": Required[OfficePowerBIConnectorDataTypesLogs] + logs: OfficePowerBIConnectorDataTypesLogs + + + class azure.mgmt.securityinsight.types.OfficePowerBIConnectorDataTypesLogs(DataConnectorDataTypeCommon): + key "state": Required[Union[str, DataTypeState]] + state: Union[str, DataTypeState] + + + class azure.mgmt.securityinsight.types.OfficePowerBIDataConnector(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[DataConnectorKind.OFFICE_POWER_BI]] + key "name": str + key "properties": ForwardRef('OfficePowerBIDataConnectorProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[DataConnectorKind.OFFICE_POWER_BI] + name: str + properties: OfficePowerBIDataConnectorProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.OfficePowerBIDataConnectorProperties(DataConnectorTenantId): + key "dataTypes": Required[OfficePowerBIConnectorDataTypes] + key "tenantId": Required[str] + dataTypes: OfficePowerBIConnectorDataTypes + tenantId: str + + + class azure.mgmt.securityinsight.types.OracleAuthModel(TypedDict, total=False): + key "pemFile": Required[str] + key "publicFingerprint": Required[str] + key "tenantId": Required[str] + key "type": Required[Literal[CcpAuthType.ORACLE]] + key "userId": Required[str] + pemFile: str + publicFingerprint: str + tenantId: str + type: Literal[CcpAuthType.ORACLE] + userId: str + + + class azure.mgmt.securityinsight.types.PackageBaseProperties(TypedDict, total=False): + key "author": ForwardRef('MetadataAuthor', module='types') + key "categories": ForwardRef('MetadataCategories', module='types') + key "contentId": str + key "contentKind": Union[str, PackageKind] + key "contentProductId": str + key "contentSchemaVersion": str + key "dependencies": ForwardRef('MetadataDependencies', module='types') + key "description": str + key "displayName": str + key "firstPublishDate": str + key "icon": str + key "isDeprecated": Union[str, Flag] + key "isFeatured": Union[str, Flag] + key "isNew": Union[str, Flag] + key "isPreview": Union[str, Flag] + key "lastPublishDate": str + key "publisherDisplayName": str + key "source": ForwardRef('MetadataSource', module='types') + key "support": ForwardRef('MetadataSupport', module='types') + key "version": str + author: MetadataAuthor + categories: MetadataCategories + contentId: str + contentKind: Union[str, PackageKind] + contentProductId: str + contentSchemaVersion: str + dependencies: MetadataDependencies + description: str + displayName: str + firstPublishDate: str + icon: str + isDeprecated: Union[str, Flag] + isFeatured: Union[str, Flag] + isNew: Union[str, Flag] + isPreview: Union[str, Flag] + lastPublishDate: str + providers: list[str] + publisherDisplayName: str + source: MetadataSource + support: MetadataSupport + threatAnalysisTactics: list[str] + threatAnalysisTechniques: list[str] + version: str + + + class azure.mgmt.securityinsight.types.PackageModel(ProxyResource): + key "etag": str + key "id": str + key "name": str + key "properties": ForwardRef('PackageProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + name: str + properties: PackageProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.PackageProperties(PackageBaseProperties): + key "author": ForwardRef('MetadataAuthor', module='types') + key "categories": ForwardRef('MetadataCategories', module='types') + key "contentId": str + key "contentKind": Union[str, PackageKind] + key "contentProductId": str + key "contentSchemaVersion": str + key "dependencies": ForwardRef('MetadataDependencies', module='types') + key "description": str + key "displayName": str + key "firstPublishDate": str + key "icon": str + key "isDeprecated": Union[str, Flag] + key "isFeatured": Union[str, Flag] + key "isNew": Union[str, Flag] + key "isPreview": Union[str, Flag] + key "lastPublishDate": str + key "publisherDisplayName": str + key "source": ForwardRef('MetadataSource', module='types') + key "support": ForwardRef('MetadataSupport', module='types') + key "version": str + author: MetadataAuthor + categories: MetadataCategories + contentId: str + contentKind: Union[str, PackageKind] + contentProductId: str + contentSchemaVersion: str + dependencies: MetadataDependencies + description: str + displayName: str + firstPublishDate: str + icon: str + isDeprecated: Union[str, Flag] + isFeatured: Union[str, Flag] + isNew: Union[str, Flag] + isPreview: Union[str, Flag] + lastPublishDate: str + providers: list[str] + publisherDisplayName: str + source: MetadataSource + support: MetadataSupport + threatAnalysisTactics: list[str] + threatAnalysisTechniques: list[str] + version: str + + + class azure.mgmt.securityinsight.types.Permissions(TypedDict, total=False): + customs: list[PermissionsCustomsItem] + resourceProvider: list[PermissionsResourceProviderItem] + + + class azure.mgmt.securityinsight.types.PermissionsCustomsItem(Customs): + key "description": str + key "name": str + description: str + name: str + + + class azure.mgmt.securityinsight.types.PermissionsResourceProviderItem(ResourceProvider): + key "permissionsDisplayText": str + key "provider": Union[str, ProviderName] + key "providerDisplayName": str + key "requiredPermissions": ForwardRef('RequiredPermissions', module='types') + key "scope": Union[str, PermissionProviderScope] + permissionsDisplayText: str + provider: Union[str, ProviderName] + providerDisplayName: str + requiredPermissions: RequiredPermissions + scope: Union[str, PermissionProviderScope] + + + class azure.mgmt.securityinsight.types.PlaybookActionProperties(TypedDict, total=False): + key "logicAppResourceId": Required[str] + key "tenantId": str + logicAppResourceId: str + tenantId: str + + + class azure.mgmt.securityinsight.types.PremiumMdtiDataConnectorDataTypes(TypedDict, total=False): + key "connector": Required[PremiumMdtiDataConnectorDataTypesConnector] + connector: PremiumMdtiDataConnectorDataTypesConnector + + + class azure.mgmt.securityinsight.types.PremiumMdtiDataConnectorDataTypesConnector(DataConnectorDataTypeCommon): + key "state": Required[Union[str, DataTypeState]] + state: Union[str, DataTypeState] + + + class azure.mgmt.securityinsight.types.PremiumMdtiDataConnectorProperties(DataConnectorTenantId): + key "dataTypes": Required[PremiumMdtiDataConnectorDataTypes] + key "lookbackPeriod": Required[str] + key "requiredSKUsPresent": bool + key "tenantId": Required[str] + dataTypes: PremiumMdtiDataConnectorDataTypes + lookbackPeriod: str + requiredSKUsPresent: bool + tenantId: str + + + class azure.mgmt.securityinsight.types.PremiumMicrosoftDefenderForThreatIntelligence(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[DataConnectorKind.PREMIUM_MICROSOFT_DEFENDER_FOR_THREAT_INTELLIGENCE]] + key "name": str + key "properties": ForwardRef('PremiumMdtiDataConnectorProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[DataConnectorKind.PREMIUM_MICROSOFT_DEFENDER_FOR_THREAT_INTELLIGENCE] + name: str + properties: PremiumMdtiDataConnectorProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.PropertyArrayChangedConditionProperties(TypedDict, total=False): + key "conditionProperties": ForwardRef('AutomationRulePropertyArrayChangedValuesCondition', module='types') + key "conditionType": Required[Literal[ConditionType.PROPERTY_ARRAY_CHANGED]] + conditionProperties: AutomationRulePropertyArrayChangedValuesCondition + conditionType: Literal[ConditionType.PROPERTY_ARRAY_CHANGED] + + + class azure.mgmt.securityinsight.types.PropertyArrayConditionProperties(TypedDict, total=False): + key "conditionProperties": ForwardRef('AutomationRulePropertyArrayValuesCondition', module='types') + key "conditionType": Required[Literal[ConditionType.PROPERTY_ARRAY]] + conditionProperties: AutomationRulePropertyArrayValuesCondition + conditionType: Literal[ConditionType.PROPERTY_ARRAY] + + + class azure.mgmt.securityinsight.types.PropertyChangedConditionProperties(TypedDict, total=False): + key "conditionProperties": ForwardRef('AutomationRulePropertyValuesChangedCondition', module='types') + key "conditionType": Required[Literal[ConditionType.PROPERTY_CHANGED]] + conditionProperties: AutomationRulePropertyValuesChangedCondition + conditionType: Literal[ConditionType.PROPERTY_CHANGED] + + + class azure.mgmt.securityinsight.types.PropertyConditionProperties(TypedDict, total=False): + key "conditionProperties": ForwardRef('AutomationRulePropertyValuesCondition', module='types') + key "conditionType": Required[Literal[ConditionType.PROPERTY]] + conditionProperties: AutomationRulePropertyValuesCondition + conditionType: Literal[ConditionType.PROPERTY] + + + class azure.mgmt.securityinsight.types.ProxyResource(Resource): + key "id": str + key "name": str + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + id: str + name: str + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.PullRequest(TypedDict, total=False): + key "state": Union[str, PullRequestState] + key "url": str + state: Union[str, PullRequestState] + url: str + + + class azure.mgmt.securityinsight.types.PurviewAuditCheckRequirements(TypedDict, total=False): + key "kind": Required[Literal[DataConnectorKind.PURVIEW_AUDIT]] + key "properties": ForwardRef('PurviewAuditCheckRequirementsProperties', module='types') + kind: Literal[DataConnectorKind.PURVIEW_AUDIT] + properties: PurviewAuditCheckRequirementsProperties + + + class azure.mgmt.securityinsight.types.PurviewAuditCheckRequirementsProperties(DataConnectorTenantId): + key "tenantId": Required[str] + tenantId: str + + + class azure.mgmt.securityinsight.types.PurviewAuditConnectorDataTypes(TypedDict, total=False): + key "logs": Required[PurviewAuditConnectorDataTypesLogs] + logs: PurviewAuditConnectorDataTypesLogs + + + class azure.mgmt.securityinsight.types.PurviewAuditConnectorDataTypesLogs(DataConnectorDataTypeCommon): + key "state": Required[Union[str, DataTypeState]] + state: Union[str, DataTypeState] + + + class azure.mgmt.securityinsight.types.PurviewAuditDataConnector(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[DataConnectorKind.PURVIEW_AUDIT]] + key "name": str + key "properties": ForwardRef('PurviewAuditDataConnectorProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[DataConnectorKind.PURVIEW_AUDIT] + name: str + properties: PurviewAuditDataConnectorProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.PurviewAuditDataConnectorProperties(DataConnectorTenantId): + key "connectorDefinitionName": str + key "dataTypes": Required[PurviewAuditConnectorDataTypes] + key "dcrConfig": ForwardRef('DCRConfiguration', module='types') + key "sourceType": str + key "tenantId": Required[str] + connectorDefinitionName: str + dataTypes: PurviewAuditConnectorDataTypes + dcrConfig: DCRConfiguration + sourceType: str + tenantId: str + + + class azure.mgmt.securityinsight.types.Query(TypedDict, total=False): + key "condition": ForwardRef('QueryCondition', module='types') + key "maxPageSize": int + key "minPageSize": int + key "sortBy": ForwardRef('QuerySortBy', module='types') + condition: QueryCondition + maxPageSize: int + minPageSize: int + sortBy: QuerySortBy + + + class azure.mgmt.securityinsight.types.QueryCondition(TypedDict, total=False): + key "clauses": Required[list[ConditionClause]] + key "conditionConnective": Union[str, Connective] + key "stixObjectType": str + clauses: list[ConditionClause] + conditionConnective: Union[str, Connective] + stixObjectType: str + + + class azure.mgmt.securityinsight.types.QueryProperties(TypedDict, total=False): + key "condition": ForwardRef('ConditionProperties', module='types') + condition: ConditionProperties + + + class azure.mgmt.securityinsight.types.QuerySortBy(TypedDict, total=False): + key "direction": Union[str, SortingDirection] + key "field": str + direction: Union[str, SortingDirection] + field: str + + + class azure.mgmt.securityinsight.types.RecommendationPatch(TypedDict, total=False): + key "properties": ForwardRef('RecommendationPatchProperties', module='types') + properties: RecommendationPatchProperties + + + class azure.mgmt.securityinsight.types.RecommendationPatchProperties(TypedDict, total=False): + key "state": Union[str, State] + state: Union[str, State] + + + class azure.mgmt.securityinsight.types.Relation(ProxyResource): + key "etag": str + key "id": str + key "name": str + key "properties": ForwardRef('RelationProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + name: str + properties: RelationProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.RelationProperties(TypedDict, total=False): + key "relatedResourceId": Required[str] + key "relatedResourceKind": str + key "relatedResourceName": str + key "relatedResourceType": str + relatedResourceId: str + relatedResourceKind: str + relatedResourceName: str + relatedResourceType: str + + + class azure.mgmt.securityinsight.types.Repository(TypedDict, total=False): + key "branch": Required[str] + key "deploymentLogsUrl": str + key "displayUrl": str + key "url": Required[str] + branch: str + deploymentLogsUrl: str + displayUrl: str + url: str + + + class azure.mgmt.securityinsight.types.RepositoryAccess(TypedDict, total=False): + key "clientId": str + key "code": str + key "installationId": str + key "kind": Required[Union[str, RepositoryAccessKind]] + key "state": str + key "token": str + clientId: str + code: str + installationId: str + kind: Union[str, RepositoryAccessKind] + state: str + token: str + + + class azure.mgmt.securityinsight.types.RepositoryAccessObject(TypedDict, total=False): + key "repositoryAccess": Required[RepositoryAccess] + repositoryAccess: RepositoryAccess + + + class azure.mgmt.securityinsight.types.RepositoryAccessProperties(TypedDict, total=False): + key "properties": Required[RepositoryAccessObject] + properties: RepositoryAccessObject + + + class azure.mgmt.securityinsight.types.RepositoryResourceInfo(TypedDict, total=False): + key "azureDevOpsResourceInfo": ForwardRef('AzureDevOpsResourceInfo', module='types') + key "gitHubResourceInfo": ForwardRef('GitHubResourceInfo', module='types') + key "webhook": ForwardRef('Webhook', module='types') + azureDevOpsResourceInfo: AzureDevOpsResourceInfo + gitHubResourceInfo: GitHubResourceInfo + webhook: Webhook + + + class azure.mgmt.securityinsight.types.RequiredPermissions(TypedDict, total=False): + key "action": bool + key "delete": bool + key "read": bool + key "write": bool + action: bool + delete: bool + read: bool + write: bool + + + class azure.mgmt.securityinsight.types.Resource(TypedDict, total=False): + key "id": str + key "name": str + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + id: str + name: str + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.ResourceProvider(TypedDict, total=False): + key "permissionsDisplayText": str + key "provider": Union[str, ProviderName] + key "providerDisplayName": str + key "requiredPermissions": ForwardRef('RequiredPermissions', module='types') + key "scope": Union[str, PermissionProviderScope] + permissionsDisplayText: str + provider: Union[str, ProviderName] + providerDisplayName: str + requiredPermissions: RequiredPermissions + scope: Union[str, PermissionProviderScope] + + + class azure.mgmt.securityinsight.types.ResourceProviderRequiredPermissions(TypedDict, total=False): + key "action": bool + key "delete": bool + key "read": bool + key "write": bool + action: bool + delete: bool + read: bool + write: bool + + + class azure.mgmt.securityinsight.types.ResourceWithEtag(Resource): + key "etag": str + key "id": str + key "name": str + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + name: str + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.RestApiPollerDataConnector(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[DataConnectorKind.REST_API_POLLER]] + key "name": str + key "properties": ForwardRef('RestApiPollerDataConnectorProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[DataConnectorKind.REST_API_POLLER] + name: str + properties: RestApiPollerDataConnectorProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.RestApiPollerDataConnectorProperties(TypedDict, total=False): + key "auth": Required[CcpAuthConfig] + key "connectorDefinitionName": Required[str] + key "dataType": str + key "dcrConfig": ForwardRef('DCRConfiguration', module='types') + key "isActive": bool + key "paging": ForwardRef('RestApiPollerRequestPagingConfig', module='types') + key "request": Required[RestApiPollerRequestConfig] + key "response": ForwardRef('CcpResponseConfig', module='types') + addOnAttributes: dict[str, str] + auth: CcpAuthConfig + connectorDefinitionName: str + dataType: str + dcrConfig: DCRConfiguration + isActive: bool + paging: RestApiPollerRequestPagingConfig + request: RestApiPollerRequestConfig + response: CcpResponseConfig + + + class azure.mgmt.securityinsight.types.RestApiPollerRequestConfig(TypedDict, total=False): + key "apiEndpoint": Required[str] + key "endTimeAttributeName": str + key "httpMethod": Union[str, HttpMethodVerb] + key "isPostPayloadJson": Optional[bool] + key "queryParametersTemplate": str + key "queryTimeFormat": str + key "queryTimeIntervalAttributeName": str + key "queryTimeIntervalDelimiter": str + key "queryTimeIntervalPrepend": str + key "queryWindowInMin": Optional[int] + key "rateLimitQPS": Optional[int] + key "retryCount": Optional[int] + key "startTimeAttributeName": str + key "timeoutInSeconds": Optional[int] + apiEndpoint: str + endTimeAttributeName: str + headers: dict[str, str] + httpMethod: Union[str, HttpMethodVerb] + isPostPayloadJson: bool + queryParameters: dict[str, Any] + queryParametersTemplate: str + queryTimeFormat: str + queryTimeIntervalAttributeName: str + queryTimeIntervalDelimiter: str + queryTimeIntervalPrepend: str + queryWindowInMin: int + rateLimitQPS: int + retryCount: int + startTimeAttributeName: str + timeoutInSeconds: int + + + class azure.mgmt.securityinsight.types.RestApiPollerRequestPagingConfig(TypedDict, total=False): + key "pageSize": int + key "pageSizeParameterName": str + key "pagingType": Required[Union[str, RestApiPollerRequestPagingKind]] + pageSize: int + pageSizeParameterName: str + pagingType: Union[str, RestApiPollerRequestPagingKind] + + + class azure.mgmt.securityinsight.types.SampleQueries(TypedDict, total=False): + key "description": str + key "query": str + description: str + query: str + + + class azure.mgmt.securityinsight.types.ScheduledAlertRule(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[AlertRuleKind.SCHEDULED]] + key "name": str + key "properties": ForwardRef('ScheduledAlertRuleProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[AlertRuleKind.SCHEDULED] + name: str + properties: ScheduledAlertRuleProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.ScheduledAlertRuleCommonProperties(TypedDict, total=False): + key "alertDetailsOverride": ForwardRef('AlertDetailsOverride', module='types') + key "eventGroupingSettings": ForwardRef('EventGroupingSettings', module='types') + key "query": str + key "queryFrequency": str + key "queryPeriod": str + key "severity": Union[str, AlertSeverity] + key "triggerOperator": Union[str, TriggerOperator] + key "triggerThreshold": int + alertDetailsOverride: AlertDetailsOverride + customDetails: dict[str, str] + entityMappings: list[EntityMapping] + eventGroupingSettings: EventGroupingSettings + query: str + queryFrequency: str + queryPeriod: str + sentinelEntitiesMappings: list[SentinelEntityMapping] + severity: Union[str, AlertSeverity] + triggerOperator: Union[str, TriggerOperator] + triggerThreshold: int + + + class azure.mgmt.securityinsight.types.ScheduledAlertRuleProperties(ScheduledAlertRuleCommonProperties): + key "alertDetailsOverride": ForwardRef('AlertDetailsOverride', module='types') + key "alertRuleTemplateName": str + key "description": str + key "displayName": Required[str] + key "enabled": Required[bool] + key "eventGroupingSettings": ForwardRef('EventGroupingSettings', module='types') + key "incidentConfiguration": ForwardRef('IncidentConfiguration', module='types') + key "lastModifiedUtc": str + key "query": str + key "queryFrequency": str + key "queryPeriod": str + key "severity": Union[str, AlertSeverity] + key "suppressionDuration": Required[str] + key "suppressionEnabled": Required[bool] + key "templateVersion": str + key "triggerOperator": Union[str, TriggerOperator] + key "triggerThreshold": int + alertDetailsOverride: AlertDetailsOverride + alertRuleTemplateName: str + customDetails: dict[str, str] + description: str + displayName: str + enabled: bool + entityMappings: list[EntityMapping] + eventGroupingSettings: EventGroupingSettings + incidentConfiguration: IncidentConfiguration + lastModifiedUtc: str + query: str + queryFrequency: str + queryPeriod: str + sentinelEntitiesMappings: list[SentinelEntityMapping] + severity: Union[str, AlertSeverity] + subTechniques: list[str] + suppressionDuration: str + suppressionEnabled: bool + tactics: list[Union[str, AttackTactic]] + techniques: list[str] + templateVersion: str + triggerOperator: Union[str, TriggerOperator] + triggerThreshold: int + + + class azure.mgmt.securityinsight.types.SecurityMLAnalyticsSetting(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[SecurityMLAnalyticsSettingsKind.ANOMALY]] + key "name": str + key "properties": ForwardRef('AnomalySecurityMLAnalyticsSettingsProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[SecurityMLAnalyticsSettingsKind.ANOMALY] + name: str + properties: AnomalySecurityMLAnalyticsSettingsProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.SecurityMLAnalyticsSettingsDataSource(TypedDict, total=False): + key "connectorId": str + connectorId: str + dataTypes: list[str] + + + class azure.mgmt.securityinsight.types.SecurityMLAnalyticsSettingsKind(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ANOMALY = "Anomaly" + + + class azure.mgmt.securityinsight.types.SentinelEntityMapping(TypedDict, total=False): + key "columnName": str + columnName: str + + + class azure.mgmt.securityinsight.types.SentinelOnboardingState(ProxyResource): + key "etag": str + key "id": str + key "name": str + key "properties": ForwardRef('SentinelOnboardingStateProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + name: str + properties: SentinelOnboardingStateProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.SentinelOnboardingStateProperties(TypedDict, total=False): + key "customerManagedKey": bool + customerManagedKey: bool + + + class azure.mgmt.securityinsight.types.ServicePrincipal(TypedDict, total=False): + key "appId": str + key "credentialsExpireOn": str + key "id": str + key "tenantId": str + appId: str + credentialsExpireOn: str + id: str + tenantId: str + + + class azure.mgmt.securityinsight.types.SessionAuthModel(TypedDict, total=False): + key "isPostPayloadJson": Optional[bool] + key "password": Required[dict[str, str]] + key "sessionIdName": str + key "sessionLoginRequestUri": str + key "sessionTimeoutInMinutes": Optional[int] + key "type": Required[Literal[CcpAuthType.SESSION]] + key "userName": Required[dict[str, str]] + headers: dict[str, str] + isPostPayloadJson: bool + password: dict[str, str] + queryParameters: dict[str, Any] + sessionIdName: str + sessionLoginRequestUri: str + sessionTimeoutInMinutes: int + type: Literal[CcpAuthType.SESSION] + userName: dict[str, str] + + + class azure.mgmt.securityinsight.types.SettingKind(str, Enum, metaclass=CaseInsensitiveEnumMeta): + ANOMALIES = "Anomalies" + ENTITY_ANALYTICS = "EntityAnalytics" + EYES_ON = "EyesOn" + UEBA = "Ueba" + + + class azure.mgmt.securityinsight.types.SourceControl(ProxyResource): + key "etag": str + key "id": str + key "name": str + key "properties": Required[SourceControlProperties] + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + name: str + properties: SourceControlProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.SourceControlProperties(TypedDict, total=False): + key "contentTypes": Required[list[Union[str, ContentType]]] + key "description": str + key "displayName": Required[str] + key "id": str + key "lastDeploymentInfo": ForwardRef('DeploymentInfo', module='types') + key "pullRequest": ForwardRef('PullRequest', module='types') + key "repoType": Required[Union[str, RepoType]] + key "repository": Required[Repository] + key "repositoryAccess": ForwardRef('RepositoryAccess', module='types') + key "repositoryResourceInfo": ForwardRef('RepositoryResourceInfo', module='types') + key "servicePrincipal": ForwardRef('ServicePrincipal', module='types') + key "version": Union[str, Version] + key "workloadIdentityFederation": ForwardRef('WorkloadIdentityFederation', module='types') + contentTypes: list[Union[str, ContentType]] + description: str + displayName: str + id: str + lastDeploymentInfo: DeploymentInfo + pullRequest: PullRequest + repoType: Union[str, RepoType] + repository: Repository + repositoryAccess: RepositoryAccess + repositoryResourceInfo: RepositoryResourceInfo + servicePrincipal: ServicePrincipal + version: Union[str, Version] + workloadIdentityFederation: WorkloadIdentityFederation + + + class azure.mgmt.securityinsight.types.SystemData(TypedDict, total=False): + key "createdAt": str + key "createdBy": str + key "createdByType": Union[str, CreatedByType] + key "lastModifiedAt": str + key "lastModifiedBy": str + key "lastModifiedByType": Union[str, CreatedByType] + createdAt: str + createdBy: str + createdByType: Union[str, CreatedByType] + lastModifiedAt: str + lastModifiedBy: str + lastModifiedByType: Union[str, CreatedByType] + + + class azure.mgmt.securityinsight.types.TICheckRequirements(TypedDict, total=False): + key "kind": Required[Literal[DataConnectorKind.THREAT_INTELLIGENCE]] + key "properties": ForwardRef('TICheckRequirementsProperties', module='types') + kind: Literal[DataConnectorKind.THREAT_INTELLIGENCE] + properties: TICheckRequirementsProperties + + + class azure.mgmt.securityinsight.types.TICheckRequirementsProperties(DataConnectorTenantId): + key "tenantId": Required[str] + tenantId: str + + + class azure.mgmt.securityinsight.types.TIDataConnector(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[DataConnectorKind.THREAT_INTELLIGENCE]] + key "name": str + key "properties": ForwardRef('TIDataConnectorProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[DataConnectorKind.THREAT_INTELLIGENCE] + name: str + properties: TIDataConnectorProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.TIDataConnectorDataTypes(TypedDict, total=False): + key "indicators": Required[TIDataConnectorDataTypesIndicators] + indicators: TIDataConnectorDataTypesIndicators + + + class azure.mgmt.securityinsight.types.TIDataConnectorDataTypesIndicators(DataConnectorDataTypeCommon): + key "state": Required[Union[str, DataTypeState]] + state: Union[str, DataTypeState] + + + class azure.mgmt.securityinsight.types.TIDataConnectorProperties(DataConnectorTenantId): + key "dataTypes": Required[TIDataConnectorDataTypes] + key "tenantId": Required[str] + key "tipLookbackPeriod": Optional[str] + dataTypes: TIDataConnectorDataTypes + tenantId: str + tipLookbackPeriod: str + + + class azure.mgmt.securityinsight.types.TeamInformation(TypedDict, total=False): + key "description": str + key "name": str + key "primaryChannelUrl": str + key "teamCreationTimeUtc": str + key "teamId": str + description: str + name: str + primaryChannelUrl: str + teamCreationTimeUtc: str + teamId: str + + + class azure.mgmt.securityinsight.types.TemplateModel(ProxyResource): + key "etag": str + key "id": str + key "name": str + key "properties": ForwardRef('TemplateProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + name: str + properties: TemplateProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.TemplateProperties(TypedDict, total=False): + key "author": ForwardRef('MetadataAuthor', module='types') + key "categories": ForwardRef('MetadataCategories', module='types') + key "contentId": str + key "contentKind": Union[str, Kind] + key "contentProductId": str + key "contentSchemaVersion": str + key "customVersion": str + key "dependencies": ForwardRef('MetadataDependencies', module='types') + key "displayName": str + key "firstPublishDate": str + key "icon": str + key "isDeprecated": Union[str, Flag] + key "lastPublishDate": str + key "mainTemplate": Any + key "packageId": str + key "packageKind": Union[str, PackageKind] + key "packageName": str + key "packageVersion": str + key "source": ForwardRef('MetadataSource', module='types') + key "support": ForwardRef('MetadataSupport', module='types') + key "version": str + author: MetadataAuthor + categories: MetadataCategories + contentId: str + contentKind: Union[str, Kind] + contentProductId: str + contentSchemaVersion: str + customVersion: str + dependantTemplates: list[TemplateProperties] + dependencies: MetadataDependencies + displayName: str + firstPublishDate: str + icon: str + isDeprecated: Union[str, Flag] + lastPublishDate: str + mainTemplate: Any + packageId: str + packageKind: Union[str, PackageKind] + packageName: str + packageVersion: str + previewImages: list[str] + previewImagesDark: list[str] + providers: list[str] + source: MetadataSource + support: MetadataSupport + threatAnalysisTactics: list[str] + threatAnalysisTechniques: list[str] + version: str + + + class azure.mgmt.securityinsight.types.ThreatIntelligenceAlertRule(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[AlertRuleKind.THREAT_INTELLIGENCE]] + key "name": str + key "properties": ForwardRef('ThreatIntelligenceAlertRuleProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[AlertRuleKind.THREAT_INTELLIGENCE] + name: str + properties: ThreatIntelligenceAlertRuleProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.ThreatIntelligenceAlertRuleProperties(TypedDict, total=False): + key "alertRuleTemplateName": Required[str] + key "description": str + key "displayName": str + key "enabled": Required[bool] + key "lastModifiedUtc": str + key "severity": Union[str, AlertSeverity] + alertRuleTemplateName: str + description: str + displayName: str + enabled: bool + lastModifiedUtc: str + severity: Union[str, AlertSeverity] + subTechniques: list[str] + tactics: list[Union[str, AttackTactic]] + techniques: list[str] + + + class azure.mgmt.securityinsight.types.ThreatIntelligenceAppendTags(TypedDict, total=False): + threatIntelligenceTags: list[str] + + + class azure.mgmt.securityinsight.types.ThreatIntelligenceExternalReference(TypedDict, total=False): + key "description": str + key "externalId": str + key "sourceName": str + key "url": str + description: str + externalId: str + hashes: dict[str, str] + sourceName: str + url: str + + + class azure.mgmt.securityinsight.types.ThreatIntelligenceFilteringCriteria(TypedDict, total=False): + key "includeDisabled": bool + key "maxConfidence": int + key "maxValidUntil": str + key "minConfidence": int + key "minValidUntil": str + key "pageSize": int + key "skipToken": str + ids: list[str] + includeDisabled: bool + keywords: list[str] + maxConfidence: int + maxValidUntil: str + minConfidence: int + minValidUntil: str + pageSize: int + patternTypes: list[str] + skipToken: str + sortBy: list[ThreatIntelligenceSortingCriteria] + sources: list[str] + threatTypes: list[str] + + + class azure.mgmt.securityinsight.types.ThreatIntelligenceGranularMarkingModel(TypedDict, total=False): + key "language": str + key "markingRef": int + language: str + markingRef: int + selectors: list[str] + + + class azure.mgmt.securityinsight.types.ThreatIntelligenceIndicatorModel(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[ThreatIntelligenceResourceKindEnum.INDICATOR]] + key "name": str + key "properties": ForwardRef('ThreatIntelligenceIndicatorProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[ThreatIntelligenceResourceKindEnum.INDICATOR] + name: str + properties: ThreatIntelligenceIndicatorProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.ThreatIntelligenceIndicatorProperties(EntityCommonProperties): + key "confidence": int + key "created": str + key "createdByRef": str + key "defanged": bool + key "description": str + key "displayName": str + key "externalId": str + key "externalLastUpdatedTimeUtc": str + key "friendlyName": str + key "language": str + key "lastUpdatedTimeUtc": str + key "modified": str + key "pattern": str + key "patternType": str + key "patternVersion": str + key "revoked": bool + key "source": str + key "validFrom": str + key "validUntil": str + additionalData: dict[str, Any] + confidence: int + created: str + createdByRef: str + defanged: bool + description: str + displayName: str + extensions: dict[str, Any] + externalId: str + externalLastUpdatedTimeUtc: str + externalReferences: list[ThreatIntelligenceExternalReference] + friendlyName: str + granularMarkings: list[ThreatIntelligenceGranularMarkingModel] + indicatorTypes: list[str] + killChainPhases: list[ThreatIntelligenceKillChainPhase] + labels: list[str] + language: str + lastUpdatedTimeUtc: str + modified: str + objectMarkingRefs: list[str] + parsedPattern: list[ThreatIntelligenceParsedPattern] + pattern: str + patternType: str + patternVersion: str + revoked: bool + source: str + threatIntelligenceTags: list[str] + threatTypes: list[str] + validFrom: str + validUntil: str + + + class azure.mgmt.securityinsight.types.ThreatIntelligenceInformation(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[ThreatIntelligenceResourceKindEnum.INDICATOR]] + key "name": str + key "properties": ForwardRef('ThreatIntelligenceIndicatorProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[ThreatIntelligenceResourceKindEnum.INDICATOR] + name: str + properties: ThreatIntelligenceIndicatorProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.ThreatIntelligenceKillChainPhase(TypedDict, total=False): + key "killChainName": str + key "phaseName": str + killChainName: str + phaseName: str + + + class azure.mgmt.securityinsight.types.ThreatIntelligenceParsedPattern(TypedDict, total=False): + key "patternTypeKey": str + patternTypeKey: str + patternTypeValues: list[ThreatIntelligenceParsedPatternTypeValue] + + + class azure.mgmt.securityinsight.types.ThreatIntelligenceParsedPatternTypeValue(TypedDict, total=False): + key "value": str + key "valueType": str + value: str + valueType: str + + + class azure.mgmt.securityinsight.types.ThreatIntelligenceResourceKindEnum(str, Enum, metaclass=CaseInsensitiveEnumMeta): + INDICATOR = "indicator" + + + class azure.mgmt.securityinsight.types.ThreatIntelligenceSortingCriteria(TypedDict, total=False): + key "itemKey": str + key "sortOrder": Union[str, ThreatIntelligenceSortingCriteriaEnum] + itemKey: str + sortOrder: Union[str, ThreatIntelligenceSortingCriteriaEnum] + + + class azure.mgmt.securityinsight.types.TiTaxiiCheckRequirements(TypedDict, total=False): + key "kind": Required[Literal[DataConnectorKind.THREAT_INTELLIGENCE_TAXII]] + key "properties": ForwardRef('TiTaxiiCheckRequirementsProperties', module='types') + kind: Literal[DataConnectorKind.THREAT_INTELLIGENCE_TAXII] + properties: TiTaxiiCheckRequirementsProperties + + + class azure.mgmt.securityinsight.types.TiTaxiiCheckRequirementsProperties(DataConnectorTenantId): + key "tenantId": Required[str] + tenantId: str + + + class azure.mgmt.securityinsight.types.TiTaxiiDataConnector(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[DataConnectorKind.THREAT_INTELLIGENCE_TAXII]] + key "name": str + key "properties": ForwardRef('TiTaxiiDataConnectorProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[DataConnectorKind.THREAT_INTELLIGENCE_TAXII] + name: str + properties: TiTaxiiDataConnectorProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.TiTaxiiDataConnectorDataTypes(TypedDict, total=False): + key "taxiiClient": Required[TiTaxiiDataConnectorDataTypesTaxiiClient] + taxiiClient: TiTaxiiDataConnectorDataTypesTaxiiClient + + + class azure.mgmt.securityinsight.types.TiTaxiiDataConnectorDataTypesTaxiiClient(DataConnectorDataTypeCommon): + key "state": Required[Union[str, DataTypeState]] + state: Union[str, DataTypeState] + + + class azure.mgmt.securityinsight.types.TiTaxiiDataConnectorProperties(DataConnectorTenantId): + key "collectionId": str + key "dataTypes": Required[TiTaxiiDataConnectorDataTypes] + key "friendlyName": str + key "password": str + key "pollingFrequency": Required[Optional[Union[str, PollingFrequency]]] + key "taxiiLookbackPeriod": Optional[str] + key "taxiiServer": str + key "tenantId": Required[str] + key "userName": str + key "workspaceId": str + collectionId: str + dataTypes: TiTaxiiDataConnectorDataTypes + friendlyName: str + password: str + pollingFrequency: Union[str, PollingFrequency] + taxiiLookbackPeriod: str + taxiiServer: str + tenantId: str + userName: str + workspaceId: str + + + class azure.mgmt.securityinsight.types.Ueba(TypedDict, total=False): + key "etag": str + key "id": str + key "kind": Required[Literal[SettingKind.UEBA]] + key "name": str + key "properties": ForwardRef('UebaProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + kind: Literal[SettingKind.UEBA] + name: str + properties: UebaProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.UebaProperties(TypedDict, total=False): + dataSources: list[Union[str, UebaDataSources]] + + + class azure.mgmt.securityinsight.types.UserInfo(TypedDict, total=False): + key "email": str + key "name": str + key "objectId": Optional[str] + email: str + name: str + objectId: str + + + class azure.mgmt.securityinsight.types.ValidationError(TypedDict, total=False): + key "recordIndex": int + errorMessages: list[str] + recordIndex: int + + + class azure.mgmt.securityinsight.types.Watchlist(ProxyResource): + key "etag": str + key "id": str + key "name": str + key "properties": ForwardRef('WatchlistProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + name: str + properties: WatchlistProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.WatchlistItem(ProxyResource): + key "etag": str + key "id": str + key "name": str + key "properties": ForwardRef('WatchlistItemProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + name: str + properties: WatchlistItemProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.WatchlistItemProperties(TypedDict, total=False): + key "created": str + key "createdBy": ForwardRef('UserInfo', module='types') + key "entityMapping": Any + key "isDeleted": bool + key "itemsKeyValue": Required[Any] + key "tenantId": str + key "updated": str + key "updatedBy": ForwardRef('UserInfo', module='types') + key "watchlistItemId": str + key "watchlistItemType": str + created: str + createdBy: UserInfo + entityMapping: Any + isDeleted: bool + itemsKeyValue: Any + tenantId: str + updated: str + updatedBy: UserInfo + watchlistItemId: str + watchlistItemType: str + + + class azure.mgmt.securityinsight.types.WatchlistProperties(TypedDict, total=False): + key "contentType": str + key "created": str + key "createdBy": ForwardRef('UserInfo', module='types') + key "defaultDuration": str + key "description": str + key "displayName": Required[str] + key "isDeleted": bool + key "itemsSearchKey": Required[str] + key "numberOfLinesToSkip": int + key "provider": Required[str] + key "provisioningState": Union[str, WatchlistProvisioningState] + key "rawContent": str + key "source": str + key "sourceType": Union[str, SourceType] + key "tenantId": str + key "updated": str + key "updatedBy": ForwardRef('UserInfo', module='types') + key "uploadStatus": str + key "watchlistAlias": str + key "watchlistId": str + key "watchlistType": str + contentType: str + created: str + createdBy: UserInfo + defaultDuration: str + description: str + displayName: str + isDeleted: bool + itemsSearchKey: str + labels: list[str] + numberOfLinesToSkip: int + provider: str + provisioningState: Union[str, WatchlistProvisioningState] + rawContent: str + source: str + sourceType: Union[str, SourceType] + tenantId: str + updated: str + updatedBy: UserInfo + uploadStatus: str + watchlistAlias: str + watchlistId: str + watchlistType: str + + + class azure.mgmt.securityinsight.types.Webhook(TypedDict, total=False): + key "rotateWebhookSecret": bool + key "webhookId": str + key "webhookSecretUpdateTime": str + key "webhookUrl": str + rotateWebhookSecret: bool + webhookId: str + webhookSecretUpdateTime: str + webhookUrl: str + + + class azure.mgmt.securityinsight.types.WorkloadIdentityFederation(TypedDict, total=False): + key "appId": str + key "id": str + key "issuer": str + key "subject": str + key "tenantId": str + appId: str + id: str + issuer: str + subject: str + tenantId: str + + + class azure.mgmt.securityinsight.types.WorkspaceManagerAssignment(ProxyResource): + key "etag": str + key "id": str + key "name": str + key "properties": ForwardRef('WorkspaceManagerAssignmentProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + name: str + properties: WorkspaceManagerAssignmentProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.WorkspaceManagerAssignmentProperties(TypedDict, total=False): + key "items": Required[list[AssignmentItem]] + key "lastJobEndTime": str + key "lastJobProvisioningState": Union[str, JobProvisioningState] + key "targetResourceName": Required[str] + items: list[AssignmentItem] + lastJobEndTime: str + lastJobProvisioningState: Union[str, JobProvisioningState] + targetResourceName: str + + + class azure.mgmt.securityinsight.types.WorkspaceManagerConfiguration(ProxyResource): + key "etag": str + key "id": str + key "name": str + key "properties": ForwardRef('WorkspaceManagerConfigurationProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + name: str + properties: WorkspaceManagerConfigurationProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.WorkspaceManagerConfigurationProperties(TypedDict, total=False): + key "mode": Required[Union[str, Mode]] + mode: Union[str, Mode] + + + class azure.mgmt.securityinsight.types.WorkspaceManagerGroup(ProxyResource): + key "etag": str + key "id": str + key "name": str + key "properties": ForwardRef('WorkspaceManagerGroupProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + name: str + properties: WorkspaceManagerGroupProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.WorkspaceManagerGroupProperties(TypedDict, total=False): + key "description": str + key "displayName": Required[str] + key "memberResourceNames": Required[list[str]] + description: str + displayName: str + memberResourceNames: list[str] + + + class azure.mgmt.securityinsight.types.WorkspaceManagerMember(ProxyResource): + key "etag": str + key "id": str + key "name": str + key "properties": ForwardRef('WorkspaceManagerMemberProperties', module='types') + key "systemData": ForwardRef('SystemData', module='types') + key "type": str + etag: str + id: str + name: str + properties: WorkspaceManagerMemberProperties + systemData: SystemData + type: str + + + class azure.mgmt.securityinsight.types.WorkspaceManagerMemberProperties(TypedDict, total=False): + key "targetWorkspaceResourceId": Required[str] + key "targetWorkspaceTenantId": Required[str] + targetWorkspaceResourceId: str + targetWorkspaceTenantId: str + + +``` \ No newline at end of file diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/api.metadata.yml b/sdk/securityinsight/azure-mgmt-securityinsight/api.metadata.yml new file mode 100644 index 000000000000..75f1432ba808 --- /dev/null +++ b/sdk/securityinsight/azure-mgmt-securityinsight/api.metadata.yml @@ -0,0 +1,3 @@ +apiMdSha256: 51645a8843cea15f15b39b9a810ae0b590c95cadd808bcfdece32ecf8b553940 +parserVersion: 0.3.31 +pythonVersion: 3.13.15 diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/apiview-properties.json b/sdk/securityinsight/azure-mgmt-securityinsight/apiview-properties.json index af66bd28ff94..3ac90f69cf6f 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/apiview-properties.json +++ b/sdk/securityinsight/azure-mgmt-securityinsight/apiview-properties.json @@ -600,10 +600,10 @@ "azure.mgmt.securityinsight.models.DeploymentFetchStatus": "Microsoft.SecurityInsights.DeploymentFetchStatus", "azure.mgmt.securityinsight.models.DeploymentState": "Microsoft.SecurityInsights.DeploymentState", "azure.mgmt.securityinsight.models.DeploymentResult": "Microsoft.SecurityInsights.DeploymentResult", - "azure.mgmt.securityinsight.models.State": "Microsoft.SecurityInsights.State", + "azure.mgmt.securityinsight.models.PullRequestState": "Microsoft.SecurityInsights.PullRequestState", "azure.mgmt.securityinsight.models.WarningCode": "Microsoft.SecurityInsights.WarningCode", "azure.mgmt.securityinsight.models.SourceType": "Microsoft.SecurityInsights.SourceType", - "azure.mgmt.securityinsight.models.ProvisioningState": "Microsoft.SecurityInsights.ProvisioningState", + "azure.mgmt.securityinsight.models.WatchlistProvisioningState": "Microsoft.SecurityInsights.WatchlistProvisioningState", "azure.mgmt.securityinsight.models.BillingStatisticKind": "Microsoft.SecurityInsights.BillingStatisticKind", "azure.mgmt.securityinsight.models.EntityQueryKind": "Microsoft.SecurityInsights.EntityQueryKind", "azure.mgmt.securityinsight.models.EntityType": "Microsoft.SecurityInsights.EntityType", @@ -622,22 +622,26 @@ "azure.mgmt.securityinsight.models.SettingKind": "Microsoft.SecurityInsights.SettingKind", "azure.mgmt.securityinsight.models.EntityProviders": "Microsoft.SecurityInsights.EntityProviders", "azure.mgmt.securityinsight.models.UebaDataSources": "Microsoft.SecurityInsights.UebaDataSources", + "azure.mgmt.securityinsight.models.JobProvisioningState": "Microsoft.SecurityInsights.JobProvisioningState", "azure.mgmt.securityinsight.models.Mode": "Microsoft.SecurityInsights.Mode", "azure.mgmt.securityinsight.models.PackageKind": "Microsoft.SecurityInsights.PackageKind", "azure.mgmt.securityinsight.models.Flag": "Microsoft.SecurityInsights.Flag", "azure.mgmt.securityinsight.models.SourceKind": "Microsoft.SecurityInsights.SourceKind", "azure.mgmt.securityinsight.models.SupportTier": "Microsoft.SecurityInsights.SupportTier", "azure.mgmt.securityinsight.models.Kind": "Microsoft.SecurityInsights.Kind", - "azure.mgmt.securityinsight.models.Operator": "Microsoft.SecurityInsights.Operator", + "azure.mgmt.securityinsight.models.MetadataDependencyOperator": "Microsoft.SecurityInsights.MetadataDependencyOperator", "azure.mgmt.securityinsight.models.ThreatIntelligenceResourceKindEnum": "Microsoft.SecurityInsights.ThreatIntelligenceResourceInnerKind", "azure.mgmt.securityinsight.models.ThreatIntelligenceSortingCriteriaEnum": "Microsoft.SecurityInsights.ThreatIntelligenceSortingOrder", "azure.mgmt.securityinsight.models.DataConnectorAuthorizationState": "Microsoft.SecurityInsights.DataConnectorAuthorizationState", "azure.mgmt.securityinsight.models.DataConnectorLicenseState": "Microsoft.SecurityInsights.DataConnectorLicenseState", "azure.mgmt.securityinsight.models.TiType": "Microsoft.SecurityInsights.TiType", "azure.mgmt.securityinsight.models.Connective": "Microsoft.SecurityInsights.Connective", + "azure.mgmt.securityinsight.models.Operator": "Microsoft.SecurityInsights.Operator", "azure.mgmt.securityinsight.models.TIObjectKind": "Microsoft.SecurityInsights.TIObjectKind", "azure.mgmt.securityinsight.models.SortingDirection": "Microsoft.SecurityInsights.SortingDirection", "azure.mgmt.securityinsight.models.EntityTimelineKind": "Microsoft.SecurityInsights.EntityTimelineKind", + "azure.mgmt.securityinsight.models.State": "Microsoft.SecurityInsights.State", + "azure.mgmt.securityinsight.models.ProvisioningState": "Microsoft.SecurityInsights.ProvisioningState", "azure.mgmt.securityinsight.models.EnrichmentType": "Microsoft.SecurityInsights.EnrichmentType", "azure.mgmt.securityinsight.operations.Operations.list": "Azure.ResourceManager.Legacy.Operations.list", "azure.mgmt.securityinsight.aio.operations.Operations.list": "Azure.ResourceManager.Legacy.Operations.list", @@ -986,5 +990,5 @@ "azure.mgmt.securityinsight.SecurityInsightsMgmtClient.list_whois_by_domain": "Microsoft.SecurityInsights.listWhoisByDomain", "azure.mgmt.securityinsight.aio.SecurityInsightsMgmtClient.list_whois_by_domain": "Microsoft.SecurityInsights.listWhoisByDomain" }, - "CrossLanguageVersion": "5735b822bf11" + "CrossLanguageVersion": "5e2df49c528c" } \ No newline at end of file diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/_client.py b/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/_client.py index be3325c6be6b..ca82c6891fc1 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/_client.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/_client.py @@ -94,7 +94,7 @@ class SecurityInsightsMgmtClient( _SecurityInsightsMgmtClientOperationsMixin -): # pylint: disable=too-many-instance-attributes +): # pylint: disable=too-many-instance-attributes,docstring-keyword-should-match-keyword-only """API spec for Microsoft.SecurityInsights (Azure Security Insights) resource provider. :ivar operations: Operations operations @@ -245,7 +245,7 @@ class SecurityInsightsMgmtClient( None. :paramtype cloud_setting: ~azure.core.AzureClouds :keyword api_version: The API version to use for this operation. Known values are - "2025-07-01-preview" and None. Default value is None. If not set, the operation's default API + "2025-10-01-preview" and None. Default value is None. If not set, the operation's default API version will be used. Note that overriding this default value may result in unsupported behavior. :paramtype api_version: str diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/_configuration.py b/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/_configuration.py index 9d45e08bf2d2..7d054289002d 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/_configuration.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/_configuration.py @@ -1,3 +1,4 @@ +# pylint: disable=line-too-long,useless-suppression # coding=utf-8 # -------------------------------------------------------------------------- # Copyright (c) Microsoft Corporation. All rights reserved. @@ -18,7 +19,7 @@ from azure.core.credentials import TokenCredential -class SecurityInsightsMgmtClientConfiguration: # pylint: disable=too-many-instance-attributes +class SecurityInsightsMgmtClientConfiguration: # pylint: disable=too-many-instance-attributes,docstring-keyword-should-match-keyword-only """Configuration for SecurityInsightsMgmtClient. Note that all parameters used to create this instance are saved as instance @@ -34,7 +35,7 @@ class SecurityInsightsMgmtClientConfiguration: # pylint: disable=too-many-insta None. :type cloud_setting: ~azure.core.AzureClouds :keyword api_version: The API version to use for this operation. Known values are - "2025-07-01-preview" and None. Default value is None. If not set, the operation's default API + "2025-10-01-preview" and None. Default value is None. If not set, the operation's default API version will be used. Note that overriding this default value may result in unsupported behavior. :paramtype api_version: str @@ -48,7 +49,7 @@ def __init__( cloud_setting: Optional["AzureClouds"] = None, **kwargs: Any ) -> None: - api_version: str = kwargs.pop("api_version", "2025-07-01-preview") + api_version: str = kwargs.pop("api_version", "2025-10-01-preview") if credential is None: raise ValueError("Parameter 'credential' must not be None.") diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/_utils/model_base.py b/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/_utils/model_base.py index bd5b9caf1022..88aaf1823543 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/_utils/model_base.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/_utils/model_base.py @@ -109,6 +109,29 @@ def _serialize_bytes(o, format: typing.Optional[str] = None) -> str: return encoded +def _serialize_duration(td: timedelta, format: typing.Optional[str] = None): + """Serialize a timedelta to its wire representation. + + For the ``seconds``/``milliseconds`` encodings the value is converted to a + numeric value, otherwise it falls back to an ISO 8601 duration string. + + :param timedelta td: The timedelta to serialize. + :param str format: The duration encoding format. + :rtype: int or float or str + :return: serialized duration + """ + seconds = td.total_seconds() + if format == "duration-seconds-int": + return int(seconds) + if format == "duration-seconds-float": + return seconds + if format == "duration-milliseconds-int": + return int(seconds * 1000) + if format == "duration-milliseconds-float": + return seconds * 1000 + return _timedelta_as_isostr(td) + + def _serialize_datetime(o, format: typing.Optional[str] = None): if hasattr(o, "year") and hasattr(o, "hour"): if format == "rfc7231": @@ -135,7 +158,15 @@ def _is_readonly(p): class SdkJSONEncoder(JSONEncoder): - """A JSON encoder that's capable of serializing datetime objects and bytes.""" + """A JSON encoder that's capable of serializing datetime objects and bytes. + + :param args: Additional positional arguments passed to the base ``JSONEncoder``. + :type args: typing.Any + :keyword exclude_readonly: Whether to exclude readonly properties. Defaults to False. + :paramtype exclude_readonly: bool + :keyword format: The format to use for serialization. Defaults to None. + :paramtype format: typing.Optional[str] + """ def __init__(self, *args, exclude_readonly: bool = False, format: typing.Optional[str] = None, **kwargs): super().__init__(*args, **kwargs) @@ -301,6 +332,12 @@ def _deserialize_duration(attr): return isodate.parse_duration(attr) +def _deserialize_duration_numeric(attr, unit): + if isinstance(attr, timedelta): + return attr + return timedelta(**{unit: float(attr)}) + + def _deserialize_decimal(attr): if isinstance(attr, decimal.Decimal): return attr @@ -313,6 +350,12 @@ def _deserialize_int_as_str(attr): return int(attr) +def _deserialize_bool_as_str(attr): + if isinstance(attr, bool): + return attr + return attr.lower() == "true" + + _DESERIALIZE_MAPPING = { datetime: _deserialize_datetime, date: _deserialize_date, @@ -330,12 +373,18 @@ def _deserialize_int_as_str(attr): "unix-timestamp": _deserialize_datetime_unix_timestamp, "base64": _deserialize_bytes, "base64url": _deserialize_bytes_base64, + "duration-seconds-int": functools.partial(_deserialize_duration_numeric, unit="seconds"), + "duration-seconds-float": functools.partial(_deserialize_duration_numeric, unit="seconds"), + "duration-milliseconds-int": functools.partial(_deserialize_duration_numeric, unit="milliseconds"), + "duration-milliseconds-float": functools.partial(_deserialize_duration_numeric, unit="milliseconds"), } def get_deserializer(annotation: typing.Any, rf: typing.Optional["_RestField"] = None): if annotation is int and rf and rf._format == "str": return _deserialize_int_as_str + if annotation is bool and rf and rf._format == "str": + return _deserialize_bool_as_str if annotation is str and rf and rf._format in _ARRAY_ENCODE_MAPPING: return functools.partial(_deserialize_array_encoded, _ARRAY_ENCODE_MAPPING[rf._format]) if rf and rf._format: @@ -425,21 +474,21 @@ def __ne__(self, other: typing.Any) -> bool: def keys(self) -> typing.KeysView[str]: """ - :returns: a set-like object providing a view on D's keys + :returns: a set-like object providing a view on the mapping's keys :rtype: ~typing.KeysView """ return self._data.keys() def values(self) -> typing.ValuesView[typing.Any]: """ - :returns: an object providing a view on D's values + :returns: an object providing a view on the mapping's values :rtype: ~typing.ValuesView """ return self._data.values() def items(self) -> typing.ItemsView[str, typing.Any]: """ - :returns: set-like object providing a view on D's items + :returns: a set-like object providing a view on the mapping's items :rtype: ~typing.ItemsView """ return self._data.items() @@ -449,7 +498,7 @@ def get(self, key: str, default: typing.Any = None) -> typing.Any: Get the value for key if key is in the dictionary, else default. :param str key: The key to look up. :param any default: The value to return if key is not in the dictionary. Defaults to None - :returns: D[k] if k in D, else d. + :returns: The value for key if key is in the dictionary, else default. :rtype: any """ try: @@ -484,19 +533,19 @@ def popitem(self) -> tuple[str, typing.Any]: Removes and returns some (key, value) pair :returns: The (key, value) pair. :rtype: tuple - :raises KeyError: if D is empty. + :raises KeyError: if the dictionary is empty. """ return self._data.popitem() def clear(self) -> None: """ - Remove all items from D. + Remove all items from the dictionary. """ self._data.clear() def update(self, *args: typing.Any, **kwargs: typing.Any) -> None: # pylint: disable=arguments-differ """ - Updates D from mapping/iterable E and F. + Update the dictionary from a mapping or an iterable of key-value pairs. :param any args: Either a mapping object or an iterable of key-value pairs. """ self._data.update(*args, **kwargs) @@ -509,10 +558,11 @@ def setdefault(self, key: str, default: typing.Any) -> typing.Any: ... # pylint def setdefault(self, key: str, default: typing.Any = _UNSET) -> typing.Any: """ - Same as calling D.get(k, d), and setting D[k]=d if k not found + Return the value for key if key is in the dictionary; otherwise set the key to + default and return default. :param str key: The key to look up. :param any default: The value to set if key is not in the dictionary - :returns: D[k] if k in D, else d. + :returns: The value for key if key is in the dictionary, else default. :rtype: any """ if default is _UNSET: @@ -564,7 +614,7 @@ def _serialize(o, format: typing.Optional[str] = None): # pylint: disable=too-m pass # Last, try datetime.timedelta try: - return _timedelta_as_isostr(o) + return _serialize_duration(o, format) except AttributeError: # This will be raised when it hits value.total_seconds in the method above pass diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/_utils/serialization.py b/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/_utils/serialization.py index a088671e9c51..ae08f9d89f74 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/_utils/serialization.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/_utils/serialization.py @@ -480,7 +480,11 @@ def _decode_attribute_map_key(key): class Serializer: # pylint: disable=too-many-public-methods - """Request object model serializer.""" + """Request object model serializer. + + :param classes: Mapping of model names to model types, used to resolve models during serialization. + :type classes: typing.Optional[typing.Mapping[str, type]] + """ basic_types = {str: "str", int: "int", bool: "bool", float: "float"} @@ -520,6 +524,10 @@ def __init__(self, classes: Optional[Mapping[str, type]] = None) -> None: "rfc-1123": Serializer.serialize_rfc, "unix-time": Serializer.serialize_unix, "duration": Serializer.serialize_duration, + "duration-seconds-int": Serializer.serialize_duration_seconds_int, + "duration-seconds-float": Serializer.serialize_duration_seconds_float, + "duration-milliseconds-int": Serializer.serialize_duration_milliseconds_int, + "duration-milliseconds-float": Serializer.serialize_duration_milliseconds_float, "date": Serializer.serialize_date, "time": Serializer.serialize_time, "decimal": Serializer.serialize_decimal, @@ -1109,6 +1117,61 @@ def serialize_duration(attr, **kwargs): # pylint: disable=unused-argument attr = isodate.parse_duration(attr) return isodate.duration_isoformat(attr) + @staticmethod + def _serialize_duration_numeric(attr, scale, as_int): + """Serialize a TimeDelta into a numeric value scaled to the wire unit. + + :param TimeDelta attr: Object to be serialized. + :param int scale: Multiplier applied to total seconds (1 for seconds, 1000 for milliseconds). + :param bool as_int: Whether to truncate the result to an int. + :rtype: int or float + :return: serialized duration + """ + if isinstance(attr, str): + attr = isodate.parse_duration(attr) + value = attr.total_seconds() * scale if isinstance(attr, datetime.timedelta) else attr + return int(value) if as_int else float(value) + + @staticmethod + def serialize_duration_seconds_int(attr, **kwargs): # pylint: disable=unused-argument + """Serialize TimeDelta object into an integer number of seconds. + + :param TimeDelta attr: Object to be serialized. + :rtype: int + :return: serialized duration + """ + return Serializer._serialize_duration_numeric(attr, 1, True) + + @staticmethod + def serialize_duration_seconds_float(attr, **kwargs): # pylint: disable=unused-argument + """Serialize TimeDelta object into a floating point number of seconds. + + :param TimeDelta attr: Object to be serialized. + :rtype: float + :return: serialized duration + """ + return Serializer._serialize_duration_numeric(attr, 1, False) + + @staticmethod + def serialize_duration_milliseconds_int(attr, **kwargs): # pylint: disable=unused-argument + """Serialize TimeDelta object into an integer number of milliseconds. + + :param TimeDelta attr: Object to be serialized. + :rtype: int + :return: serialized duration + """ + return Serializer._serialize_duration_numeric(attr, 1000, True) + + @staticmethod + def serialize_duration_milliseconds_float(attr, **kwargs): # pylint: disable=unused-argument + """Serialize TimeDelta object into a floating point number of milliseconds. + + :param TimeDelta attr: Object to be serialized. + :rtype: float + :return: serialized duration + """ + return Serializer._serialize_duration_numeric(attr, 1000, False) + @staticmethod def serialize_rfc(attr, **kwargs): # pylint: disable=unused-argument """Serialize Datetime object into RFC-1123 formatted string. @@ -1381,6 +1444,10 @@ def __init__(self, classes: Optional[Mapping[str, type]] = None) -> None: "rfc-1123": Deserializer.deserialize_rfc, "unix-time": Deserializer.deserialize_unix, "duration": Deserializer.deserialize_duration, + "duration-seconds-int": Deserializer.deserialize_duration_seconds, + "duration-seconds-float": Deserializer.deserialize_duration_seconds, + "duration-milliseconds-int": Deserializer.deserialize_duration_milliseconds, + "duration-milliseconds-float": Deserializer.deserialize_duration_milliseconds, "date": Deserializer.deserialize_date, "time": Deserializer.deserialize_time, "decimal": Deserializer.deserialize_decimal, @@ -1393,6 +1460,10 @@ def __init__(self, classes: Optional[Mapping[str, type]] = None) -> None: } self.deserialize_expected_types = { "duration": (isodate.Duration, datetime.timedelta), + "duration-seconds-int": (isodate.Duration, datetime.timedelta), + "duration-seconds-float": (isodate.Duration, datetime.timedelta), + "duration-milliseconds-int": (isodate.Duration, datetime.timedelta), + "duration-milliseconds-float": (isodate.Duration, datetime.timedelta), "iso-8601": (datetime.datetime), } self.dependencies: dict[str, type] = dict(classes) if classes else {} @@ -1954,6 +2025,48 @@ def deserialize_duration(attr): raise DeserializationError(msg) from err return duration + @staticmethod + def _deserialize_duration_numeric(attr, unit): + """Deserialize a numeric duration value into a TimeDelta object. + + :param float attr: response value to be deserialized. + :param str unit: The wire unit, used as the ``timedelta`` keyword + (``"seconds"`` or ``"milliseconds"``). + :return: Deserialized duration + :rtype: TimeDelta + :raises DeserializationError: if value is invalid. + """ + if isinstance(attr, ET.Element): + attr = attr.text + try: + duration = datetime.timedelta(**{unit: float(attr)}) # type: ignore + except (ValueError, OverflowError, TypeError) as err: + msg = "Cannot deserialize duration object." + raise DeserializationError(msg) from err + return duration + + @staticmethod + def deserialize_duration_seconds(attr): + """Deserialize a numeric number of seconds into a TimeDelta object. + + :param float attr: response value to be deserialized. + :return: Deserialized duration + :rtype: TimeDelta + :raises DeserializationError: if value is invalid. + """ + return Deserializer._deserialize_duration_numeric(attr, "seconds") + + @staticmethod + def deserialize_duration_milliseconds(attr): + """Deserialize a numeric number of milliseconds into a TimeDelta object. + + :param float attr: response value to be deserialized. + :return: Deserialized duration + :rtype: TimeDelta + :raises DeserializationError: if value is invalid. + """ + return Deserializer._deserialize_duration_numeric(attr, "milliseconds") + @staticmethod def deserialize_date(attr): """Deserialize ISO-8601 formatted string into Date object. diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/_validation.py b/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/_validation.py new file mode 100644 index 000000000000..f5af3a4eb8a2 --- /dev/null +++ b/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/_validation.py @@ -0,0 +1,66 @@ +# -------------------------------------------------------------------------- +# Copyright (c) Microsoft Corporation. All rights reserved. +# Licensed under the MIT License. See License.txt in the project root for license information. +# Code generated by Microsoft (R) Python Code Generator. +# Changes may cause incorrect behavior and will be lost if the code is regenerated. +# -------------------------------------------------------------------------- +import functools + + +def api_version_validation(**kwargs): + params_added_on = kwargs.pop("params_added_on", {}) + method_added_on = kwargs.pop("method_added_on", "") + api_versions_list = kwargs.pop("api_versions_list", []) + + def _index_with_default(value: str, default: int = -1) -> int: + """Get the index of value in lst, or return default if not found. + + :param value: The value to search for in the api_versions_list. + :type value: str + :param default: The default value to return if the value is not found. + :type default: int + :return: The index of the value in the list, or the default value if not found. + :rtype: int + """ + try: + return api_versions_list.index(value) + except ValueError: + return default + + def decorator(func): + @functools.wraps(func) + def wrapper(*args, **kwargs): + try: + # this assumes the client has an _api_version attribute + client = args[0] + client_api_version = client._config.api_version # pylint: disable=protected-access + except AttributeError: + return func(*args, **kwargs) + + if _index_with_default(method_added_on) > _index_with_default(client_api_version): + raise ValueError( + f"'{func.__name__}' is not available in API version " + f"{client_api_version}. Pass service API version {method_added_on} or newer to your client." + ) + + unsupported = { + parameter: api_version + for api_version, parameters in params_added_on.items() + for parameter in parameters + if parameter in kwargs and _index_with_default(api_version) > _index_with_default(client_api_version) + } + if unsupported: + raise ValueError( + "".join( + [ + f"'{param}' is not available in API version {client_api_version}. " + f"Use service API version {version} or newer.\n" + for param, version in unsupported.items() + ] + ) + ) + return func(*args, **kwargs) + + return wrapper + + return decorator diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/_version.py b/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/_version.py index 2e7efc3e2e20..f6038f74ae41 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/_version.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/_version.py @@ -6,4 +6,4 @@ # Changes may cause incorrect behavior and will be lost if the code is regenerated. # -------------------------------------------------------------------------- -VERSION = "2.0.0b3" +VERSION = "2.0.0b4" diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/aio/_client.py b/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/aio/_client.py index 8e488a10cf5b..ffa7687c637b 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/aio/_client.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/aio/_client.py @@ -94,7 +94,7 @@ class SecurityInsightsMgmtClient( _SecurityInsightsMgmtClientOperationsMixin -): # pylint: disable=too-many-instance-attributes +): # pylint: disable=too-many-instance-attributes,docstring-keyword-should-match-keyword-only """API spec for Microsoft.SecurityInsights (Azure Security Insights) resource provider. :ivar operations: Operations operations @@ -252,7 +252,7 @@ class SecurityInsightsMgmtClient( None. :paramtype cloud_setting: ~azure.core.AzureClouds :keyword api_version: The API version to use for this operation. Known values are - "2025-07-01-preview" and None. Default value is None. If not set, the operation's default API + "2025-10-01-preview" and None. Default value is None. If not set, the operation's default API version will be used. Note that overriding this default value may result in unsupported behavior. :paramtype api_version: str diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/aio/_configuration.py b/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/aio/_configuration.py index 277f4e75dea9..98d51105626c 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/aio/_configuration.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/aio/_configuration.py @@ -1,3 +1,4 @@ +# pylint: disable=line-too-long,useless-suppression # coding=utf-8 # -------------------------------------------------------------------------- # Copyright (c) Microsoft Corporation. All rights reserved. @@ -18,7 +19,7 @@ from azure.core.credentials_async import AsyncTokenCredential -class SecurityInsightsMgmtClientConfiguration: # pylint: disable=too-many-instance-attributes +class SecurityInsightsMgmtClientConfiguration: # pylint: disable=too-many-instance-attributes,docstring-keyword-should-match-keyword-only """Configuration for SecurityInsightsMgmtClient. Note that all parameters used to create this instance are saved as instance @@ -34,7 +35,7 @@ class SecurityInsightsMgmtClientConfiguration: # pylint: disable=too-many-insta None. :type cloud_setting: ~azure.core.AzureClouds :keyword api_version: The API version to use for this operation. Known values are - "2025-07-01-preview" and None. Default value is None. If not set, the operation's default API + "2025-10-01-preview" and None. Default value is None. If not set, the operation's default API version will be used. Note that overriding this default value may result in unsupported behavior. :paramtype api_version: str @@ -48,7 +49,7 @@ def __init__( cloud_setting: Optional["AzureClouds"] = None, **kwargs: Any ) -> None: - api_version: str = kwargs.pop("api_version", "2025-07-01-preview") + api_version: str = kwargs.pop("api_version", "2025-10-01-preview") if credential is None: raise ValueError("Parameter 'credential' must not be None.") diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/aio/operations/_operations.py b/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/aio/operations/_operations.py index c298fc9af5dd..d06f29d79028 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/aio/operations/_operations.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/aio/operations/_operations.py @@ -33,10 +33,11 @@ from azure.mgmt.core.exceptions import ARMErrorFormat from azure.mgmt.core.polling.async_arm_polling import AsyncARMPolling -from ... import models as _models +from ... import models as _models, types as _types from ..._utils.model_base import SdkJSONEncoder, _deserialize, _failsafe_deserialize from ..._utils.serialization import Deserializer, Serializer from ..._utils.utils import ClientMixinABC +from ..._validation import api_version_validation from ...operations._operations import ( build_actions_create_or_update_request, build_actions_delete_request, @@ -216,11 +217,10 @@ T = TypeVar("T") ClsType = Optional[Callable[[PipelineResponse[HttpRequest, AsyncHttpResponse], T, dict[str, Any]], Any]] -JSON = MutableMapping[str, Any] List = list -class Operations: +class Operations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -332,7 +332,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class AlertRulesOperations: +class AlertRulesOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -462,7 +462,7 @@ async def create_or_update( resource_group_name: str, workspace_name: str, rule_id: str, - alert_rule: JSON, + alert_rule: _types.AlertRule, *, content_type: str = "application/json", **kwargs: Any @@ -477,7 +477,7 @@ async def create_or_update( :param rule_id: Alert rule ID. Required. :type rule_id: str :param alert_rule: The alert rule. Required. - :type alert_rule: JSON + :type alert_rule: ~azure.mgmt.securityinsight.types.AlertRule :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -522,7 +522,7 @@ async def create_or_update( resource_group_name: str, workspace_name: str, rule_id: str, - alert_rule: Union[_models.AlertRule, JSON, IO[bytes]], + alert_rule: Union[_models.AlertRule, _types.AlertRule, IO[bytes]], **kwargs: Any ) -> _models.AlertRule: """Creates or updates the alert rule. @@ -534,9 +534,9 @@ async def create_or_update( :type workspace_name: str :param rule_id: Alert rule ID. Required. :type rule_id: str - :param alert_rule: The alert rule. Is one of the following types: AlertRule, JSON, IO[bytes] - Required. - :type alert_rule: ~azure.mgmt.securityinsight.models.AlertRule or JSON or IO[bytes] + :param alert_rule: The alert rule. Is either a AlertRule type or a IO[bytes] type. Required. + :type alert_rule: ~azure.mgmt.securityinsight.models.AlertRule or + ~azure.mgmt.securityinsight.types.AlertRule or IO[bytes] :return: AlertRule. The AlertRule is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.AlertRule :raises ~azure.core.exceptions.HttpResponseError: @@ -770,7 +770,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class AlertRuleTemplatesOperations: +class AlertRuleTemplatesOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -968,7 +968,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class AutomationRulesOperations: +class AutomationRulesOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -1098,7 +1098,7 @@ async def create_or_update( resource_group_name: str, workspace_name: str, automation_rule_id: str, - automation_rule_to_upsert: Optional[JSON] = None, + automation_rule_to_upsert: Optional[_types.AutomationRule] = None, *, content_type: str = "application/json", **kwargs: Any @@ -1113,7 +1113,7 @@ async def create_or_update( :param automation_rule_id: The automation rule ID. Required. :type automation_rule_id: str :param automation_rule_to_upsert: The automation rule. Default value is None. - :type automation_rule_to_upsert: JSON + :type automation_rule_to_upsert: ~azure.mgmt.securityinsight.types.AutomationRule :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -1158,7 +1158,7 @@ async def create_or_update( resource_group_name: str, workspace_name: str, automation_rule_id: str, - automation_rule_to_upsert: Optional[Union[_models.AutomationRule, JSON, IO[bytes]]] = None, + automation_rule_to_upsert: Optional[Union[_models.AutomationRule, _types.AutomationRule, IO[bytes]]] = None, **kwargs: Any ) -> _models.AutomationRule: """Creates or updates the automation rule. @@ -1170,10 +1170,10 @@ async def create_or_update( :type workspace_name: str :param automation_rule_id: The automation rule ID. Required. :type automation_rule_id: str - :param automation_rule_to_upsert: The automation rule. Is one of the following types: - AutomationRule, JSON, IO[bytes] Default value is None. - :type automation_rule_to_upsert: ~azure.mgmt.securityinsight.models.AutomationRule or JSON or - IO[bytes] + :param automation_rule_to_upsert: The automation rule. Is either a AutomationRule type or a + IO[bytes] type. Default value is None. + :type automation_rule_to_upsert: ~azure.mgmt.securityinsight.models.AutomationRule or + ~azure.mgmt.securityinsight.types.AutomationRule or IO[bytes] :return: AutomationRule. The AutomationRule is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.AutomationRule :raises ~azure.core.exceptions.HttpResponseError: @@ -1429,7 +1429,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class IncidentsOperations: +class IncidentsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -1559,7 +1559,7 @@ async def create_or_update( resource_group_name: str, workspace_name: str, incident_id: str, - incident: JSON, + incident: _types.Incident, *, content_type: str = "application/json", **kwargs: Any @@ -1574,7 +1574,7 @@ async def create_or_update( :param incident_id: Incident ID. Required. :type incident_id: str :param incident: The incident. Required. - :type incident: JSON + :type incident: ~azure.mgmt.securityinsight.types.Incident :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -1619,7 +1619,7 @@ async def create_or_update( resource_group_name: str, workspace_name: str, incident_id: str, - incident: Union[_models.Incident, JSON, IO[bytes]], + incident: Union[_models.Incident, _types.Incident, IO[bytes]], **kwargs: Any ) -> _models.Incident: """Creates or updates an incident. @@ -1631,9 +1631,9 @@ async def create_or_update( :type workspace_name: str :param incident_id: Incident ID. Required. :type incident_id: str - :param incident: The incident. Is one of the following types: Incident, JSON, IO[bytes] - Required. - :type incident: ~azure.mgmt.securityinsight.models.Incident or JSON or IO[bytes] + :param incident: The incident. Is either a Incident type or a IO[bytes] type. Required. + :type incident: ~azure.mgmt.securityinsight.models.Incident or + ~azure.mgmt.securityinsight.types.Incident or IO[bytes] :return: Incident. The Incident is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.Incident :raises ~azure.core.exceptions.HttpResponseError: @@ -1929,7 +1929,7 @@ async def run_playbook( resource_group_name: str, workspace_name: str, incident_identifier: str, - request_body: Optional[JSON] = None, + request_body: Optional[_types.ManualTriggerRequestBody] = None, *, content_type: str = "application/json", **kwargs: Any @@ -1945,7 +1945,7 @@ async def run_playbook( :type incident_identifier: str :param request_body: Describes the request body for triggering a playbook on an incident. Default value is None. - :type request_body: JSON + :type request_body: ~azure.mgmt.securityinsight.types.ManualTriggerRequestBody :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -1991,7 +1991,9 @@ async def run_playbook( resource_group_name: str, workspace_name: str, incident_identifier: str, - request_body: Optional[Union[_models.ManualTriggerRequestBody, JSON, IO[bytes]]] = None, + request_body: Optional[ + Union[_models.ManualTriggerRequestBody, _types.ManualTriggerRequestBody, IO[bytes]] + ] = None, **kwargs: Any ) -> Any: """Triggers playbook on a specific incident. @@ -2004,9 +2006,9 @@ async def run_playbook( :param incident_identifier: The incident identifier. Required. :type incident_identifier: str :param request_body: Describes the request body for triggering a playbook on an incident. Is - one of the following types: ManualTriggerRequestBody, JSON, IO[bytes] Default value is None. - :type request_body: ~azure.mgmt.securityinsight.models.ManualTriggerRequestBody or JSON or - IO[bytes] + either a ManualTriggerRequestBody type or a IO[bytes] type. Default value is None. + :type request_body: ~azure.mgmt.securityinsight.models.ManualTriggerRequestBody or + ~azure.mgmt.securityinsight.types.ManualTriggerRequestBody or IO[bytes] :return: any :rtype: any :raises ~azure.core.exceptions.HttpResponseError: @@ -2310,7 +2312,7 @@ async def list_entities( return deserialized # type: ignore -class BookmarksOperations: +class BookmarksOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -2440,7 +2442,7 @@ async def create_or_update( resource_group_name: str, workspace_name: str, bookmark_id: str, - bookmark: JSON, + bookmark: _types.Bookmark, *, content_type: str = "application/json", **kwargs: Any @@ -2455,7 +2457,7 @@ async def create_or_update( :param bookmark_id: Bookmark ID. Required. :type bookmark_id: str :param bookmark: The bookmark. Required. - :type bookmark: JSON + :type bookmark: ~azure.mgmt.securityinsight.types.Bookmark :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -2500,7 +2502,7 @@ async def create_or_update( resource_group_name: str, workspace_name: str, bookmark_id: str, - bookmark: Union[_models.Bookmark, JSON, IO[bytes]], + bookmark: Union[_models.Bookmark, _types.Bookmark, IO[bytes]], **kwargs: Any ) -> _models.Bookmark: """Creates or updates the bookmark. @@ -2512,9 +2514,9 @@ async def create_or_update( :type workspace_name: str :param bookmark_id: Bookmark ID. Required. :type bookmark_id: str - :param bookmark: The bookmark. Is one of the following types: Bookmark, JSON, IO[bytes] - Required. - :type bookmark: ~azure.mgmt.securityinsight.models.Bookmark or JSON or IO[bytes] + :param bookmark: The bookmark. Is either a Bookmark type or a IO[bytes] type. Required. + :type bookmark: ~azure.mgmt.securityinsight.models.Bookmark or + ~azure.mgmt.securityinsight.types.Bookmark or IO[bytes] :return: Bookmark. The Bookmark is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.Bookmark :raises ~azure.core.exceptions.HttpResponseError: @@ -2748,7 +2750,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class DataConnectorDefinitionsOperations: +class DataConnectorDefinitionsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -2878,7 +2880,7 @@ async def create_or_update( resource_group_name: str, workspace_name: str, data_connector_definition_name: str, - connector_definition_input: JSON, + connector_definition_input: _types.DataConnectorDefinition, *, content_type: str = "application/json", **kwargs: Any @@ -2893,7 +2895,7 @@ async def create_or_update( :param data_connector_definition_name: The data connector definition name. Required. :type data_connector_definition_name: str :param connector_definition_input: The data connector definition. Required. - :type connector_definition_input: JSON + :type connector_definition_input: ~azure.mgmt.securityinsight.types.DataConnectorDefinition :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -2938,7 +2940,7 @@ async def create_or_update( resource_group_name: str, workspace_name: str, data_connector_definition_name: str, - connector_definition_input: Union[_models.DataConnectorDefinition, JSON, IO[bytes]], + connector_definition_input: Union[_models.DataConnectorDefinition, _types.DataConnectorDefinition, IO[bytes]], **kwargs: Any ) -> _models.DataConnectorDefinition: """Creates or updates the data connector definition. @@ -2950,10 +2952,10 @@ async def create_or_update( :type workspace_name: str :param data_connector_definition_name: The data connector definition name. Required. :type data_connector_definition_name: str - :param connector_definition_input: The data connector definition. Is one of the following - types: DataConnectorDefinition, JSON, IO[bytes] Required. + :param connector_definition_input: The data connector definition. Is either a + DataConnectorDefinition type or a IO[bytes] type. Required. :type connector_definition_input: ~azure.mgmt.securityinsight.models.DataConnectorDefinition or - JSON or IO[bytes] + ~azure.mgmt.securityinsight.types.DataConnectorDefinition or IO[bytes] :return: DataConnectorDefinition. The DataConnectorDefinition is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.DataConnectorDefinition :raises ~azure.core.exceptions.HttpResponseError: @@ -3192,7 +3194,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class DataConnectorsOperations: +class DataConnectorsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -3322,7 +3324,7 @@ async def create_or_update( resource_group_name: str, workspace_name: str, data_connector_id: str, - data_connector: JSON, + data_connector: _types.DataConnector, *, content_type: str = "application/json", **kwargs: Any @@ -3337,7 +3339,7 @@ async def create_or_update( :param data_connector_id: Connector ID. Required. :type data_connector_id: str :param data_connector: The data connector. Required. - :type data_connector: JSON + :type data_connector: ~azure.mgmt.securityinsight.types.DataConnector :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -3382,7 +3384,7 @@ async def create_or_update( resource_group_name: str, workspace_name: str, data_connector_id: str, - data_connector: Union[_models.DataConnector, JSON, IO[bytes]], + data_connector: Union[_models.DataConnector, _types.DataConnector, IO[bytes]], **kwargs: Any ) -> _models.DataConnector: """Creates or updates the data connector. @@ -3394,9 +3396,10 @@ async def create_or_update( :type workspace_name: str :param data_connector_id: Connector ID. Required. :type data_connector_id: str - :param data_connector: The data connector. Is one of the following types: DataConnector, JSON, - IO[bytes] Required. - :type data_connector: ~azure.mgmt.securityinsight.models.DataConnector or JSON or IO[bytes] + :param data_connector: The data connector. Is either a DataConnector type or a IO[bytes] type. + Required. + :type data_connector: ~azure.mgmt.securityinsight.models.DataConnector or + ~azure.mgmt.securityinsight.types.DataConnector or IO[bytes] :return: DataConnector. The DataConnector is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.DataConnector :raises ~azure.core.exceptions.HttpResponseError: @@ -3670,7 +3673,7 @@ async def connect( resource_group_name: str, workspace_name: str, data_connector_id: str, - connect_body: JSON, + connect_body: _types.DataConnectorConnectBody, *, content_type: str = "application/json", **kwargs: Any @@ -3685,7 +3688,7 @@ async def connect( :param data_connector_id: Connector ID. Required. :type data_connector_id: str :param connect_body: The content of the action request. Required. - :type connect_body: JSON + :type connect_body: ~azure.mgmt.securityinsight.types.DataConnectorConnectBody :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -3725,12 +3728,26 @@ async def connect( """ @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "data_connector_id", + "content_type", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def connect( self, resource_group_name: str, workspace_name: str, data_connector_id: str, - connect_body: Union[_models.DataConnectorConnectBody, JSON, IO[bytes]], + connect_body: Union[_models.DataConnectorConnectBody, _types.DataConnectorConnectBody, IO[bytes]], **kwargs: Any ) -> None: """Connects a data connector. @@ -3742,10 +3759,10 @@ async def connect( :type workspace_name: str :param data_connector_id: Connector ID. Required. :type data_connector_id: str - :param connect_body: The content of the action request. Is one of the following types: - DataConnectorConnectBody, JSON, IO[bytes] Required. - :type connect_body: ~azure.mgmt.securityinsight.models.DataConnectorConnectBody or JSON or - IO[bytes] + :param connect_body: The content of the action request. Is either a DataConnectorConnectBody + type or a IO[bytes] type. Required. + :type connect_body: ~azure.mgmt.securityinsight.models.DataConnectorConnectBody or + ~azure.mgmt.securityinsight.types.DataConnectorConnectBody or IO[bytes] :return: None :rtype: None :raises ~azure.core.exceptions.HttpResponseError: @@ -3806,6 +3823,19 @@ async def connect( return cls(pipeline_response, None, {}) # type: ignore @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "data_connector_id", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def disconnect( self, resource_group_name: str, workspace_name: str, data_connector_id: str, **kwargs: Any ) -> None: @@ -3868,7 +3898,7 @@ async def disconnect( return cls(pipeline_response, None, {}) # type: ignore -class IncidentCommentsOperations: +class IncidentCommentsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -4005,7 +4035,7 @@ async def create_or_update( workspace_name: str, incident_id: str, incident_comment_id: str, - incident_comment: JSON, + incident_comment: _types.IncidentComment, *, content_type: str = "application/json", **kwargs: Any @@ -4022,7 +4052,7 @@ async def create_or_update( :param incident_comment_id: Incident comment ID. Required. :type incident_comment_id: str :param incident_comment: The incident comment. Required. - :type incident_comment: JSON + :type incident_comment: ~azure.mgmt.securityinsight.types.IncidentComment :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -4071,7 +4101,7 @@ async def create_or_update( workspace_name: str, incident_id: str, incident_comment_id: str, - incident_comment: Union[_models.IncidentComment, JSON, IO[bytes]], + incident_comment: Union[_models.IncidentComment, _types.IncidentComment, IO[bytes]], **kwargs: Any ) -> _models.IncidentComment: """Creates or updates a comment for a given incident. @@ -4085,9 +4115,10 @@ async def create_or_update( :type incident_id: str :param incident_comment_id: Incident comment ID. Required. :type incident_comment_id: str - :param incident_comment: The incident comment. Is one of the following types: IncidentComment, - JSON, IO[bytes] Required. - :type incident_comment: ~azure.mgmt.securityinsight.models.IncidentComment or JSON or IO[bytes] + :param incident_comment: The incident comment. Is either a IncidentComment type or a IO[bytes] + type. Required. + :type incident_comment: ~azure.mgmt.securityinsight.models.IncidentComment or + ~azure.mgmt.securityinsight.types.IncidentComment or IO[bytes] :return: IncidentComment. The IncidentComment is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.IncidentComment :raises ~azure.core.exceptions.HttpResponseError: @@ -4358,7 +4389,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class BookmarkRelationsOperations: +class BookmarkRelationsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -4378,6 +4409,21 @@ def __init__(self, *args, **kwargs) -> None: self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "bookmark_id", + "relation_name", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def get( self, resource_group_name: str, workspace_name: str, bookmark_id: str, relation_name: str, **kwargs: Any ) -> _models.Relation: @@ -4495,7 +4541,7 @@ async def create_or_update( workspace_name: str, bookmark_id: str, relation_name: str, - relation: JSON, + relation: _types.Relation, *, content_type: str = "application/json", **kwargs: Any @@ -4512,7 +4558,7 @@ async def create_or_update( :param relation_name: Relation Name. Required. :type relation_name: str :param relation: Resource create parameters. Required. - :type relation: JSON + :type relation: ~azure.mgmt.securityinsight.types.Relation :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -4555,13 +4601,29 @@ async def create_or_update( """ @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "bookmark_id", + "relation_name", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def create_or_update( self, resource_group_name: str, workspace_name: str, bookmark_id: str, relation_name: str, - relation: Union[_models.Relation, JSON, IO[bytes]], + relation: Union[_models.Relation, _types.Relation, IO[bytes]], **kwargs: Any ) -> _models.Relation: """Creates the bookmark relation. @@ -4575,9 +4637,10 @@ async def create_or_update( :type bookmark_id: str :param relation_name: Relation Name. Required. :type relation_name: str - :param relation: Resource create parameters. Is one of the following types: Relation, JSON, - IO[bytes] Required. - :type relation: ~azure.mgmt.securityinsight.models.Relation or JSON or IO[bytes] + :param relation: Resource create parameters. Is either a Relation type or a IO[bytes] type. + Required. + :type relation: ~azure.mgmt.securityinsight.models.Relation or + ~azure.mgmt.securityinsight.types.Relation or IO[bytes] :return: Relation. The Relation is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.Relation :raises ~azure.core.exceptions.HttpResponseError: @@ -4652,6 +4715,20 @@ async def create_or_update( return deserialized # type: ignore @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "bookmark_id", + "relation_name", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def delete( self, resource_group_name: str, workspace_name: str, bookmark_id: str, relation_name: str, **kwargs: Any ) -> None: @@ -4717,6 +4794,24 @@ async def delete( return cls(pipeline_response, None, {}) # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "bookmark_id", + "filter", + "orderby", + "top", + "skip_token", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def list( self, resource_group_name: str, @@ -4847,7 +4942,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class EntityRelationsOperations: +class EntityRelationsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -4867,6 +4962,21 @@ def __init__(self, *args, **kwargs) -> None: self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "entity_id", + "relation_name", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def get_relation( self, resource_group_name: str, workspace_name: str, entity_id: str, relation_name: str, **kwargs: Any ) -> _models.Relation: @@ -4945,7 +5055,7 @@ async def get_relation( return deserialized # type: ignore -class IncidentTasksOperations: +class IncidentTasksOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -5082,7 +5192,7 @@ async def create_or_update( workspace_name: str, incident_id: str, incident_task_id: str, - incident_task: JSON, + incident_task: _types.IncidentTask, *, content_type: str = "application/json", **kwargs: Any @@ -5099,7 +5209,7 @@ async def create_or_update( :param incident_task_id: Incident task ID. Required. :type incident_task_id: str :param incident_task: The incident task. Required. - :type incident_task: JSON + :type incident_task: ~azure.mgmt.securityinsight.types.IncidentTask :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -5148,7 +5258,7 @@ async def create_or_update( workspace_name: str, incident_id: str, incident_task_id: str, - incident_task: Union[_models.IncidentTask, JSON, IO[bytes]], + incident_task: Union[_models.IncidentTask, _types.IncidentTask, IO[bytes]], **kwargs: Any ) -> _models.IncidentTask: """Creates or updates the incident task. @@ -5162,9 +5272,10 @@ async def create_or_update( :type incident_id: str :param incident_task_id: Incident task ID. Required. :type incident_task_id: str - :param incident_task: The incident task. Is one of the following types: IncidentTask, JSON, - IO[bytes] Required. - :type incident_task: ~azure.mgmt.securityinsight.models.IncidentTask or JSON or IO[bytes] + :param incident_task: The incident task. Is either a IncidentTask type or a IO[bytes] type. + Required. + :type incident_task: ~azure.mgmt.securityinsight.models.IncidentTask or + ~azure.mgmt.securityinsight.types.IncidentTask or IO[bytes] :return: IncidentTask. The IncidentTask is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.IncidentTask :raises ~azure.core.exceptions.HttpResponseError: @@ -5410,7 +5521,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class SentinelOnboardingStatesOperations: +class SentinelOnboardingStatesOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -5544,7 +5655,7 @@ async def create( resource_group_name: str, workspace_name: str, sentinel_onboarding_state_name: str, - sentinel_onboarding_state_parameter: Optional[JSON] = None, + sentinel_onboarding_state_parameter: Optional[_types.SentinelOnboardingState] = None, *, content_type: str = "application/json", **kwargs: Any @@ -5561,7 +5672,8 @@ async def create( :type sentinel_onboarding_state_name: str :param sentinel_onboarding_state_parameter: The Sentinel onboarding state parameter. Default value is None. - :type sentinel_onboarding_state_parameter: JSON + :type sentinel_onboarding_state_parameter: + ~azure.mgmt.securityinsight.types.SentinelOnboardingState :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -5608,7 +5720,9 @@ async def create( resource_group_name: str, workspace_name: str, sentinel_onboarding_state_name: str, - sentinel_onboarding_state_parameter: Optional[Union[_models.SentinelOnboardingState, JSON, IO[bytes]]] = None, + sentinel_onboarding_state_parameter: Optional[ + Union[_models.SentinelOnboardingState, _types.SentinelOnboardingState, IO[bytes]] + ] = None, **kwargs: Any ) -> _models.SentinelOnboardingState: """Create Sentinel onboarding state. @@ -5621,10 +5735,11 @@ async def create( :param sentinel_onboarding_state_name: The Sentinel onboarding state name. Supports - default. Required. :type sentinel_onboarding_state_name: str - :param sentinel_onboarding_state_parameter: The Sentinel onboarding state parameter. Is one of - the following types: SentinelOnboardingState, JSON, IO[bytes] Default value is None. + :param sentinel_onboarding_state_parameter: The Sentinel onboarding state parameter. Is either + a SentinelOnboardingState type or a IO[bytes] type. Default value is None. :type sentinel_onboarding_state_parameter: - ~azure.mgmt.securityinsight.models.SentinelOnboardingState or JSON or IO[bytes] + ~azure.mgmt.securityinsight.models.SentinelOnboardingState or + ~azure.mgmt.securityinsight.types.SentinelOnboardingState or IO[bytes] :return: SentinelOnboardingState. The SentinelOnboardingState is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.SentinelOnboardingState :raises ~azure.core.exceptions.HttpResponseError: @@ -5838,7 +5953,7 @@ async def list( return deserialized # type: ignore -class SecurityMLAnalyticsSettingsOperations: +class SecurityMLAnalyticsSettingsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -5971,7 +6086,7 @@ async def create_or_update( resource_group_name: str, workspace_name: str, settings_resource_name: str, - security_ml_analytics_setting: JSON, + security_ml_analytics_setting: _types.SecurityMLAnalyticsSetting, *, content_type: str = "application/json", **kwargs: Any @@ -5986,7 +6101,8 @@ async def create_or_update( :param settings_resource_name: Security ML Analytics Settings resource name. Required. :type settings_resource_name: str :param security_ml_analytics_setting: The security ML Analytics setting. Required. - :type security_ml_analytics_setting: JSON + :type security_ml_analytics_setting: + ~azure.mgmt.securityinsight.types.SecurityMLAnalyticsSetting :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -6033,7 +6149,9 @@ async def create_or_update( resource_group_name: str, workspace_name: str, settings_resource_name: str, - security_ml_analytics_setting: Union[_models.SecurityMLAnalyticsSetting, JSON, IO[bytes]], + security_ml_analytics_setting: Union[ + _models.SecurityMLAnalyticsSetting, _types.SecurityMLAnalyticsSetting, IO[bytes] + ], **kwargs: Any ) -> _models.SecurityMLAnalyticsSetting: """Creates or updates the Security ML Analytics Settings. @@ -6045,10 +6163,11 @@ async def create_or_update( :type workspace_name: str :param settings_resource_name: Security ML Analytics Settings resource name. Required. :type settings_resource_name: str - :param security_ml_analytics_setting: The security ML Analytics setting. Is one of the - following types: SecurityMLAnalyticsSetting, JSON, IO[bytes] Required. + :param security_ml_analytics_setting: The security ML Analytics setting. Is either a + SecurityMLAnalyticsSetting type or a IO[bytes] type. Required. :type security_ml_analytics_setting: - ~azure.mgmt.securityinsight.models.SecurityMLAnalyticsSetting or JSON or IO[bytes] + ~azure.mgmt.securityinsight.models.SecurityMLAnalyticsSetting or + ~azure.mgmt.securityinsight.types.SecurityMLAnalyticsSetting or IO[bytes] :return: SecurityMLAnalyticsSetting. The SecurityMLAnalyticsSetting is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.SecurityMLAnalyticsSetting @@ -6288,7 +6407,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class SourceControlsOperations: +class SourceControlsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -6418,7 +6537,7 @@ async def create( resource_group_name: str, workspace_name: str, source_control_id: str, - source_control: JSON, + source_control: _types.SourceControl, *, content_type: str = "application/json", **kwargs: Any @@ -6433,7 +6552,7 @@ async def create( :param source_control_id: Source control Id. Required. :type source_control_id: str :param source_control: The SourceControl. Required. - :type source_control: JSON + :type source_control: ~azure.mgmt.securityinsight.types.SourceControl :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -6478,7 +6597,7 @@ async def create( resource_group_name: str, workspace_name: str, source_control_id: str, - source_control: Union[_models.SourceControl, JSON, IO[bytes]], + source_control: Union[_models.SourceControl, _types.SourceControl, IO[bytes]], **kwargs: Any ) -> _models.SourceControl: """Creates a source control. @@ -6490,9 +6609,10 @@ async def create( :type workspace_name: str :param source_control_id: Source control Id. Required. :type source_control_id: str - :param source_control: The SourceControl. Is one of the following types: SourceControl, JSON, - IO[bytes] Required. - :type source_control: ~azure.mgmt.securityinsight.models.SourceControl or JSON or IO[bytes] + :param source_control: The SourceControl. Is either a SourceControl type or a IO[bytes] type. + Required. + :type source_control: ~azure.mgmt.securityinsight.models.SourceControl or + ~azure.mgmt.securityinsight.types.SourceControl or IO[bytes] :return: SourceControl. The SourceControl is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.SourceControl :raises ~azure.core.exceptions.HttpResponseError: @@ -6704,7 +6824,7 @@ async def delete( resource_group_name: str, workspace_name: str, source_control_id: str, - repository_access: JSON, + repository_access: _types.RepositoryAccessProperties, *, content_type: str = "application/json", **kwargs: Any @@ -6719,7 +6839,7 @@ async def delete( :param source_control_id: Source control Id. Required. :type source_control_id: str :param repository_access: The repository access credentials. Required. - :type repository_access: JSON + :type repository_access: ~azure.mgmt.securityinsight.types.RepositoryAccessProperties :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -6764,7 +6884,7 @@ async def delete( resource_group_name: str, workspace_name: str, source_control_id: str, - repository_access: Union[_models.RepositoryAccessProperties, JSON, IO[bytes]], + repository_access: Union[_models.RepositoryAccessProperties, _types.RepositoryAccessProperties, IO[bytes]], **kwargs: Any ) -> _models.Warning: """Delete a source control. @@ -6776,10 +6896,10 @@ async def delete( :type workspace_name: str :param source_control_id: Source control Id. Required. :type source_control_id: str - :param repository_access: The repository access credentials. Is one of the following types: - RepositoryAccessProperties, JSON, IO[bytes] Required. - :type repository_access: ~azure.mgmt.securityinsight.models.RepositoryAccessProperties or JSON - or IO[bytes] + :param repository_access: The repository access credentials. Is either a + RepositoryAccessProperties type or a IO[bytes] type. Required. + :type repository_access: ~azure.mgmt.securityinsight.models.RepositoryAccessProperties or + ~azure.mgmt.securityinsight.types.RepositoryAccessProperties or IO[bytes] :return: Warning. The Warning is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.Warning :raises ~azure.core.exceptions.HttpResponseError: @@ -6853,7 +6973,7 @@ async def delete( return deserialized # type: ignore -class WatchlistsOperations: +class WatchlistsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -6952,7 +7072,7 @@ async def _create_or_update_initial( resource_group_name: str, workspace_name: str, watchlist_alias: str, - watchlist: Union[_models.Watchlist, JSON, IO[bytes]], + watchlist: Union[_models.Watchlist, _types.Watchlist, IO[bytes]], **kwargs: Any ) -> AsyncIterator[bytes]: error_map: MutableMapping = { @@ -7017,7 +7137,6 @@ async def _create_or_update_initial( response_headers["Azure-AsyncOperation"] = self._deserialize( "str", response.headers.get("Azure-AsyncOperation") ) - response_headers["Retry-After"] = self._deserialize("int", response.headers.get("Retry-After")) deserialized = response.iter_bytes() if _decompress else response.iter_raw() @@ -7065,7 +7184,7 @@ async def begin_create_or_update( resource_group_name: str, workspace_name: str, watchlist_alias: str, - watchlist: JSON, + watchlist: _types.Watchlist, *, content_type: str = "application/json", **kwargs: Any @@ -7082,7 +7201,7 @@ async def begin_create_or_update( :param watchlist_alias: The watchlist alias. Required. :type watchlist_alias: str :param watchlist: The watchlist. Required. - :type watchlist: JSON + :type watchlist: ~azure.mgmt.securityinsight.types.Watchlist :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -7131,7 +7250,7 @@ async def begin_create_or_update( resource_group_name: str, workspace_name: str, watchlist_alias: str, - watchlist: Union[_models.Watchlist, JSON, IO[bytes]], + watchlist: Union[_models.Watchlist, _types.Watchlist, IO[bytes]], **kwargs: Any ) -> AsyncLROPoller[_models.Watchlist]: """Create or update a Watchlist and its Watchlist Items (bulk creation, e.g. through text/csv @@ -7145,9 +7264,9 @@ async def begin_create_or_update( :type workspace_name: str :param watchlist_alias: The watchlist alias. Required. :type watchlist_alias: str - :param watchlist: The watchlist. Is one of the following types: Watchlist, JSON, IO[bytes] - Required. - :type watchlist: ~azure.mgmt.securityinsight.models.Watchlist or JSON or IO[bytes] + :param watchlist: The watchlist. Is either a Watchlist type or a IO[bytes] type. Required. + :type watchlist: ~azure.mgmt.securityinsight.models.Watchlist or + ~azure.mgmt.securityinsight.types.Watchlist or IO[bytes] :return: An instance of AsyncLROPoller that returns Watchlist. The Watchlist is compatible with MutableMapping :rtype: ~azure.core.polling.AsyncLROPoller[~azure.mgmt.securityinsight.models.Watchlist] @@ -7262,7 +7381,6 @@ async def _delete_initial( "str", response.headers.get("Azure-AsyncOperation") ) response_headers["Location"] = self._deserialize("str", response.headers.get("Location")) - response_headers["Retry-After"] = self._deserialize("int", response.headers.get("Retry-After")) deserialized = response.iter_bytes() if _decompress else response.iter_raw() @@ -7274,7 +7392,7 @@ async def _delete_initial( @distributed_trace_async async def begin_delete( self, resource_group_name: str, workspace_name: str, watchlist_alias: str, **kwargs: Any - ) -> AsyncLROPoller[None]: + ) -> AsyncLROPoller[_models.Watchlist]: """Delete a watchlist. :param resource_group_name: The name of the resource group. The name is case insensitive. @@ -7284,14 +7402,15 @@ async def begin_delete( :type workspace_name: str :param watchlist_alias: The watchlist alias. Required. :type watchlist_alias: str - :return: An instance of AsyncLROPoller that returns None - :rtype: ~azure.core.polling.AsyncLROPoller[None] + :return: An instance of AsyncLROPoller that returns Watchlist. The Watchlist is compatible with + MutableMapping + :rtype: ~azure.core.polling.AsyncLROPoller[~azure.mgmt.securityinsight.models.Watchlist] :raises ~azure.core.exceptions.HttpResponseError: """ _headers = kwargs.pop("headers", {}) or {} _params = kwargs.pop("params", {}) or {} - cls: ClsType[None] = kwargs.pop("cls", None) + cls: ClsType[_models.Watchlist] = kwargs.pop("cls", None) polling: Union[bool, AsyncPollingMethod] = kwargs.pop("polling", True) lro_delay = kwargs.pop("polling_interval", self._config.polling_interval) cont_token: Optional[str] = kwargs.pop("continuation_token", None) @@ -7308,9 +7427,18 @@ async def begin_delete( await raw_result.http_response.read() # type: ignore kwargs.pop("error_map", None) - def get_long_running_output(pipeline_response): # pylint: disable=inconsistent-return-statements + def get_long_running_output(pipeline_response): + response_headers = {} + response = pipeline_response.http_response + response_headers["Azure-AsyncOperation"] = self._deserialize( + "str", response.headers.get("Azure-AsyncOperation") + ) + response_headers["Location"] = self._deserialize("str", response.headers.get("Location")) + + deserialized = _deserialize(_models.Watchlist, response.json()) if cls: - return cls(pipeline_response, None, {}) # type: ignore + return cls(pipeline_response, deserialized, response_headers) # type: ignore + return deserialized path_format_arguments = { "endpoint": self._serialize.url("self._config.base_url", self._config.base_url, "str", skip_quote=True), @@ -7325,13 +7453,15 @@ def get_long_running_output(pipeline_response): # pylint: disable=inconsistent- else: polling_method = polling if cont_token: - return AsyncLROPoller[None].from_continuation_token( + return AsyncLROPoller[_models.Watchlist].from_continuation_token( polling_method=polling_method, continuation_token=cont_token, client=self._client, deserialization_callback=get_long_running_output, ) - return AsyncLROPoller[None](self._client, raw_result, get_long_running_output, polling_method) # type: ignore + return AsyncLROPoller[_models.Watchlist]( + self._client, raw_result, get_long_running_output, polling_method # type: ignore + ) @distributed_trace def list( @@ -7442,7 +7572,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class WatchlistItemsOperations: +class WatchlistItemsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -7579,7 +7709,7 @@ async def create_or_update( workspace_name: str, watchlist_alias: str, watchlist_item_id: str, - watchlist_item: JSON, + watchlist_item: _types.WatchlistItem, *, content_type: str = "application/json", **kwargs: Any @@ -7596,7 +7726,7 @@ async def create_or_update( :param watchlist_item_id: The watchlist item id (GUID). Required. :type watchlist_item_id: str :param watchlist_item: The watchlist item. Required. - :type watchlist_item: JSON + :type watchlist_item: ~azure.mgmt.securityinsight.types.WatchlistItem :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -7645,7 +7775,7 @@ async def create_or_update( workspace_name: str, watchlist_alias: str, watchlist_item_id: str, - watchlist_item: Union[_models.WatchlistItem, JSON, IO[bytes]], + watchlist_item: Union[_models.WatchlistItem, _types.WatchlistItem, IO[bytes]], **kwargs: Any ) -> _models.WatchlistItem: """Create or update a watchlist item. @@ -7659,9 +7789,10 @@ async def create_or_update( :type watchlist_alias: str :param watchlist_item_id: The watchlist item id (GUID). Required. :type watchlist_item_id: str - :param watchlist_item: The watchlist item. Is one of the following types: WatchlistItem, JSON, - IO[bytes] Required. - :type watchlist_item: ~azure.mgmt.securityinsight.models.WatchlistItem or JSON or IO[bytes] + :param watchlist_item: The watchlist item. Is either a WatchlistItem type or a IO[bytes] type. + Required. + :type watchlist_item: ~azure.mgmt.securityinsight.models.WatchlistItem or + ~azure.mgmt.securityinsight.types.WatchlistItem or IO[bytes] :return: WatchlistItem. The WatchlistItem is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.WatchlistItem :raises ~azure.core.exceptions.HttpResponseError: @@ -7919,7 +8050,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class BillingStatisticsOperations: +class BillingStatisticsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -7939,6 +8070,20 @@ def __init__(self, *args, **kwargs) -> None: self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "billing_statistic_name", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def get( self, resource_group_name: str, workspace_name: str, billing_statistic_name: str, **kwargs: Any ) -> _models.BillingStatistic: @@ -8014,6 +8159,13 @@ async def get( return deserialized # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": ["api_version", "subscription_id", "resource_group_name", "workspace_name", "accept"] + }, + api_versions_list=["2025-10-01-preview"], + ) def list( self, resource_group_name: str, workspace_name: str, **kwargs: Any ) -> AsyncItemPaged["_models.BillingStatistic"]: @@ -8117,7 +8269,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class EntitiesOperations: +class EntitiesOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -8137,6 +8289,20 @@ def __init__(self, *args, **kwargs) -> None: self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "entity_id", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def get(self, resource_group_name: str, workspace_name: str, entity_id: str, **kwargs: Any) -> _models.Entity: """Gets an entity. @@ -8210,6 +8376,13 @@ async def get(self, resource_group_name: str, workspace_name: str, entity_id: st return deserialized # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": ["api_version", "subscription_id", "resource_group_name", "workspace_name", "accept"] + }, + api_versions_list=["2025-10-01-preview"], + ) def list(self, resource_group_name: str, workspace_name: str, **kwargs: Any) -> AsyncItemPaged["_models.Entity"]: """Gets all entities. @@ -8346,7 +8519,7 @@ async def run_playbook( resource_group_name: str, workspace_name: str, entity_identifier: str, - request_body: Optional[JSON] = None, + request_body: Optional[_types.EntityManualTriggerRequestBody] = None, *, content_type: str = "application/json", **kwargs: Any @@ -8362,7 +8535,7 @@ async def run_playbook( :type entity_identifier: str :param request_body: Describes the request body for triggering a playbook on an entity. Default value is None. - :type request_body: JSON + :type request_body: ~azure.mgmt.securityinsight.types.EntityManualTriggerRequestBody :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -8408,7 +8581,9 @@ async def run_playbook( resource_group_name: str, workspace_name: str, entity_identifier: str, - request_body: Optional[Union[_models.EntityManualTriggerRequestBody, JSON, IO[bytes]]] = None, + request_body: Optional[ + Union[_models.EntityManualTriggerRequestBody, _types.EntityManualTriggerRequestBody, IO[bytes]] + ] = None, **kwargs: Any ) -> None: """Triggers playbook on a specific entity. @@ -8420,10 +8595,10 @@ async def run_playbook( :type workspace_name: str :param entity_identifier: entity ID. Required. :type entity_identifier: str - :param request_body: Describes the request body for triggering a playbook on an entity. Is one - of the following types: EntityManualTriggerRequestBody, JSON, IO[bytes] Default value is None. - :type request_body: ~azure.mgmt.securityinsight.models.EntityManualTriggerRequestBody or JSON - or IO[bytes] + :param request_body: Describes the request body for triggering a playbook on an entity. Is + either a EntityManualTriggerRequestBody type or a IO[bytes] type. Default value is None. + :type request_body: ~azure.mgmt.securityinsight.models.EntityManualTriggerRequestBody or + ~azure.mgmt.securityinsight.types.EntityManualTriggerRequestBody or IO[bytes] :return: None :rtype: None :raises ~azure.core.exceptions.HttpResponseError: @@ -8524,7 +8699,7 @@ async def expand( resource_group_name: str, workspace_name: str, entity_id: str, - parameters: JSON, + parameters: _types.EntityExpandParameters, *, content_type: str = "application/json", **kwargs: Any @@ -8540,7 +8715,7 @@ async def expand( :type entity_id: str :param parameters: The parameters required to execute an expand operation on the given entity. Required. - :type parameters: JSON + :type parameters: ~azure.mgmt.securityinsight.types.EntityExpandParameters :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -8581,12 +8756,27 @@ async def expand( """ @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "entity_id", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def expand( self, resource_group_name: str, workspace_name: str, entity_id: str, - parameters: Union[_models.EntityExpandParameters, JSON, IO[bytes]], + parameters: Union[_models.EntityExpandParameters, _types.EntityExpandParameters, IO[bytes]], **kwargs: Any ) -> _models.EntityExpandResponse: """Expands an entity. @@ -8599,9 +8789,9 @@ async def expand( :param entity_id: entity ID. Required. :type entity_id: str :param parameters: The parameters required to execute an expand operation on the given entity. - Is one of the following types: EntityExpandParameters, JSON, IO[bytes] Required. - :type parameters: ~azure.mgmt.securityinsight.models.EntityExpandParameters or JSON or - IO[bytes] + Is either a EntityExpandParameters type or a IO[bytes] type. Required. + :type parameters: ~azure.mgmt.securityinsight.models.EntityExpandParameters or + ~azure.mgmt.securityinsight.types.EntityExpandParameters or IO[bytes] :return: EntityExpandResponse. The EntityExpandResponse is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.EntityExpandResponse :raises ~azure.core.exceptions.HttpResponseError: @@ -8675,6 +8865,21 @@ async def expand( return deserialized # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "entity_id", + "kind", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def queries( self, resource_group_name: str, @@ -8826,7 +9031,7 @@ async def get_insights( resource_group_name: str, workspace_name: str, entity_id: str, - parameters: JSON, + parameters: _types.EntityGetInsightsParameters, *, content_type: str = "application/json", **kwargs: Any @@ -8841,7 +9046,7 @@ async def get_insights( :param entity_id: entity ID. Required. :type entity_id: str :param parameters: The parameters required to execute insights on the given entity. Required. - :type parameters: JSON + :type parameters: ~azure.mgmt.securityinsight.types.EntityGetInsightsParameters :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -8883,12 +9088,27 @@ async def get_insights( """ @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "entity_id", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def get_insights( self, resource_group_name: str, workspace_name: str, entity_id: str, - parameters: Union[_models.EntityGetInsightsParameters, JSON, IO[bytes]], + parameters: Union[_models.EntityGetInsightsParameters, _types.EntityGetInsightsParameters, IO[bytes]], **kwargs: Any ) -> _models.EntityGetInsightsResponse: """Execute Insights for an entity. @@ -8900,10 +9120,10 @@ async def get_insights( :type workspace_name: str :param entity_id: entity ID. Required. :type entity_id: str - :param parameters: The parameters required to execute insights on the given entity. Is one of - the following types: EntityGetInsightsParameters, JSON, IO[bytes] Required. - :type parameters: ~azure.mgmt.securityinsight.models.EntityGetInsightsParameters or JSON or - IO[bytes] + :param parameters: The parameters required to execute insights on the given entity. Is either a + EntityGetInsightsParameters type or a IO[bytes] type. Required. + :type parameters: ~azure.mgmt.securityinsight.models.EntityGetInsightsParameters or + ~azure.mgmt.securityinsight.types.EntityGetInsightsParameters or IO[bytes] :return: EntityGetInsightsResponse. The EntityGetInsightsResponse is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.EntityGetInsightsResponse @@ -8978,7 +9198,7 @@ async def get_insights( return deserialized # type: ignore -class EntityQueriesOperations: +class EntityQueriesOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -8998,6 +9218,20 @@ def __init__(self, *args, **kwargs) -> None: self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "entity_query_id", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def get( self, resource_group_name: str, workspace_name: str, entity_query_id: str, **kwargs: Any ) -> _models.EntityQuery: @@ -9108,7 +9342,7 @@ async def create_or_update( resource_group_name: str, workspace_name: str, entity_query_id: str, - entity_query: JSON, + entity_query: _types.CustomEntityQuery, *, content_type: str = "application/json", **kwargs: Any @@ -9123,7 +9357,7 @@ async def create_or_update( :param entity_query_id: entity query ID. Required. :type entity_query_id: str :param entity_query: The entity query we want to create or update. Required. - :type entity_query: JSON + :type entity_query: ~azure.mgmt.securityinsight.types.CustomEntityQuery :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -9163,12 +9397,27 @@ async def create_or_update( """ @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "entity_query_id", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def create_or_update( self, resource_group_name: str, workspace_name: str, entity_query_id: str, - entity_query: Union[_models.CustomEntityQuery, JSON, IO[bytes]], + entity_query: Union[_models.CustomEntityQuery, _types.CustomEntityQuery, IO[bytes]], **kwargs: Any ) -> _models.EntityQuery: """Creates or updates the entity query. @@ -9180,9 +9429,10 @@ async def create_or_update( :type workspace_name: str :param entity_query_id: entity query ID. Required. :type entity_query_id: str - :param entity_query: The entity query we want to create or update. Is one of the following - types: CustomEntityQuery, JSON, IO[bytes] Required. - :type entity_query: ~azure.mgmt.securityinsight.models.CustomEntityQuery or JSON or IO[bytes] + :param entity_query: The entity query we want to create or update. Is either a + CustomEntityQuery type or a IO[bytes] type. Required. + :type entity_query: ~azure.mgmt.securityinsight.models.CustomEntityQuery or + ~azure.mgmt.securityinsight.types.CustomEntityQuery or IO[bytes] :return: EntityQuery. The EntityQuery is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.EntityQuery :raises ~azure.core.exceptions.HttpResponseError: @@ -9256,6 +9506,19 @@ async def create_or_update( return deserialized # type: ignore @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "entity_query_id", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def delete(self, resource_group_name: str, workspace_name: str, entity_query_id: str, **kwargs: Any) -> None: """Delete the entity query. @@ -9316,6 +9579,20 @@ async def delete(self, resource_group_name: str, workspace_name: str, entity_que return cls(pipeline_response, None, {}) # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "kind", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def list( self, resource_group_name: str, @@ -9428,7 +9705,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class EntityQueryTemplatesOperations: +class EntityQueryTemplatesOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -9448,6 +9725,20 @@ def __init__(self, *args, **kwargs) -> None: self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "entity_query_template_id", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def get( self, resource_group_name: str, workspace_name: str, entity_query_template_id: str, **kwargs: Any ) -> _models.EntityQueryTemplate: @@ -9523,6 +9814,20 @@ async def get( return deserialized # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "kind", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def list( self, resource_group_name: str, @@ -9636,7 +9941,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class FileImportsOperations: +class FileImportsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -9656,6 +9961,20 @@ def __init__(self, *args, **kwargs) -> None: self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "file_import_id", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def get( self, resource_group_name: str, workspace_name: str, file_import_id: str, **kwargs: Any ) -> _models.FileImport: @@ -9766,7 +10085,7 @@ async def create( resource_group_name: str, workspace_name: str, file_import_id: str, - file_import: JSON, + file_import: _types.FileImport, *, content_type: str = "application/json", **kwargs: Any @@ -9781,7 +10100,7 @@ async def create( :param file_import_id: File import ID. Required. :type file_import_id: str :param file_import: The file import. Required. - :type file_import: JSON + :type file_import: ~azure.mgmt.securityinsight.types.FileImport :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -9821,12 +10140,27 @@ async def create( """ @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "file_import_id", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def create( self, resource_group_name: str, workspace_name: str, file_import_id: str, - file_import: Union[_models.FileImport, JSON, IO[bytes]], + file_import: Union[_models.FileImport, _types.FileImport, IO[bytes]], **kwargs: Any ) -> _models.FileImport: """Creates the file import. @@ -9838,9 +10172,9 @@ async def create( :type workspace_name: str :param file_import_id: File import ID. Required. :type file_import_id: str - :param file_import: The file import. Is one of the following types: FileImport, JSON, IO[bytes] - Required. - :type file_import: ~azure.mgmt.securityinsight.models.FileImport or JSON or IO[bytes] + :param file_import: The file import. Is either a FileImport type or a IO[bytes] type. Required. + :type file_import: ~azure.mgmt.securityinsight.models.FileImport or + ~azure.mgmt.securityinsight.types.FileImport or IO[bytes] :return: FileImport. The FileImport is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.FileImport :raises ~azure.core.exceptions.HttpResponseError: @@ -9913,6 +10247,20 @@ async def create( return deserialized # type: ignore + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "file_import_id", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def _delete_initial( self, resource_group_name: str, workspace_name: str, file_import_id: str, **kwargs: Any ) -> AsyncIterator[bytes]: @@ -9975,6 +10323,20 @@ async def _delete_initial( return deserialized # type: ignore @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "file_import_id", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def begin_delete( self, resource_group_name: str, workspace_name: str, file_import_id: str, **kwargs: Any ) -> AsyncLROPoller[_models.FileImport]: @@ -10046,6 +10408,23 @@ def get_long_running_output(pipeline_response): ) @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "filter", + "orderby", + "top", + "skip_token", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def list( self, resource_group_name: str, @@ -10172,7 +10551,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class HuntsOperations: +class HuntsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -10192,6 +10571,20 @@ def __init__(self, *args, **kwargs) -> None: self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "hunt_id", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def get(self, resource_group_name: str, workspace_name: str, hunt_id: str, **kwargs: Any) -> _models.Hunt: """Gets a hunt, without relations and comments. @@ -10300,7 +10693,7 @@ async def create_or_update( resource_group_name: str, workspace_name: str, hunt_id: str, - hunt: JSON, + hunt: _types.Hunt, *, content_type: str = "application/json", **kwargs: Any @@ -10315,7 +10708,7 @@ async def create_or_update( :param hunt_id: The hunt id (GUID). Required. :type hunt_id: str :param hunt: The hunt. Required. - :type hunt: JSON + :type hunt: ~azure.mgmt.securityinsight.types.Hunt :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -10355,12 +10748,27 @@ async def create_or_update( """ @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "hunt_id", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def create_or_update( self, resource_group_name: str, workspace_name: str, hunt_id: str, - hunt: Union[_models.Hunt, JSON, IO[bytes]], + hunt: Union[_models.Hunt, _types.Hunt, IO[bytes]], **kwargs: Any ) -> _models.Hunt: """Create or update a hunt. @@ -10372,8 +10780,9 @@ async def create_or_update( :type workspace_name: str :param hunt_id: The hunt id (GUID). Required. :type hunt_id: str - :param hunt: The hunt. Is one of the following types: Hunt, JSON, IO[bytes] Required. - :type hunt: ~azure.mgmt.securityinsight.models.Hunt or JSON or IO[bytes] + :param hunt: The hunt. Is either a Hunt type or a IO[bytes] type. Required. + :type hunt: ~azure.mgmt.securityinsight.models.Hunt or ~azure.mgmt.securityinsight.types.Hunt + or IO[bytes] :return: Hunt. The Hunt is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.Hunt :raises ~azure.core.exceptions.HttpResponseError: @@ -10447,6 +10856,13 @@ async def create_or_update( return deserialized # type: ignore @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": ["api_version", "subscription_id", "resource_group_name", "workspace_name", "hunt_id"] + }, + api_versions_list=["2025-10-01-preview"], + ) async def delete(self, resource_group_name: str, workspace_name: str, hunt_id: str, **kwargs: Any) -> None: """Delete a hunt. @@ -10507,6 +10923,23 @@ async def delete(self, resource_group_name: str, workspace_name: str, hunt_id: s return cls(pipeline_response, None, {}) # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "filter", + "orderby", + "top", + "skip_token", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def list( self, resource_group_name: str, @@ -10633,7 +11066,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class HuntCommentsOperations: +class HuntCommentsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -10653,6 +11086,21 @@ def __init__(self, *args, **kwargs) -> None: self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "hunt_id", + "hunt_comment_id", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def get( self, resource_group_name: str, workspace_name: str, hunt_id: str, hunt_comment_id: str, **kwargs: Any ) -> _models.HuntComment: @@ -10770,7 +11218,7 @@ async def create_or_update( workspace_name: str, hunt_id: str, hunt_comment_id: str, - hunt_comment: JSON, + hunt_comment: _types.HuntComment, *, content_type: str = "application/json", **kwargs: Any @@ -10787,7 +11235,7 @@ async def create_or_update( :param hunt_comment_id: The hunt comment id (GUID). Required. :type hunt_comment_id: str :param hunt_comment: The hunt comment. Required. - :type hunt_comment: JSON + :type hunt_comment: ~azure.mgmt.securityinsight.types.HuntComment :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -10830,13 +11278,29 @@ async def create_or_update( """ @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "hunt_id", + "hunt_comment_id", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def create_or_update( self, resource_group_name: str, workspace_name: str, hunt_id: str, hunt_comment_id: str, - hunt_comment: Union[_models.HuntComment, JSON, IO[bytes]], + hunt_comment: Union[_models.HuntComment, _types.HuntComment, IO[bytes]], **kwargs: Any ) -> _models.HuntComment: """Creates or updates a hunt relation. @@ -10850,9 +11314,10 @@ async def create_or_update( :type hunt_id: str :param hunt_comment_id: The hunt comment id (GUID). Required. :type hunt_comment_id: str - :param hunt_comment: The hunt comment. Is one of the following types: HuntComment, JSON, - IO[bytes] Required. - :type hunt_comment: ~azure.mgmt.securityinsight.models.HuntComment or JSON or IO[bytes] + :param hunt_comment: The hunt comment. Is either a HuntComment type or a IO[bytes] type. + Required. + :type hunt_comment: ~azure.mgmt.securityinsight.models.HuntComment or + ~azure.mgmt.securityinsight.types.HuntComment or IO[bytes] :return: HuntComment. The HuntComment is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.HuntComment :raises ~azure.core.exceptions.HttpResponseError: @@ -10927,6 +11392,20 @@ async def create_or_update( return deserialized # type: ignore @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "hunt_id", + "hunt_comment_id", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def delete( self, resource_group_name: str, workspace_name: str, hunt_id: str, hunt_comment_id: str, **kwargs: Any ) -> None: @@ -10992,6 +11471,24 @@ async def delete( return cls(pipeline_response, None, {}) # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "hunt_id", + "filter", + "orderby", + "top", + "skip_token", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def list( self, resource_group_name: str, @@ -11122,7 +11619,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class HuntRelationsOperations: +class HuntRelationsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -11142,6 +11639,21 @@ def __init__(self, *args, **kwargs) -> None: self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "hunt_id", + "hunt_relation_id", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def get( self, resource_group_name: str, workspace_name: str, hunt_id: str, hunt_relation_id: str, **kwargs: Any ) -> _models.HuntRelation: @@ -11259,7 +11771,7 @@ async def create_or_update( workspace_name: str, hunt_id: str, hunt_relation_id: str, - hunt_relation: JSON, + hunt_relation: _types.HuntRelation, *, content_type: str = "application/json", **kwargs: Any @@ -11276,7 +11788,7 @@ async def create_or_update( :param hunt_relation_id: The hunt relation id (GUID). Required. :type hunt_relation_id: str :param hunt_relation: The hunt relation. Required. - :type hunt_relation: JSON + :type hunt_relation: ~azure.mgmt.securityinsight.types.HuntRelation :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -11319,13 +11831,29 @@ async def create_or_update( """ @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "hunt_id", + "hunt_relation_id", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def create_or_update( self, resource_group_name: str, workspace_name: str, hunt_id: str, hunt_relation_id: str, - hunt_relation: Union[_models.HuntRelation, JSON, IO[bytes]], + hunt_relation: Union[_models.HuntRelation, _types.HuntRelation, IO[bytes]], **kwargs: Any ) -> _models.HuntRelation: """Creates or updates a hunt relation. @@ -11339,9 +11867,10 @@ async def create_or_update( :type hunt_id: str :param hunt_relation_id: The hunt relation id (GUID). Required. :type hunt_relation_id: str - :param hunt_relation: The hunt relation. Is one of the following types: HuntRelation, JSON, - IO[bytes] Required. - :type hunt_relation: ~azure.mgmt.securityinsight.models.HuntRelation or JSON or IO[bytes] + :param hunt_relation: The hunt relation. Is either a HuntRelation type or a IO[bytes] type. + Required. + :type hunt_relation: ~azure.mgmt.securityinsight.models.HuntRelation or + ~azure.mgmt.securityinsight.types.HuntRelation or IO[bytes] :return: HuntRelation. The HuntRelation is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.HuntRelation :raises ~azure.core.exceptions.HttpResponseError: @@ -11416,6 +11945,20 @@ async def create_or_update( return deserialized # type: ignore @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "hunt_id", + "hunt_relation_id", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def delete( self, resource_group_name: str, workspace_name: str, hunt_id: str, hunt_relation_id: str, **kwargs: Any ) -> None: @@ -11481,6 +12024,24 @@ async def delete( return cls(pipeline_response, None, {}) # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "hunt_id", + "filter", + "orderby", + "top", + "skip_token", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def list( self, resource_group_name: str, @@ -11612,7 +12173,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class OfficeConsentsOperations: +class OfficeConsentsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -11632,6 +12193,20 @@ def __init__(self, *args, **kwargs) -> None: self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "consent_id", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def get( self, resource_group_name: str, workspace_name: str, consent_id: str, **kwargs: Any ) -> _models.OfficeConsent: @@ -11707,6 +12282,19 @@ async def get( return deserialized # type: ignore @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "consent_id", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def delete(self, resource_group_name: str, workspace_name: str, consent_id: str, **kwargs: Any) -> None: """Delete the office365 consent. @@ -11767,6 +12355,13 @@ async def delete(self, resource_group_name: str, workspace_name: str, consent_id return cls(pipeline_response, None, {}) # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": ["api_version", "subscription_id", "resource_group_name", "workspace_name", "accept"] + }, + api_versions_list=["2025-10-01-preview"], + ) def list( self, resource_group_name: str, workspace_name: str, **kwargs: Any ) -> AsyncItemPaged["_models.OfficeConsent"]: @@ -11870,7 +12465,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class ProductSettingsOperations: +class ProductSettingsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -11890,6 +12485,20 @@ def __init__(self, *args, **kwargs) -> None: self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "settings_name", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def get( self, resource_group_name: str, workspace_name: str, settings_name: str, **kwargs: Any ) -> _models.Settings: @@ -12002,7 +12611,7 @@ async def update( resource_group_name: str, workspace_name: str, settings_name: str, - settings: JSON, + settings: _types.Settings, *, content_type: str = "application/json", **kwargs: Any @@ -12018,7 +12627,7 @@ async def update( Required. :type settings_name: str :param settings: The setting. Required. - :type settings: JSON + :type settings: ~azure.mgmt.securityinsight.types.Settings :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -12059,12 +12668,27 @@ async def update( """ @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "settings_name", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def update( self, resource_group_name: str, workspace_name: str, settings_name: str, - settings: Union[_models.Settings, JSON, IO[bytes]], + settings: Union[_models.Settings, _types.Settings, IO[bytes]], **kwargs: Any ) -> _models.Settings: """Updates setting. @@ -12077,9 +12701,9 @@ async def update( :param settings_name: The setting name. Supports - Anomalies, EyesOn, EntityAnalytics, Ueba. Required. :type settings_name: str - :param settings: The setting. Is one of the following types: Settings, JSON, IO[bytes] - Required. - :type settings: ~azure.mgmt.securityinsight.models.Settings or JSON or IO[bytes] + :param settings: The setting. Is either a Settings type or a IO[bytes] type. Required. + :type settings: ~azure.mgmt.securityinsight.models.Settings or + ~azure.mgmt.securityinsight.types.Settings or IO[bytes] :return: Settings. The Settings is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.Settings :raises ~azure.core.exceptions.HttpResponseError: @@ -12153,6 +12777,19 @@ async def update( return deserialized # type: ignore @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "settings_name", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def delete(self, resource_group_name: str, workspace_name: str, settings_name: str, **kwargs: Any) -> None: """Delete setting of the product. @@ -12214,6 +12851,13 @@ async def delete(self, resource_group_name: str, workspace_name: str, settings_n return cls(pipeline_response, None, {}) # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": ["api_version", "subscription_id", "resource_group_name", "workspace_name", "accept"] + }, + api_versions_list=["2025-10-01-preview"], + ) def list(self, resource_group_name: str, workspace_name: str, **kwargs: Any) -> AsyncItemPaged["_models.Settings"]: """List of all the settings. @@ -12314,7 +12958,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class WorkspaceManagerAssignmentsOperations: +class WorkspaceManagerAssignmentsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -12334,6 +12978,20 @@ def __init__(self, *args, **kwargs) -> None: self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "workspace_manager_assignment_name", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def get( self, resource_group_name: str, workspace_name: str, workspace_manager_assignment_name: str, **kwargs: Any ) -> _models.WorkspaceManagerAssignment: @@ -12449,7 +13107,7 @@ async def create_or_update( resource_group_name: str, workspace_name: str, workspace_manager_assignment_name: str, - workspace_manager_assignment: JSON, + workspace_manager_assignment: _types.WorkspaceManagerAssignment, *, content_type: str = "application/json", **kwargs: Any @@ -12465,7 +13123,8 @@ async def create_or_update( Required. :type workspace_manager_assignment_name: str :param workspace_manager_assignment: The workspace manager assignment. Required. - :type workspace_manager_assignment: JSON + :type workspace_manager_assignment: + ~azure.mgmt.securityinsight.types.WorkspaceManagerAssignment :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -12508,12 +13167,29 @@ async def create_or_update( """ @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "workspace_manager_assignment_name", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def create_or_update( self, resource_group_name: str, workspace_name: str, workspace_manager_assignment_name: str, - workspace_manager_assignment: Union[_models.WorkspaceManagerAssignment, JSON, IO[bytes]], + workspace_manager_assignment: Union[ + _models.WorkspaceManagerAssignment, _types.WorkspaceManagerAssignment, IO[bytes] + ], **kwargs: Any ) -> _models.WorkspaceManagerAssignment: """Creates or updates a workspace manager assignment. @@ -12526,10 +13202,11 @@ async def create_or_update( :param workspace_manager_assignment_name: The name of the workspace manager assignment. Required. :type workspace_manager_assignment_name: str - :param workspace_manager_assignment: The workspace manager assignment. Is one of the following - types: WorkspaceManagerAssignment, JSON, IO[bytes] Required. + :param workspace_manager_assignment: The workspace manager assignment. Is either a + WorkspaceManagerAssignment type or a IO[bytes] type. Required. :type workspace_manager_assignment: - ~azure.mgmt.securityinsight.models.WorkspaceManagerAssignment or JSON or IO[bytes] + ~azure.mgmt.securityinsight.models.WorkspaceManagerAssignment or + ~azure.mgmt.securityinsight.types.WorkspaceManagerAssignment or IO[bytes] :return: WorkspaceManagerAssignment. The WorkspaceManagerAssignment is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.WorkspaceManagerAssignment @@ -12604,6 +13281,19 @@ async def create_or_update( return deserialized # type: ignore @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "workspace_manager_assignment_name", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def delete( self, resource_group_name: str, workspace_name: str, workspace_manager_assignment_name: str, **kwargs: Any ) -> None: @@ -12667,6 +13357,22 @@ async def delete( return cls(pipeline_response, None, {}) # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "orderby", + "top", + "skip_token", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def list( self, resource_group_name: str, @@ -12789,7 +13495,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class WorkspaceManagerConfigurationsOperations: +class WorkspaceManagerConfigurationsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -12809,6 +13515,20 @@ def __init__(self, *args, **kwargs) -> None: self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "workspace_manager_configuration_name", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def get( self, resource_group_name: str, workspace_name: str, workspace_manager_configuration_name: str, **kwargs: Any ) -> _models.WorkspaceManagerConfiguration: @@ -12924,7 +13644,7 @@ async def create_or_update( resource_group_name: str, workspace_name: str, workspace_manager_configuration_name: str, - workspace_manager_configuration: JSON, + workspace_manager_configuration: _types.WorkspaceManagerConfiguration, *, content_type: str = "application/json", **kwargs: Any @@ -12940,7 +13660,8 @@ async def create_or_update( Required. :type workspace_manager_configuration_name: str :param workspace_manager_configuration: The workspace manager configuration. Required. - :type workspace_manager_configuration: JSON + :type workspace_manager_configuration: + ~azure.mgmt.securityinsight.types.WorkspaceManagerConfiguration :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -12983,12 +13704,29 @@ async def create_or_update( """ @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "workspace_manager_configuration_name", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def create_or_update( self, resource_group_name: str, workspace_name: str, workspace_manager_configuration_name: str, - workspace_manager_configuration: Union[_models.WorkspaceManagerConfiguration, JSON, IO[bytes]], + workspace_manager_configuration: Union[ + _models.WorkspaceManagerConfiguration, _types.WorkspaceManagerConfiguration, IO[bytes] + ], **kwargs: Any ) -> _models.WorkspaceManagerConfiguration: """Creates or updates a workspace manager configuration. @@ -13001,10 +13739,11 @@ async def create_or_update( :param workspace_manager_configuration_name: The name of the workspace manager configuration. Required. :type workspace_manager_configuration_name: str - :param workspace_manager_configuration: The workspace manager configuration. Is one of the - following types: WorkspaceManagerConfiguration, JSON, IO[bytes] Required. + :param workspace_manager_configuration: The workspace manager configuration. Is either a + WorkspaceManagerConfiguration type or a IO[bytes] type. Required. :type workspace_manager_configuration: - ~azure.mgmt.securityinsight.models.WorkspaceManagerConfiguration or JSON or IO[bytes] + ~azure.mgmt.securityinsight.models.WorkspaceManagerConfiguration or + ~azure.mgmt.securityinsight.types.WorkspaceManagerConfiguration or IO[bytes] :return: WorkspaceManagerConfiguration. The WorkspaceManagerConfiguration is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.WorkspaceManagerConfiguration @@ -13079,6 +13818,19 @@ async def create_or_update( return deserialized # type: ignore @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "workspace_manager_configuration_name", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def delete( self, resource_group_name: str, workspace_name: str, workspace_manager_configuration_name: str, **kwargs: Any ) -> None: @@ -13142,6 +13894,22 @@ async def delete( return cls(pipeline_response, None, {}) # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "orderby", + "top", + "skip_token", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def list( self, resource_group_name: str, @@ -13264,7 +14032,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class WorkspaceManagerGroupsOperations: +class WorkspaceManagerGroupsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -13284,6 +14052,20 @@ def __init__(self, *args, **kwargs) -> None: self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "workspace_manager_group_name", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def get( self, resource_group_name: str, workspace_name: str, workspace_manager_group_name: str, **kwargs: Any ) -> _models.WorkspaceManagerGroup: @@ -13394,7 +14176,7 @@ async def create_or_update( resource_group_name: str, workspace_name: str, workspace_manager_group_name: str, - workspace_manager_group: JSON, + workspace_manager_group: _types.WorkspaceManagerGroup, *, content_type: str = "application/json", **kwargs: Any @@ -13409,7 +14191,7 @@ async def create_or_update( :param workspace_manager_group_name: The name of the workspace manager group. Required. :type workspace_manager_group_name: str :param workspace_manager_group: The workspace manager group object. Required. - :type workspace_manager_group: JSON + :type workspace_manager_group: ~azure.mgmt.securityinsight.types.WorkspaceManagerGroup :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -13449,12 +14231,27 @@ async def create_or_update( """ @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "workspace_manager_group_name", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def create_or_update( self, resource_group_name: str, workspace_name: str, workspace_manager_group_name: str, - workspace_manager_group: Union[_models.WorkspaceManagerGroup, JSON, IO[bytes]], + workspace_manager_group: Union[_models.WorkspaceManagerGroup, _types.WorkspaceManagerGroup, IO[bytes]], **kwargs: Any ) -> _models.WorkspaceManagerGroup: """Creates or updates a workspace manager group. @@ -13466,10 +14263,10 @@ async def create_or_update( :type workspace_name: str :param workspace_manager_group_name: The name of the workspace manager group. Required. :type workspace_manager_group_name: str - :param workspace_manager_group: The workspace manager group object. Is one of the following - types: WorkspaceManagerGroup, JSON, IO[bytes] Required. - :type workspace_manager_group: ~azure.mgmt.securityinsight.models.WorkspaceManagerGroup or JSON - or IO[bytes] + :param workspace_manager_group: The workspace manager group object. Is either a + WorkspaceManagerGroup type or a IO[bytes] type. Required. + :type workspace_manager_group: ~azure.mgmt.securityinsight.models.WorkspaceManagerGroup or + ~azure.mgmt.securityinsight.types.WorkspaceManagerGroup or IO[bytes] :return: WorkspaceManagerGroup. The WorkspaceManagerGroup is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.WorkspaceManagerGroup :raises ~azure.core.exceptions.HttpResponseError: @@ -13543,6 +14340,19 @@ async def create_or_update( return deserialized # type: ignore @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "workspace_manager_group_name", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def delete( self, resource_group_name: str, workspace_name: str, workspace_manager_group_name: str, **kwargs: Any ) -> None: @@ -13605,6 +14415,22 @@ async def delete( return cls(pipeline_response, None, {}) # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "orderby", + "top", + "skip_token", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def list( self, resource_group_name: str, @@ -13727,7 +14553,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class WorkspaceManagerMembersOperations: +class WorkspaceManagerMembersOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -13747,6 +14573,20 @@ def __init__(self, *args, **kwargs) -> None: self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "workspace_manager_member_name", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def get( self, resource_group_name: str, workspace_name: str, workspace_manager_member_name: str, **kwargs: Any ) -> _models.WorkspaceManagerMember: @@ -13857,7 +14697,7 @@ async def create_or_update( resource_group_name: str, workspace_name: str, workspace_manager_member_name: str, - workspace_manager_member: JSON, + workspace_manager_member: _types.WorkspaceManagerMember, *, content_type: str = "application/json", **kwargs: Any @@ -13872,7 +14712,7 @@ async def create_or_update( :param workspace_manager_member_name: The name of the workspace manager member. Required. :type workspace_manager_member_name: str :param workspace_manager_member: The workspace manager member object. Required. - :type workspace_manager_member: JSON + :type workspace_manager_member: ~azure.mgmt.securityinsight.types.WorkspaceManagerMember :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -13912,12 +14752,27 @@ async def create_or_update( """ @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "workspace_manager_member_name", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def create_or_update( self, resource_group_name: str, workspace_name: str, workspace_manager_member_name: str, - workspace_manager_member: Union[_models.WorkspaceManagerMember, JSON, IO[bytes]], + workspace_manager_member: Union[_models.WorkspaceManagerMember, _types.WorkspaceManagerMember, IO[bytes]], **kwargs: Any ) -> _models.WorkspaceManagerMember: """Creates or updates a workspace manager member. @@ -13929,10 +14784,10 @@ async def create_or_update( :type workspace_name: str :param workspace_manager_member_name: The name of the workspace manager member. Required. :type workspace_manager_member_name: str - :param workspace_manager_member: The workspace manager member object. Is one of the following - types: WorkspaceManagerMember, JSON, IO[bytes] Required. + :param workspace_manager_member: The workspace manager member object. Is either a + WorkspaceManagerMember type or a IO[bytes] type. Required. :type workspace_manager_member: ~azure.mgmt.securityinsight.models.WorkspaceManagerMember or - JSON or IO[bytes] + ~azure.mgmt.securityinsight.types.WorkspaceManagerMember or IO[bytes] :return: WorkspaceManagerMember. The WorkspaceManagerMember is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.WorkspaceManagerMember :raises ~azure.core.exceptions.HttpResponseError: @@ -14006,6 +14861,19 @@ async def create_or_update( return deserialized # type: ignore @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "workspace_manager_member_name", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def delete( self, resource_group_name: str, workspace_name: str, workspace_manager_member_name: str, **kwargs: Any ) -> None: @@ -14068,6 +14936,22 @@ async def delete( return cls(pipeline_response, None, {}) # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "orderby", + "top", + "skip_token", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def list( self, resource_group_name: str, @@ -14190,7 +15074,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class AlertRuleOperations: +class AlertRuleOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -14209,12 +15093,28 @@ def __init__(self, *args, **kwargs) -> None: self._serialize: Serializer = input_args.pop(0) if input_args else kwargs.pop("serializer") self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "rule_id", + "content_type", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def _trigger_rule_run_initial( self, resource_group_name: str, workspace_name: str, rule_id: str, - analytics_rule_run_trigger_parameter: Union[_models.AnalyticsRuleRunTrigger, JSON, IO[bytes]], + analytics_rule_run_trigger_parameter: Union[ + _models.AnalyticsRuleRunTrigger, _types.AnalyticsRuleRunTrigger, IO[bytes] + ], **kwargs: Any ) -> AsyncIterator[bytes]: error_map: MutableMapping = { @@ -14294,7 +15194,7 @@ async def begin_trigger_rule_run( *, content_type: str = "application/json", **kwargs: Any - ) -> AsyncLROPoller[_models.AlertRule]: + ) -> AsyncLROPoller[None]: """triggers analytics rule run. :param resource_group_name: The name of the resource group. The name is case insensitive. @@ -14310,9 +15210,8 @@ async def begin_trigger_rule_run( :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str - :return: An instance of AsyncLROPoller that returns AlertRule. The AlertRule is compatible with - MutableMapping - :rtype: ~azure.core.polling.AsyncLROPoller[~azure.mgmt.securityinsight.models.AlertRule] + :return: An instance of AsyncLROPoller that returns None + :rtype: ~azure.core.polling.AsyncLROPoller[None] :raises ~azure.core.exceptions.HttpResponseError: """ @@ -14322,11 +15221,11 @@ async def begin_trigger_rule_run( resource_group_name: str, workspace_name: str, rule_id: str, - analytics_rule_run_trigger_parameter: JSON, + analytics_rule_run_trigger_parameter: _types.AnalyticsRuleRunTrigger, *, content_type: str = "application/json", **kwargs: Any - ) -> AsyncLROPoller[_models.AlertRule]: + ) -> AsyncLROPoller[None]: """triggers analytics rule run. :param resource_group_name: The name of the resource group. The name is case insensitive. @@ -14337,13 +15236,13 @@ async def begin_trigger_rule_run( :param rule_id: Alert rule ID. Required. :type rule_id: str :param analytics_rule_run_trigger_parameter: The content of the action request. Required. - :type analytics_rule_run_trigger_parameter: JSON + :type analytics_rule_run_trigger_parameter: + ~azure.mgmt.securityinsight.types.AnalyticsRuleRunTrigger :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str - :return: An instance of AsyncLROPoller that returns AlertRule. The AlertRule is compatible with - MutableMapping - :rtype: ~azure.core.polling.AsyncLROPoller[~azure.mgmt.securityinsight.models.AlertRule] + :return: An instance of AsyncLROPoller that returns None + :rtype: ~azure.core.polling.AsyncLROPoller[None] :raises ~azure.core.exceptions.HttpResponseError: """ @@ -14357,7 +15256,7 @@ async def begin_trigger_rule_run( *, content_type: str = "application/json", **kwargs: Any - ) -> AsyncLROPoller[_models.AlertRule]: + ) -> AsyncLROPoller[None]: """triggers analytics rule run. :param resource_group_name: The name of the resource group. The name is case insensitive. @@ -14372,21 +15271,36 @@ async def begin_trigger_rule_run( :keyword content_type: Body Parameter content-type. Content type parameter for binary body. Default value is "application/json". :paramtype content_type: str - :return: An instance of AsyncLROPoller that returns AlertRule. The AlertRule is compatible with - MutableMapping - :rtype: ~azure.core.polling.AsyncLROPoller[~azure.mgmt.securityinsight.models.AlertRule] + :return: An instance of AsyncLROPoller that returns None + :rtype: ~azure.core.polling.AsyncLROPoller[None] :raises ~azure.core.exceptions.HttpResponseError: """ @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "rule_id", + "content_type", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def begin_trigger_rule_run( self, resource_group_name: str, workspace_name: str, rule_id: str, - analytics_rule_run_trigger_parameter: Union[_models.AnalyticsRuleRunTrigger, JSON, IO[bytes]], + analytics_rule_run_trigger_parameter: Union[ + _models.AnalyticsRuleRunTrigger, _types.AnalyticsRuleRunTrigger, IO[bytes] + ], **kwargs: Any - ) -> AsyncLROPoller[_models.AlertRule]: + ) -> AsyncLROPoller[None]: """triggers analytics rule run. :param resource_group_name: The name of the resource group. The name is case insensitive. @@ -14396,20 +15310,20 @@ async def begin_trigger_rule_run( :type workspace_name: str :param rule_id: Alert rule ID. Required. :type rule_id: str - :param analytics_rule_run_trigger_parameter: The content of the action request. Is one of the - following types: AnalyticsRuleRunTrigger, JSON, IO[bytes] Required. + :param analytics_rule_run_trigger_parameter: The content of the action request. Is either a + AnalyticsRuleRunTrigger type or a IO[bytes] type. Required. :type analytics_rule_run_trigger_parameter: - ~azure.mgmt.securityinsight.models.AnalyticsRuleRunTrigger or JSON or IO[bytes] - :return: An instance of AsyncLROPoller that returns AlertRule. The AlertRule is compatible with - MutableMapping - :rtype: ~azure.core.polling.AsyncLROPoller[~azure.mgmt.securityinsight.models.AlertRule] + ~azure.mgmt.securityinsight.models.AnalyticsRuleRunTrigger or + ~azure.mgmt.securityinsight.types.AnalyticsRuleRunTrigger or IO[bytes] + :return: An instance of AsyncLROPoller that returns None + :rtype: ~azure.core.polling.AsyncLROPoller[None] :raises ~azure.core.exceptions.HttpResponseError: """ _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = kwargs.pop("params", {}) or {} content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - cls: ClsType[_models.AlertRule] = kwargs.pop("cls", None) + cls: ClsType[None] = kwargs.pop("cls", None) polling: Union[bool, AsyncPollingMethod] = kwargs.pop("polling", True) lro_delay = kwargs.pop("polling_interval", self._config.polling_interval) cont_token: Optional[str] = kwargs.pop("continuation_token", None) @@ -14428,15 +15342,9 @@ async def begin_trigger_rule_run( await raw_result.http_response.read() # type: ignore kwargs.pop("error_map", None) - def get_long_running_output(pipeline_response): - response_headers = {} - response = pipeline_response.http_response - response_headers["Location"] = self._deserialize("str", response.headers.get("Location")) - - deserialized = _deserialize(_models.AlertRule, response.json()) + def get_long_running_output(pipeline_response): # pylint: disable=inconsistent-return-statements if cls: - return cls(pipeline_response, deserialized, response_headers) # type: ignore - return deserialized + return cls(pipeline_response, None, {}) # type: ignore path_format_arguments = { "endpoint": self._serialize.url("self._config.base_url", self._config.base_url, "str", skip_quote=True), @@ -14451,18 +15359,16 @@ def get_long_running_output(pipeline_response): else: polling_method = polling if cont_token: - return AsyncLROPoller[_models.AlertRule].from_continuation_token( + return AsyncLROPoller[None].from_continuation_token( polling_method=polling_method, continuation_token=cont_token, client=self._client, deserialization_callback=get_long_running_output, ) - return AsyncLROPoller[_models.AlertRule]( - self._client, raw_result, get_long_running_output, polling_method # type: ignore - ) + return AsyncLROPoller[None](self._client, raw_result, get_long_running_output, polling_method) # type: ignore -class ActionsOperations: +class ActionsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -14599,7 +15505,7 @@ async def create_or_update( workspace_name: str, rule_id: str, action_id: str, - action: JSON, + action: _types.ActionRequest, *, content_type: str = "application/json", **kwargs: Any @@ -14616,7 +15522,7 @@ async def create_or_update( :param action_id: Action ID. Required. :type action_id: str :param action: The action. Required. - :type action: JSON + :type action: ~azure.mgmt.securityinsight.types.ActionRequest :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -14665,7 +15571,7 @@ async def create_or_update( workspace_name: str, rule_id: str, action_id: str, - action: Union[_models.ActionRequest, JSON, IO[bytes]], + action: Union[_models.ActionRequest, _types.ActionRequest, IO[bytes]], **kwargs: Any ) -> _models.ActionResponse: """Creates or updates the action of alert rule. @@ -14679,9 +15585,9 @@ async def create_or_update( :type rule_id: str :param action_id: Action ID. Required. :type action_id: str - :param action: The action. Is one of the following types: ActionRequest, JSON, IO[bytes] - Required. - :type action: ~azure.mgmt.securityinsight.models.ActionRequest or JSON or IO[bytes] + :param action: The action. Is either a ActionRequest type or a IO[bytes] type. Required. + :type action: ~azure.mgmt.securityinsight.models.ActionRequest or + ~azure.mgmt.securityinsight.types.ActionRequest or IO[bytes] :return: ActionResponse. The ActionResponse is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.ActionResponse :raises ~azure.core.exceptions.HttpResponseError: @@ -14927,7 +15833,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class BookmarkOperations: +class BookmarkOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -14982,7 +15888,7 @@ async def expand( resource_group_name: str, workspace_name: str, bookmark_id: str, - parameters: JSON, + parameters: _types.BookmarkExpandParameters, *, content_type: str = "application/json", **kwargs: Any @@ -14997,7 +15903,7 @@ async def expand( :param bookmark_id: Bookmark ID. Required. :type bookmark_id: str :param parameters: The content of the action request. Required. - :type parameters: JSON + :type parameters: ~azure.mgmt.securityinsight.types.BookmarkExpandParameters :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -15037,12 +15943,27 @@ async def expand( """ @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "bookmark_id", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def expand( self, resource_group_name: str, workspace_name: str, bookmark_id: str, - parameters: Union[_models.BookmarkExpandParameters, JSON, IO[bytes]], + parameters: Union[_models.BookmarkExpandParameters, _types.BookmarkExpandParameters, IO[bytes]], **kwargs: Any ) -> _models.BookmarkExpandResponse: """Expand an bookmark. @@ -15054,10 +15975,10 @@ async def expand( :type workspace_name: str :param bookmark_id: Bookmark ID. Required. :type bookmark_id: str - :param parameters: The content of the action request. Is one of the following types: - BookmarkExpandParameters, JSON, IO[bytes] Required. - :type parameters: ~azure.mgmt.securityinsight.models.BookmarkExpandParameters or JSON or - IO[bytes] + :param parameters: The content of the action request. Is either a BookmarkExpandParameters type + or a IO[bytes] type. Required. + :type parameters: ~azure.mgmt.securityinsight.models.BookmarkExpandParameters or + ~azure.mgmt.securityinsight.types.BookmarkExpandParameters or IO[bytes] :return: BookmarkExpandResponse. The BookmarkExpandResponse is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.BookmarkExpandResponse :raises ~azure.core.exceptions.HttpResponseError: @@ -15131,7 +16052,7 @@ async def expand( return deserialized # type: ignore -class ContentPackagesOperations: +class ContentPackagesOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -15367,7 +16288,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class ContentPackageOperations: +class ContentPackageOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -15422,7 +16343,7 @@ async def install( resource_group_name: str, workspace_name: str, package_id: str, - package_installation_properties: JSON, + package_installation_properties: _types.PackageModel, *, content_type: str = "application/json", **kwargs: Any @@ -15437,7 +16358,7 @@ async def install( :param package_id: package Id. Required. :type package_id: str :param package_installation_properties: Package installation properties. Required. - :type package_installation_properties: JSON + :type package_installation_properties: ~azure.mgmt.securityinsight.types.PackageModel :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -15482,7 +16403,7 @@ async def install( resource_group_name: str, workspace_name: str, package_id: str, - package_installation_properties: Union[_models.PackageModel, JSON, IO[bytes]], + package_installation_properties: Union[_models.PackageModel, _types.PackageModel, IO[bytes]], **kwargs: Any ) -> _models.PackageModel: """Install a package to the workspace. @@ -15494,10 +16415,10 @@ async def install( :type workspace_name: str :param package_id: package Id. Required. :type package_id: str - :param package_installation_properties: Package installation properties. Is one of the - following types: PackageModel, JSON, IO[bytes] Required. - :type package_installation_properties: ~azure.mgmt.securityinsight.models.PackageModel or JSON - or IO[bytes] + :param package_installation_properties: Package installation properties. Is either a + PackageModel type or a IO[bytes] type. Required. + :type package_installation_properties: ~azure.mgmt.securityinsight.models.PackageModel or + ~azure.mgmt.securityinsight.types.PackageModel or IO[bytes] :return: PackageModel. The PackageModel is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.PackageModel :raises ~azure.core.exceptions.HttpResponseError: @@ -15631,7 +16552,7 @@ async def uninstall(self, resource_group_name: str, workspace_name: str, package return cls(pipeline_response, None, {}) # type: ignore -class ProductPackageOperations: +class ProductPackageOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -15726,7 +16647,7 @@ async def get( return deserialized # type: ignore -class ProductPackagesOperations: +class ProductPackagesOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -15881,7 +16802,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class ProductTemplateOperations: +class ProductTemplateOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -15976,7 +16897,7 @@ async def get( return deserialized # type: ignore -class ProductTemplatesOperations: +class ProductTemplatesOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -16137,7 +17058,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class ContentTemplateOperations: +class ContentTemplateOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -16271,7 +17192,7 @@ async def install( resource_group_name: str, workspace_name: str, template_id: str, - template_installation_properties: JSON, + template_installation_properties: _types.TemplateModel, *, content_type: str = "application/json", **kwargs: Any @@ -16286,7 +17207,7 @@ async def install( :param template_id: template Id. Required. :type template_id: str :param template_installation_properties: Template installation properties. Required. - :type template_installation_properties: JSON + :type template_installation_properties: ~azure.mgmt.securityinsight.types.TemplateModel :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -16331,7 +17252,7 @@ async def install( resource_group_name: str, workspace_name: str, template_id: str, - template_installation_properties: Union[_models.TemplateModel, JSON, IO[bytes]], + template_installation_properties: Union[_models.TemplateModel, _types.TemplateModel, IO[bytes]], **kwargs: Any ) -> _models.TemplateModel: """Install a template. @@ -16343,10 +17264,10 @@ async def install( :type workspace_name: str :param template_id: template Id. Required. :type template_id: str - :param template_installation_properties: Template installation properties. Is one of the - following types: TemplateModel, JSON, IO[bytes] Required. + :param template_installation_properties: Template installation properties. Is either a + TemplateModel type or a IO[bytes] type. Required. :type template_installation_properties: ~azure.mgmt.securityinsight.models.TemplateModel or - JSON or IO[bytes] + ~azure.mgmt.securityinsight.types.TemplateModel or IO[bytes] :return: TemplateModel. The TemplateModel is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.TemplateModel :raises ~azure.core.exceptions.HttpResponseError: @@ -16480,7 +17401,7 @@ async def delete(self, resource_group_name: str, workspace_name: str, template_i return cls(pipeline_response, None, {}) # type: ignore -class ContentTemplatesOperations: +class ContentTemplatesOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -16650,7 +17571,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class IncidentRelationsOperations: +class IncidentRelationsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -16787,7 +17708,7 @@ async def create_or_update( workspace_name: str, incident_id: str, relation_name: str, - relation: JSON, + relation: _types.Relation, *, content_type: str = "application/json", **kwargs: Any @@ -16804,7 +17725,7 @@ async def create_or_update( :param relation_name: Relation Name. Required. :type relation_name: str :param relation: The relation model. Required. - :type relation: JSON + :type relation: ~azure.mgmt.securityinsight.types.Relation :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -16853,7 +17774,7 @@ async def create_or_update( workspace_name: str, incident_id: str, relation_name: str, - relation: Union[_models.Relation, JSON, IO[bytes]], + relation: Union[_models.Relation, _types.Relation, IO[bytes]], **kwargs: Any ) -> _models.Relation: """Creates or updates the incident relation. @@ -16867,9 +17788,9 @@ async def create_or_update( :type incident_id: str :param relation_name: Relation Name. Required. :type relation_name: str - :param relation: The relation model. Is one of the following types: Relation, JSON, IO[bytes] - Required. - :type relation: ~azure.mgmt.securityinsight.models.Relation or JSON or IO[bytes] + :param relation: The relation model. Is either a Relation type or a IO[bytes] type. Required. + :type relation: ~azure.mgmt.securityinsight.models.Relation or + ~azure.mgmt.securityinsight.types.Relation or IO[bytes] :return: Relation. The Relation is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.Relation :raises ~azure.core.exceptions.HttpResponseError: @@ -17139,7 +18060,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class EntitiesRelationsOperations: +class EntitiesRelationsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -17289,7 +18210,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class MetadataOperations: +class MetadataOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -17419,7 +18340,7 @@ async def create( resource_group_name: str, workspace_name: str, metadata_name: str, - metadata: JSON, + metadata: _types.MetadataModel, *, content_type: str = "application/json", **kwargs: Any @@ -17434,7 +18355,7 @@ async def create( :param metadata_name: The Metadata name. Required. :type metadata_name: str :param metadata: Metadata resource. Required. - :type metadata: JSON + :type metadata: ~azure.mgmt.securityinsight.types.MetadataModel :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -17479,7 +18400,7 @@ async def create( resource_group_name: str, workspace_name: str, metadata_name: str, - metadata: Union[_models.MetadataModel, JSON, IO[bytes]], + metadata: Union[_models.MetadataModel, _types.MetadataModel, IO[bytes]], **kwargs: Any ) -> _models.MetadataModel: """Create a Metadata. @@ -17491,9 +18412,10 @@ async def create( :type workspace_name: str :param metadata_name: The Metadata name. Required. :type metadata_name: str - :param metadata: Metadata resource. Is one of the following types: MetadataModel, JSON, - IO[bytes] Required. - :type metadata: ~azure.mgmt.securityinsight.models.MetadataModel or JSON or IO[bytes] + :param metadata: Metadata resource. Is either a MetadataModel type or a IO[bytes] type. + Required. + :type metadata: ~azure.mgmt.securityinsight.models.MetadataModel or + ~azure.mgmt.securityinsight.types.MetadataModel or IO[bytes] :return: MetadataModel. The MetadataModel is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.MetadataModel :raises ~azure.core.exceptions.HttpResponseError: @@ -17602,7 +18524,7 @@ async def update( resource_group_name: str, workspace_name: str, metadata_name: str, - metadata_patch: JSON, + metadata_patch: _types.MetadataPatch, *, content_type: str = "application/json", **kwargs: Any @@ -17617,7 +18539,7 @@ async def update( :param metadata_name: The Metadata name. Required. :type metadata_name: str :param metadata_patch: Partial metadata request. Required. - :type metadata_patch: JSON + :type metadata_patch: ~azure.mgmt.securityinsight.types.MetadataPatch :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -17662,7 +18584,7 @@ async def update( resource_group_name: str, workspace_name: str, metadata_name: str, - metadata_patch: Union[_models.MetadataPatch, JSON, IO[bytes]], + metadata_patch: Union[_models.MetadataPatch, _types.MetadataPatch, IO[bytes]], **kwargs: Any ) -> _models.MetadataModel: """Update an existing Metadata. @@ -17674,9 +18596,10 @@ async def update( :type workspace_name: str :param metadata_name: The Metadata name. Required. :type metadata_name: str - :param metadata_patch: Partial metadata request. Is one of the following types: MetadataPatch, - JSON, IO[bytes] Required. - :type metadata_patch: ~azure.mgmt.securityinsight.models.MetadataPatch or JSON or IO[bytes] + :param metadata_patch: Partial metadata request. Is either a MetadataPatch type or a IO[bytes] + type. Required. + :type metadata_patch: ~azure.mgmt.securityinsight.models.MetadataPatch or + ~azure.mgmt.securityinsight.types.MetadataPatch or IO[bytes] :return: MetadataModel. The MetadataModel is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.MetadataModel :raises ~azure.core.exceptions.HttpResponseError: @@ -17935,7 +18858,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class ThreatIntelligenceIndicatorOperations: +class ThreatIntelligenceIndicatorOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -18069,7 +18992,7 @@ async def create( resource_group_name: str, workspace_name: str, name: str, - threat_intelligence_properties: JSON, + threat_intelligence_properties: _types.ThreatIntelligenceIndicatorModel, *, content_type: str = "application/json", **kwargs: Any @@ -18085,7 +19008,8 @@ async def create( :type name: str :param threat_intelligence_properties: Properties of threat intelligence indicators to create and update. Required. - :type threat_intelligence_properties: JSON + :type threat_intelligence_properties: + ~azure.mgmt.securityinsight.types.ThreatIntelligenceIndicatorModel :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -18133,7 +19057,9 @@ async def create( resource_group_name: str, workspace_name: str, name: str, - threat_intelligence_properties: Union[_models.ThreatIntelligenceIndicatorModel, JSON, IO[bytes]], + threat_intelligence_properties: Union[ + _models.ThreatIntelligenceIndicatorModel, _types.ThreatIntelligenceIndicatorModel, IO[bytes] + ], **kwargs: Any ) -> _models.ThreatIntelligenceInformation: """Update a threat Intelligence indicator. @@ -18146,10 +19072,10 @@ async def create( :param name: Threat intelligence indicator name field. Required. :type name: str :param threat_intelligence_properties: Properties of threat intelligence indicators to create - and update. Is one of the following types: ThreatIntelligenceIndicatorModel, JSON, IO[bytes] - Required. + and update. Is either a ThreatIntelligenceIndicatorModel type or a IO[bytes] type. Required. :type threat_intelligence_properties: - ~azure.mgmt.securityinsight.models.ThreatIntelligenceIndicatorModel or JSON or IO[bytes] + ~azure.mgmt.securityinsight.models.ThreatIntelligenceIndicatorModel or + ~azure.mgmt.securityinsight.types.ThreatIntelligenceIndicatorModel or IO[bytes] :return: ThreatIntelligenceInformation. The ThreatIntelligenceInformation is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.ThreatIntelligenceInformation @@ -18321,7 +19247,7 @@ async def append_tags( resource_group_name: str, workspace_name: str, name: str, - threat_intelligence_append_tags: JSON, + threat_intelligence_append_tags: _types.ThreatIntelligenceAppendTags, *, content_type: str = "application/json", **kwargs: Any @@ -18337,7 +19263,8 @@ async def append_tags( :type name: str :param threat_intelligence_append_tags: The threat intelligence append tags request body. Required. - :type threat_intelligence_append_tags: JSON + :type threat_intelligence_append_tags: + ~azure.mgmt.securityinsight.types.ThreatIntelligenceAppendTags :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -18383,7 +19310,9 @@ async def append_tags( resource_group_name: str, workspace_name: str, name: str, - threat_intelligence_append_tags: Union[_models.ThreatIntelligenceAppendTags, JSON, IO[bytes]], + threat_intelligence_append_tags: Union[ + _models.ThreatIntelligenceAppendTags, _types.ThreatIntelligenceAppendTags, IO[bytes] + ], **kwargs: Any ) -> None: """Append tags to a threat intelligence indicator. @@ -18396,9 +19325,10 @@ async def append_tags( :param name: Threat intelligence indicator name field. Required. :type name: str :param threat_intelligence_append_tags: The threat intelligence append tags request body. Is - one of the following types: ThreatIntelligenceAppendTags, JSON, IO[bytes] Required. + either a ThreatIntelligenceAppendTags type or a IO[bytes] type. Required. :type threat_intelligence_append_tags: - ~azure.mgmt.securityinsight.models.ThreatIntelligenceAppendTags or JSON or IO[bytes] + ~azure.mgmt.securityinsight.models.ThreatIntelligenceAppendTags or + ~azure.mgmt.securityinsight.types.ThreatIntelligenceAppendTags or IO[bytes] :return: None :rtype: None :raises ~azure.core.exceptions.HttpResponseError: @@ -18497,7 +19427,7 @@ async def replace_tags( resource_group_name: str, workspace_name: str, name: str, - threat_intelligence_replace_tags: JSON, + threat_intelligence_replace_tags: _types.ThreatIntelligenceIndicatorModel, *, content_type: str = "application/json", **kwargs: Any @@ -18513,7 +19443,8 @@ async def replace_tags( :type name: str :param threat_intelligence_replace_tags: Tags in the threat intelligence indicator to be replaced. Required. - :type threat_intelligence_replace_tags: JSON + :type threat_intelligence_replace_tags: + ~azure.mgmt.securityinsight.types.ThreatIntelligenceIndicatorModel :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -18561,7 +19492,9 @@ async def replace_tags( resource_group_name: str, workspace_name: str, name: str, - threat_intelligence_replace_tags: Union[_models.ThreatIntelligenceIndicatorModel, JSON, IO[bytes]], + threat_intelligence_replace_tags: Union[ + _models.ThreatIntelligenceIndicatorModel, _types.ThreatIntelligenceIndicatorModel, IO[bytes] + ], **kwargs: Any ) -> _models.ThreatIntelligenceInformation: """Replace tags added to a threat intelligence indicator. @@ -18574,10 +19507,10 @@ async def replace_tags( :param name: Threat intelligence indicator name field. Required. :type name: str :param threat_intelligence_replace_tags: Tags in the threat intelligence indicator to be - replaced. Is one of the following types: ThreatIntelligenceIndicatorModel, JSON, IO[bytes] - Required. + replaced. Is either a ThreatIntelligenceIndicatorModel type or a IO[bytes] type. Required. :type threat_intelligence_replace_tags: - ~azure.mgmt.securityinsight.models.ThreatIntelligenceIndicatorModel or JSON or IO[bytes] + ~azure.mgmt.securityinsight.models.ThreatIntelligenceIndicatorModel or + ~azure.mgmt.securityinsight.types.ThreatIntelligenceIndicatorModel or IO[bytes] :return: ThreatIntelligenceInformation. The ThreatIntelligenceInformation is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.ThreatIntelligenceInformation @@ -18685,7 +19618,7 @@ async def create_indicator( self, resource_group_name: str, workspace_name: str, - threat_intelligence_properties: JSON, + threat_intelligence_properties: _types.ThreatIntelligenceIndicatorModel, *, content_type: str = "application/json", **kwargs: Any @@ -18698,7 +19631,8 @@ async def create_indicator( :param workspace_name: The name of the monitor workspace. Required. :type workspace_name: str :param threat_intelligence_properties: The content of the action request. Required. - :type threat_intelligence_properties: JSON + :type threat_intelligence_properties: + ~azure.mgmt.securityinsight.types.ThreatIntelligenceIndicatorModel :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -18741,7 +19675,9 @@ async def create_indicator( self, resource_group_name: str, workspace_name: str, - threat_intelligence_properties: Union[_models.ThreatIntelligenceIndicatorModel, JSON, IO[bytes]], + threat_intelligence_properties: Union[ + _models.ThreatIntelligenceIndicatorModel, _types.ThreatIntelligenceIndicatorModel, IO[bytes] + ], **kwargs: Any ) -> _models.ThreatIntelligenceInformation: """Create a new threat intelligence indicator. @@ -18751,10 +19687,11 @@ async def create_indicator( :type resource_group_name: str :param workspace_name: The name of the monitor workspace. Required. :type workspace_name: str - :param threat_intelligence_properties: The content of the action request. Is one of the - following types: ThreatIntelligenceIndicatorModel, JSON, IO[bytes] Required. + :param threat_intelligence_properties: The content of the action request. Is either a + ThreatIntelligenceIndicatorModel type or a IO[bytes] type. Required. :type threat_intelligence_properties: - ~azure.mgmt.securityinsight.models.ThreatIntelligenceIndicatorModel or JSON or IO[bytes] + ~azure.mgmt.securityinsight.models.ThreatIntelligenceIndicatorModel or + ~azure.mgmt.securityinsight.types.ThreatIntelligenceIndicatorModel or IO[bytes] :return: ThreatIntelligenceInformation. The ThreatIntelligenceInformation is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.ThreatIntelligenceInformation @@ -18861,7 +19798,7 @@ def query_indicators( self, resource_group_name: str, workspace_name: str, - threat_intelligence_filtering_criteria: JSON, + threat_intelligence_filtering_criteria: _types.ThreatIntelligenceFilteringCriteria, *, content_type: str = "application/json", **kwargs: Any @@ -18874,7 +19811,8 @@ def query_indicators( :param workspace_name: The name of the monitor workspace. Required. :type workspace_name: str :param threat_intelligence_filtering_criteria: The content of the action request. Required. - :type threat_intelligence_filtering_criteria: JSON + :type threat_intelligence_filtering_criteria: + ~azure.mgmt.securityinsight.types.ThreatIntelligenceFilteringCriteria :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -18917,7 +19855,9 @@ def query_indicators( self, resource_group_name: str, workspace_name: str, - threat_intelligence_filtering_criteria: Union[_models.ThreatIntelligenceFilteringCriteria, JSON, IO[bytes]], + threat_intelligence_filtering_criteria: Union[ + _models.ThreatIntelligenceFilteringCriteria, _types.ThreatIntelligenceFilteringCriteria, IO[bytes] + ], **kwargs: Any ) -> AsyncItemPaged["_models.ThreatIntelligenceInformation"]: """Query threat intelligence indicators as per filtering criteria. @@ -18927,10 +19867,11 @@ def query_indicators( :type resource_group_name: str :param workspace_name: The name of the monitor workspace. Required. :type workspace_name: str - :param threat_intelligence_filtering_criteria: The content of the action request. Is one of the - following types: ThreatIntelligenceFilteringCriteria, JSON, IO[bytes] Required. + :param threat_intelligence_filtering_criteria: The content of the action request. Is either a + ThreatIntelligenceFilteringCriteria type or a IO[bytes] type. Required. :type threat_intelligence_filtering_criteria: - ~azure.mgmt.securityinsight.models.ThreatIntelligenceFilteringCriteria or JSON or IO[bytes] + ~azure.mgmt.securityinsight.models.ThreatIntelligenceFilteringCriteria or + ~azure.mgmt.securityinsight.types.ThreatIntelligenceFilteringCriteria or IO[bytes] :return: An iterator like instance of ThreatIntelligenceInformation :rtype: ~azure.core.async_paging.AsyncItemPaged[~azure.mgmt.securityinsight.models.ThreatIntelligenceInformation] @@ -19033,7 +19974,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class ThreatIntelligenceIndicatorsOperations: +class ThreatIntelligenceIndicatorsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -19180,7 +20121,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class DataConnectorsCheckRequirementsOperations: # pylint: disable=name-too-long +class DataConnectorsCheckRequirementsOperations: # pylint: disable=docstring-missing-param,name-too-long """ .. warning:: **DO NOT** instantiate this class directly. @@ -19234,7 +20175,7 @@ async def post( self, resource_group_name: str, workspace_name: str, - data_connectors_check_requirements: JSON, + data_connectors_check_requirements: _types.DataConnectorsCheckRequirements, *, content_type: str = "application/json", **kwargs: Any @@ -19248,7 +20189,8 @@ async def post( :type workspace_name: str :param data_connectors_check_requirements: The parameters for requirements check message. Required. - :type data_connectors_check_requirements: JSON + :type data_connectors_check_requirements: + ~azure.mgmt.securityinsight.types.DataConnectorsCheckRequirements :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -19292,7 +20234,9 @@ async def post( self, resource_group_name: str, workspace_name: str, - data_connectors_check_requirements: Union[_models.DataConnectorsCheckRequirements, JSON, IO[bytes]], + data_connectors_check_requirements: Union[ + _models.DataConnectorsCheckRequirements, _types.DataConnectorsCheckRequirements, IO[bytes] + ], **kwargs: Any ) -> _models.DataConnectorRequirementsState: """Get requirements state for a data connector type. @@ -19303,9 +20247,10 @@ async def post( :param workspace_name: The name of the workspace. Required. :type workspace_name: str :param data_connectors_check_requirements: The parameters for requirements check message. Is - one of the following types: DataConnectorsCheckRequirements, JSON, IO[bytes] Required. + either a DataConnectorsCheckRequirements type or a IO[bytes] type. Required. :type data_connectors_check_requirements: - ~azure.mgmt.securityinsight.models.DataConnectorsCheckRequirements or JSON or IO[bytes] + ~azure.mgmt.securityinsight.models.DataConnectorsCheckRequirements or + ~azure.mgmt.securityinsight.types.DataConnectorsCheckRequirements or IO[bytes] :return: DataConnectorRequirementsState. The DataConnectorRequirementsState is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.DataConnectorRequirementsState @@ -19379,7 +20324,7 @@ async def post( return deserialized # type: ignore -class SourceControlOperations: +class SourceControlOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -19430,7 +20375,7 @@ def list_repositories( self, resource_group_name: str, workspace_name: str, - repository_access: JSON, + repository_access: _types.RepositoryAccessProperties, *, content_type: str = "application/json", **kwargs: Any @@ -19443,7 +20388,7 @@ def list_repositories( :param workspace_name: The name of the workspace. Required. :type workspace_name: str :param repository_access: The content of the action request. Required. - :type repository_access: JSON + :type repository_access: ~azure.mgmt.securityinsight.types.RepositoryAccessProperties :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -19484,7 +20429,7 @@ def list_repositories( self, resource_group_name: str, workspace_name: str, - repository_access: Union[_models.RepositoryAccessProperties, JSON, IO[bytes]], + repository_access: Union[_models.RepositoryAccessProperties, _types.RepositoryAccessProperties, IO[bytes]], **kwargs: Any ) -> AsyncItemPaged["_models.Repo"]: """Gets a list of repositories metadata. @@ -19494,10 +20439,10 @@ def list_repositories( :type resource_group_name: str :param workspace_name: The name of the workspace. Required. :type workspace_name: str - :param repository_access: The content of the action request. Is one of the following types: - RepositoryAccessProperties, JSON, IO[bytes] Required. - :type repository_access: ~azure.mgmt.securityinsight.models.RepositoryAccessProperties or JSON - or IO[bytes] + :param repository_access: The content of the action request. Is either a + RepositoryAccessProperties type or a IO[bytes] type. Required. + :type repository_access: ~azure.mgmt.securityinsight.models.RepositoryAccessProperties or + ~azure.mgmt.securityinsight.types.RepositoryAccessProperties or IO[bytes] :return: An iterator like instance of Repo :rtype: ~azure.core.async_paging.AsyncItemPaged[~azure.mgmt.securityinsight.models.Repo] :raises ~azure.core.exceptions.HttpResponseError: @@ -19599,7 +20544,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class ThreatIntelligenceIndicatorMetricsOperations: # pylint: disable=name-too-long +class ThreatIntelligenceIndicatorMetricsOperations: # pylint: disable=docstring-missing-param,name-too-long """ .. warning:: **DO NOT** instantiate this class directly. @@ -19692,7 +20637,7 @@ async def list( return deserialized # type: ignore -class ThreatIntelligenceOperations: +class ThreatIntelligenceOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -19747,7 +20692,7 @@ async def count( resource_group_name: str, workspace_name: str, ti_type: Union[str, _models.TiType], - query: Optional[JSON] = None, + query: Optional[_types.CountQuery] = None, *, content_type: str = "application/json", **kwargs: Any @@ -19762,7 +20707,7 @@ async def count( :param ti_type: TI type. "main" Required. :type ti_type: str or ~azure.mgmt.securityinsight.models.TiType :param query: The query to run on the TI objects in the workspace. Default value is None. - :type query: JSON + :type query: ~azure.mgmt.securityinsight.types.CountQuery :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -19807,7 +20752,7 @@ async def count( resource_group_name: str, workspace_name: str, ti_type: Union[str, _models.TiType], - query: Optional[Union[_models.CountQuery, JSON, IO[bytes]]] = None, + query: Optional[Union[_models.CountQuery, _types.CountQuery, IO[bytes]]] = None, **kwargs: Any ) -> _models.ThreatIntelligenceCount: """Gets the count of all TI objects for the workspace. @@ -19819,9 +20764,10 @@ async def count( :type workspace_name: str :param ti_type: TI type. "main" Required. :type ti_type: str or ~azure.mgmt.securityinsight.models.TiType - :param query: The query to run on the TI objects in the workspace. Is one of the following - types: CountQuery, JSON, IO[bytes] Default value is None. - :type query: ~azure.mgmt.securityinsight.models.CountQuery or JSON or IO[bytes] + :param query: The query to run on the TI objects in the workspace. Is either a CountQuery type + or a IO[bytes] type. Default value is None. + :type query: ~azure.mgmt.securityinsight.models.CountQuery or + ~azure.mgmt.securityinsight.types.CountQuery or IO[bytes] :return: ThreatIntelligenceCount. The ThreatIntelligenceCount is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.ThreatIntelligenceCount :raises ~azure.core.exceptions.HttpResponseError: @@ -19934,7 +20880,7 @@ def query( resource_group_name: str, workspace_name: str, ti_type: Union[str, _models.TiType], - query: Optional[JSON] = None, + query: Optional[_types.Query] = None, *, content_type: str = "application/json", **kwargs: Any @@ -19949,7 +20895,7 @@ def query( :param ti_type: TI type. "main" Required. :type ti_type: str or ~azure.mgmt.securityinsight.models.TiType :param query: The query to run on the TI objects in the workspace. Default value is None. - :type query: JSON + :type query: ~azure.mgmt.securityinsight.types.Query :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -19994,7 +20940,7 @@ def query( resource_group_name: str, workspace_name: str, ti_type: Union[str, _models.TiType], - query: Optional[Union[_models.Query, JSON, IO[bytes]]] = None, + query: Optional[Union[_models.Query, _types.Query, IO[bytes]]] = None, **kwargs: Any ) -> AsyncItemPaged["_models.TIObject"]: """Gets all TI objects for the workspace. @@ -20006,9 +20952,10 @@ def query( :type workspace_name: str :param ti_type: TI type. "main" Required. :type ti_type: str or ~azure.mgmt.securityinsight.models.TiType - :param query: The query to run on the TI objects in the workspace. Is one of the following - types: Query, JSON, IO[bytes] Default value is None. - :type query: ~azure.mgmt.securityinsight.models.Query or JSON or IO[bytes] + :param query: The query to run on the TI objects in the workspace. Is either a Query type or a + IO[bytes] type. Default value is None. + :type query: ~azure.mgmt.securityinsight.models.Query or + ~azure.mgmt.securityinsight.types.Query or IO[bytes] :return: An iterator like instance of TIObject :rtype: ~azure.core.async_paging.AsyncItemPaged[~azure.mgmt.securityinsight.models.TIObject] :raises ~azure.core.exceptions.HttpResponseError: @@ -20115,7 +21062,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class EntitiesGetTimelineOperations: +class EntitiesGetTimelineOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -20171,7 +21118,7 @@ async def list( resource_group_name: str, workspace_name: str, entity_id: str, - parameters: JSON, + parameters: _types.EntityTimelineParameters, *, content_type: str = "application/json", **kwargs: Any @@ -20187,7 +21134,7 @@ async def list( :type entity_id: str :param parameters: The parameters required to execute an timeline operation on the given entity. Required. - :type parameters: JSON + :type parameters: ~azure.mgmt.securityinsight.types.EntityTimelineParameters :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -20228,12 +21175,27 @@ async def list( """ @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "entity_id", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def list( self, resource_group_name: str, workspace_name: str, entity_id: str, - parameters: Union[_models.EntityTimelineParameters, JSON, IO[bytes]], + parameters: Union[_models.EntityTimelineParameters, _types.EntityTimelineParameters, IO[bytes]], **kwargs: Any ) -> _models.EntityTimelineResponse: """Timeline for an entity. @@ -20246,9 +21208,9 @@ async def list( :param entity_id: entity ID. Required. :type entity_id: str :param parameters: The parameters required to execute an timeline operation on the given - entity. Is one of the following types: EntityTimelineParameters, JSON, IO[bytes] Required. - :type parameters: ~azure.mgmt.securityinsight.models.EntityTimelineParameters or JSON or - IO[bytes] + entity. Is either a EntityTimelineParameters type or a IO[bytes] type. Required. + :type parameters: ~azure.mgmt.securityinsight.models.EntityTimelineParameters or + ~azure.mgmt.securityinsight.types.EntityTimelineParameters or IO[bytes] :return: EntityTimelineResponse. The EntityTimelineResponse is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.EntityTimelineResponse :raises ~azure.core.exceptions.HttpResponseError: @@ -20322,7 +21284,7 @@ async def list( return deserialized # type: ignore -class GetOperations: +class GetOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -20417,7 +21379,7 @@ async def single_recommendation( return deserialized # type: ignore -class UpdateOperations: +class UpdateOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -20472,7 +21434,7 @@ async def recommendation( resource_group_name: str, workspace_name: str, recommendation_id: str, - recommendation_patch: JSON, + recommendation_patch: _types.RecommendationPatch, *, content_type: str = "application/json", **kwargs: Any @@ -20487,7 +21449,7 @@ async def recommendation( :param recommendation_id: Recommendation Id. Required. :type recommendation_id: str :param recommendation_patch: Recommendation Fields to Update. Required. - :type recommendation_patch: JSON + :type recommendation_patch: ~azure.mgmt.securityinsight.types.RecommendationPatch :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -20532,7 +21494,7 @@ async def recommendation( resource_group_name: str, workspace_name: str, recommendation_id: str, - recommendation_patch: Union[_models.RecommendationPatch, JSON, IO[bytes]], + recommendation_patch: Union[_models.RecommendationPatch, _types.RecommendationPatch, IO[bytes]], **kwargs: Any ) -> _models.Recommendation: """Patch a recommendation. @@ -20544,10 +21506,10 @@ async def recommendation( :type workspace_name: str :param recommendation_id: Recommendation Id. Required. :type recommendation_id: str - :param recommendation_patch: Recommendation Fields to Update. Is one of the following types: - RecommendationPatch, JSON, IO[bytes] Required. - :type recommendation_patch: ~azure.mgmt.securityinsight.models.RecommendationPatch or JSON or - IO[bytes] + :param recommendation_patch: Recommendation Fields to Update. Is either a RecommendationPatch + type or a IO[bytes] type. Required. + :type recommendation_patch: ~azure.mgmt.securityinsight.models.RecommendationPatch or + ~azure.mgmt.securityinsight.types.RecommendationPatch or IO[bytes] :return: Recommendation. The Recommendation is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.Recommendation :raises ~azure.core.exceptions.HttpResponseError: @@ -20621,7 +21583,7 @@ async def recommendation( return deserialized # type: ignore -class GetRecommendationsOperations: +class GetRecommendationsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -20744,7 +21706,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class ReevaluateOperations: +class ReevaluateOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -20839,7 +21801,7 @@ async def recommendation( return deserialized # type: ignore -class TriggeredAnalyticsRuleRunOperations: +class TriggeredAnalyticsRuleRunOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -20935,7 +21897,7 @@ async def get( return deserialized # type: ignore -class GetTriggeredAnalyticsRuleRunsOperations: +class GetTriggeredAnalyticsRuleRunsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -21058,7 +22020,7 @@ async def get_next(next_link=None): return AsyncItemPaged(get_next, extract_data) -class WorkspaceManagerAssignmentJobsOperations: +class WorkspaceManagerAssignmentJobsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -21475,7 +22437,7 @@ async def list_geodata_by_ip( resource_group_name: str, workspace_name: str, enrichment_type: Union[str, _models.EnrichmentType], - ip_address_body: JSON, + ip_address_body: _types.EnrichmentIpAddressBody, *, content_type: str = "application/json", **kwargs: Any @@ -21490,7 +22452,7 @@ async def list_geodata_by_ip( :param enrichment_type: Enrichment type. "main" Required. :type enrichment_type: str or ~azure.mgmt.securityinsight.models.EnrichmentType :param ip_address_body: IP address (v4 or v6) to be enriched. Required. - :type ip_address_body: JSON + :type ip_address_body: ~azure.mgmt.securityinsight.types.EnrichmentIpAddressBody :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -21530,12 +22492,27 @@ async def list_geodata_by_ip( """ @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "enrichment_type", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def list_geodata_by_ip( self, resource_group_name: str, workspace_name: str, enrichment_type: Union[str, _models.EnrichmentType], - ip_address_body: Union[_models.EnrichmentIpAddressBody, JSON, IO[bytes]], + ip_address_body: Union[_models.EnrichmentIpAddressBody, _types.EnrichmentIpAddressBody, IO[bytes]], **kwargs: Any ) -> _models.EnrichmentIpGeodata: """Get geodata for a single IP address. @@ -21547,10 +22524,10 @@ async def list_geodata_by_ip( :type workspace_name: str :param enrichment_type: Enrichment type. "main" Required. :type enrichment_type: str or ~azure.mgmt.securityinsight.models.EnrichmentType - :param ip_address_body: IP address (v4 or v6) to be enriched. Is one of the following types: - EnrichmentIpAddressBody, JSON, IO[bytes] Required. - :type ip_address_body: ~azure.mgmt.securityinsight.models.EnrichmentIpAddressBody or JSON or - IO[bytes] + :param ip_address_body: IP address (v4 or v6) to be enriched. Is either a + EnrichmentIpAddressBody type or a IO[bytes] type. Required. + :type ip_address_body: ~azure.mgmt.securityinsight.models.EnrichmentIpAddressBody or + ~azure.mgmt.securityinsight.types.EnrichmentIpAddressBody or IO[bytes] :return: EnrichmentIpGeodata. The EnrichmentIpGeodata is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.EnrichmentIpGeodata :raises ~azure.core.exceptions.HttpResponseError: @@ -21659,7 +22636,7 @@ async def list_whois_by_domain( resource_group_name: str, workspace_name: str, enrichment_type: Union[str, _models.EnrichmentType], - domain_body: JSON, + domain_body: _types.EnrichmentDomainBody, *, content_type: str = "application/json", **kwargs: Any @@ -21674,7 +22651,7 @@ async def list_whois_by_domain( :param enrichment_type: Enrichment type. "main" Required. :type enrichment_type: str or ~azure.mgmt.securityinsight.models.EnrichmentType :param domain_body: Domain name to be enriched. Only domain name is accepted. Required. - :type domain_body: JSON + :type domain_body: ~azure.mgmt.securityinsight.types.EnrichmentDomainBody :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -21714,12 +22691,27 @@ async def list_whois_by_domain( """ @distributed_trace_async + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "enrichment_type", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) async def list_whois_by_domain( self, resource_group_name: str, workspace_name: str, enrichment_type: Union[str, _models.EnrichmentType], - domain_body: Union[_models.EnrichmentDomainBody, JSON, IO[bytes]], + domain_body: Union[_models.EnrichmentDomainBody, _types.EnrichmentDomainBody, IO[bytes]], **kwargs: Any ) -> _models.EnrichmentDomainWhois: """Get whois information for a single domain name. @@ -21731,9 +22723,10 @@ async def list_whois_by_domain( :type workspace_name: str :param enrichment_type: Enrichment type. "main" Required. :type enrichment_type: str or ~azure.mgmt.securityinsight.models.EnrichmentType - :param domain_body: Domain name to be enriched. Only domain name is accepted. Is one of the - following types: EnrichmentDomainBody, JSON, IO[bytes] Required. - :type domain_body: ~azure.mgmt.securityinsight.models.EnrichmentDomainBody or JSON or IO[bytes] + :param domain_body: Domain name to be enriched. Only domain name is accepted. Is either a + EnrichmentDomainBody type or a IO[bytes] type. Required. + :type domain_body: ~azure.mgmt.securityinsight.models.EnrichmentDomainBody or + ~azure.mgmt.securityinsight.types.EnrichmentDomainBody or IO[bytes] :return: EnrichmentDomainWhois. The EnrichmentDomainWhois is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.EnrichmentDomainWhois :raises ~azure.core.exceptions.HttpResponseError: diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/__init__.py b/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/__init__.py index dbe998417e10..1d2ea94249ec 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/__init__.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/__init__.py @@ -614,9 +614,11 @@ IncidentStatus, IncidentTaskStatus, IngestionMode, + JobProvisioningState, KillChainIntent, Kind, MatchingMethod, + MetadataDependencyOperator, MicrosoftSecurityProductName, Mode, MtpProvider, @@ -630,6 +632,7 @@ ProviderName, ProviderPermissionsScope, ProvisioningState, + PullRequestState, RegistryHive, RegistryValueKind, RepoType, @@ -656,6 +659,7 @@ UebaDataSources, Version, WarningCode, + WatchlistProvisioningState, ) from ._patch import __all__ as _patch_all from ._patch import * @@ -1258,9 +1262,11 @@ "IncidentStatus", "IncidentTaskStatus", "IngestionMode", + "JobProvisioningState", "KillChainIntent", "Kind", "MatchingMethod", + "MetadataDependencyOperator", "MicrosoftSecurityProductName", "Mode", "MtpProvider", @@ -1274,6 +1280,7 @@ "ProviderName", "ProviderPermissionsScope", "ProvisioningState", + "PullRequestState", "RegistryHive", "RegistryValueKind", "RepoType", @@ -1300,6 +1307,7 @@ "UebaDataSources", "Version", "WarningCode", + "WatchlistProvisioningState", ] __all__.extend([p for p in _patch_all if p not in __all__]) # pyright: ignore _patch_sdk() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/_enums.py b/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/_enums.py index 72102e97c913..1e80d56b23c3 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/_enums.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/_enums.py @@ -1115,6 +1115,19 @@ class IngestionMode(str, Enum, metaclass=CaseInsensitiveEnumMeta): """Unspecified.""" +class JobProvisioningState(str, Enum, metaclass=CaseInsensitiveEnumMeta): + """The provisioning state of the workspace manager job.""" + + SUCCEEDED = "Succeeded" + """Succeeded.""" + IN_PROGRESS = "InProgress" + """InProgress.""" + CANCELED = "Canceled" + """Canceled.""" + FAILED = "Failed" + """Failed.""" + + class KillChainIntent(str, Enum, metaclass=CaseInsensitiveEnumMeta): """The intent of the alert.""" @@ -1252,6 +1265,15 @@ class MatchingMethod(str, Enum, metaclass=CaseInsensitiveEnumMeta): details match.""" +class MetadataDependencyOperator(str, Enum, metaclass=CaseInsensitiveEnumMeta): + """Operator used for list of dependencies in criteria array.""" + + AND = "AND" + """AND.""" + OR = "OR" + """OR.""" + + class MicrosoftSecurityProductName(str, Enum, metaclass=CaseInsensitiveEnumMeta): """The alerts' productName on which the cases will be generated.""" @@ -1459,6 +1481,15 @@ class ProvisioningState(str, Enum, metaclass=CaseInsensitiveEnumMeta): """Canceled.""" +class PullRequestState(str, Enum, metaclass=CaseInsensitiveEnumMeta): + """Status of the pull request.""" + + OPEN = "Open" + """Open.""" + CLOSED = "Closed" + """Closed.""" + + class RegistryHive(str, Enum, metaclass=CaseInsensitiveEnumMeta): """the hive that holds the registry key.""" @@ -1783,3 +1814,22 @@ class WarningCode(str, Enum, metaclass=CaseInsensitiveEnumMeta): """SourceControlWarning_DeleteRoleAssignment.""" SOURCE_CONTROL_DELETED_WITH_WARNINGS = "SourceControl_DeletedWithWarnings" """SourceControl_DeletedWithWarnings.""" + + +class WatchlistProvisioningState(str, Enum, metaclass=CaseInsensitiveEnumMeta): + """The provisioning state of the watchlist.""" + + NEW = "New" + """New.""" + IN_PROGRESS = "InProgress" + """InProgress.""" + UPLOADING = "Uploading" + """Uploading.""" + DELETING = "Deleting" + """Deleting.""" + SUCCEEDED = "Succeeded" + """Succeeded.""" + FAILED = "Failed" + """Failed.""" + CANCELED = "Canceled" + """Canceled.""" diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/_models.py b/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/_models.py index 7dcdf3bc52a7..d8d4c44c539b 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/_models.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/models/_models.py @@ -35,7 +35,7 @@ from .. import models as _models -class DataConnectorsCheckRequirements(_Model): +class DataConnectorsCheckRequirements(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Data connector requirements properties. You probably want to use the sub-classes and not this class directly. Known sub-classes are: @@ -88,7 +88,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class AADCheckRequirements(DataConnectorsCheckRequirements, discriminator="AzureActiveDirectory"): +class AADCheckRequirements( + DataConnectorsCheckRequirements, discriminator="AzureActiveDirectory" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents AADIP (Azure Active Directory Identity Protection) requirements check request. :ivar properties: AADIP (Azure Active Directory Identity Protection) requirements check @@ -143,7 +145,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class DataConnectorTenantId(_Model): +class DataConnectorTenantId(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Properties data connector on tenant level. :ivar tenant_id: The tenant id to connect to, and get the data from. Required. @@ -171,7 +173,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class AADCheckRequirementsProperties(DataConnectorTenantId): +class AADCheckRequirementsProperties( + DataConnectorTenantId +): # pylint: disable=docstring-keyword-should-match-keyword-only """AADIP (Azure Active Directory Identity Protection) requirements check properties. :ivar tenant_id: The tenant id to connect to, and get the data from. Required. @@ -241,7 +245,7 @@ class ProxyResource(Resource): """ -class DataConnector(ProxyResource): +class DataConnector(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """Data connector. You probably want to use the sub-classes and not this class directly. Known sub-classes are: @@ -315,7 +319,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class AADDataConnector(DataConnector, discriminator="AzureActiveDirectory"): +class AADDataConnector( + DataConnector, discriminator="AzureActiveDirectory" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents AADIP (Azure Active Directory Identity Protection) data connector. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -383,7 +389,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class AADDataConnectorProperties(_Model): +class AADDataConnectorProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """AADIP (Azure Active Directory Identity Protection) data connector properties. :ivar tenant_id: The tenant id to connect to, and get the data from. Required. @@ -418,7 +424,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class AATPCheckRequirements(DataConnectorsCheckRequirements, discriminator="AzureAdvancedThreatProtection"): +class AATPCheckRequirements( + DataConnectorsCheckRequirements, discriminator="AzureAdvancedThreatProtection" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents AATP (Azure Advanced Threat Protection) requirements check request. :ivar properties: AATP (Azure Advanced Threat Protection) requirements check properties. @@ -473,7 +481,9 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class AATPCheckRequirementsProperties(DataConnectorTenantId): +class AATPCheckRequirementsProperties( + DataConnectorTenantId +): # pylint: disable=docstring-keyword-should-match-keyword-only """AATP (Azure Advanced Threat Protection) requirements check properties. :ivar tenant_id: The tenant id to connect to, and get the data from. Required. @@ -498,7 +508,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class AATPDataConnector(DataConnector, discriminator="AzureAdvancedThreatProtection"): +class AATPDataConnector( + DataConnector, discriminator="AzureAdvancedThreatProtection" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents AATP (Azure Advanced Threat Protection) data connector. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -566,7 +578,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class AATPDataConnectorProperties(_Model): +class AATPDataConnectorProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """AATP (Azure Advanced Threat Protection) data connector properties. :ivar tenant_id: The tenant id to connect to, and get the data from. Required. @@ -601,7 +613,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class Entity(ProxyResource): +class Entity(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """Specific entity. You probably want to use the sub-classes and not this class directly. Known sub-classes are: @@ -659,7 +671,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class AccountEntity(Entity, discriminator="Account"): +class AccountEntity(Entity, discriminator="Account"): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents an account entity. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -827,7 +839,7 @@ class AccountEntityProperties(EntityCommonProperties): """The fully qualified domain DNS name.""" -class ActionPropertiesBase(_Model): +class ActionPropertiesBase(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Action property bag base. :ivar logic_app_resource_id: Logic App Resource Id, @@ -861,7 +873,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ResourceWithEtag(Resource): +class ResourceWithEtag(Resource): # pylint: disable=docstring-keyword-should-match-keyword-only """An azure resource object with an Etag property. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -900,7 +912,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ActionRequest(ResourceWithEtag): +class ActionRequest(ResourceWithEtag): # pylint: disable=docstring-keyword-should-match-keyword-only """Action for alert rule. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -964,7 +976,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class ActionRequestProperties(ActionPropertiesBase): +class ActionRequestProperties(ActionPropertiesBase): # pylint: disable=docstring-keyword-should-match-keyword-only """Action property bag. :ivar logic_app_resource_id: Logic App Resource Id, @@ -997,7 +1009,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ActionResponse(ProxyResource): +class ActionResponse(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """Action for alert rule. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -1063,7 +1075,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class ActionResponseProperties(ActionPropertiesBase): +class ActionResponseProperties(ActionPropertiesBase): # pylint: disable=docstring-keyword-should-match-keyword-only """Action property bag. :ivar logic_app_resource_id: Logic App Resource Id, @@ -1098,7 +1110,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class CustomEntityQuery(ResourceWithEtag): +class CustomEntityQuery(ResourceWithEtag): # pylint: disable=docstring-keyword-should-match-keyword-only """Specific entity query that supports put requests. You probably want to use the sub-classes and not this class directly. Known sub-classes are: @@ -1144,7 +1156,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ActivityCustomEntityQuery(CustomEntityQuery, discriminator="Activity"): +class ActivityCustomEntityQuery( + CustomEntityQuery, discriminator="Activity" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents Activity entity query. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -1224,7 +1238,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class ActivityEntityQueriesProperties(_Model): +class ActivityEntityQueriesProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes activity entity query properties. :ivar title: The entity query title. @@ -1324,7 +1338,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ActivityEntityQueriesPropertiesQueryDefinitions(_Model): # pylint: disable=name-too-long +class ActivityEntityQueriesPropertiesQueryDefinitions( + _Model +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """The Activity query definitions. :ivar query: The Activity query to run on a given entity. @@ -1352,7 +1368,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class EntityQuery(ProxyResource): +class EntityQuery(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """Specific entity query. You probably want to use the sub-classes and not this class directly. Known sub-classes are: @@ -1406,7 +1422,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ActivityEntityQuery(EntityQuery, discriminator="Activity"): +class ActivityEntityQuery( + EntityQuery, discriminator="Activity" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents Activity entity query. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -1486,7 +1504,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class EntityQueryTemplate(ProxyResource): +class EntityQueryTemplate(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """Specific entity query template. You probably want to use the sub-classes and not this class directly. Known sub-classes are: @@ -1531,7 +1549,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ActivityEntityQueryTemplate(EntityQueryTemplate, discriminator="Activity"): +class ActivityEntityQueryTemplate( + EntityQueryTemplate, discriminator="Activity" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents Activity entity query. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -1605,7 +1625,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class ActivityEntityQueryTemplateProperties(_Model): +class ActivityEntityQueryTemplateProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes activity entity query properties. :ivar title: The entity query title. @@ -1688,7 +1708,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ActivityEntityQueryTemplatePropertiesQueryDefinitions(_Model): # pylint: disable=name-too-long +class ActivityEntityQueryTemplatePropertiesQueryDefinitions( + _Model +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """The Activity query definitions. :ivar query: The Activity query to run on a given entity. @@ -1724,7 +1746,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class EntityTimelineItem(_Model): +class EntityTimelineItem(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Entity timeline Item. You probably want to use the sub-classes and not this class directly. Known sub-classes are: @@ -1758,7 +1780,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ActivityTimelineItem(EntityTimelineItem, discriminator="Activity"): +class ActivityTimelineItem( + EntityTimelineItem, discriminator="Activity" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents Activity timeline item. :ivar query_id: The activity query id. Required. @@ -1829,7 +1853,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: self.kind = EntityTimelineKind.ACTIVITY # type: ignore -class AddIncidentTaskActionProperties(_Model): +class AddIncidentTaskActionProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """AddIncidentTaskActionProperties. :ivar title: The title of the task. Required. @@ -1862,7 +1886,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class AlertDetailsOverride(_Model): +class AlertDetailsOverride(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Settings for how to dynamically override alert static details. :ivar alert_display_name_format: the format containing columns name(s) to override the alert @@ -1923,7 +1947,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class AlertPropertyMapping(_Model): +class AlertPropertyMapping(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """A single alert property mapping to override. :ivar alert_property: The V3 alert property. Known values are: "AlertLink", "ConfidenceLevel", @@ -1962,7 +1986,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class AlertRule(ProxyResource): +class AlertRule(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """Alert rule. You probably want to use the sub-classes and not this class directly. Known sub-classes are: @@ -2019,7 +2043,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class AlertRuleTemplate(ProxyResource): +class AlertRuleTemplate(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """Alert rule template. You probably want to use the sub-classes and not this class directly. Known sub-classes are: @@ -2072,7 +2096,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class AlertRuleTemplateDataSource(_Model): +class AlertRuleTemplateDataSource(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """alert rule template data sources. :ivar connector_id: The connector id that provides the following data types. @@ -2109,7 +2133,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class AlertRuleTemplatePropertiesBase(_Model): +class AlertRuleTemplatePropertiesBase(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Base alert rule template property bag. :ivar alert_rules_created_by_template_count: The number of alert rules that were created by @@ -2181,7 +2205,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class AlertRuleTemplateWithMitreProperties(AlertRuleTemplatePropertiesBase): +class AlertRuleTemplateWithMitreProperties( + AlertRuleTemplatePropertiesBase +): # pylint: disable=docstring-keyword-should-match-keyword-only """Alert rule template with MITRE property bag. :ivar alert_rules_created_by_template_count: The number of alert rules that were created by @@ -2238,7 +2264,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class AlertsDataTypeOfDataConnector(_Model): +class AlertsDataTypeOfDataConnector(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Alerts data type for data connectors. :ivar alerts: Alerts data type connection. Required. @@ -2268,7 +2294,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class AnalyticsRuleRunTrigger(_Model): +class AnalyticsRuleRunTrigger(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Analytics Rule Run Trigger request. :ivar properties: The analytics Rule Run Trigger request. Required. @@ -2318,7 +2344,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class AnalyticsRuleRunTriggerProperties(_Model): +class AnalyticsRuleRunTriggerProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The Analytics Rule Run Trigger properties. :ivar execution_time_utc: Required. @@ -2348,7 +2374,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class Settings(ProxyResource): +class Settings(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """The Setting. You probably want to use the sub-classes and not this class directly. Known sub-classes are: @@ -2402,7 +2428,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class Anomalies(Settings, discriminator="Anomalies"): +class Anomalies(Settings, discriminator="Anomalies"): # pylint: disable=docstring-keyword-should-match-keyword-only """Settings with single toggle. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -2481,7 +2507,7 @@ class AnomaliesSettingsProperties(_Model): """Determines whether the setting is enable or disabled.""" -class SecurityMLAnalyticsSetting(ProxyResource): +class SecurityMLAnalyticsSetting(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """Security ML Analytics Setting. You probably want to use the sub-classes and not this class directly. Known sub-classes are: @@ -2533,7 +2559,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class AnomalySecurityMLAnalyticsSettings(SecurityMLAnalyticsSetting, discriminator="Anomaly"): +class AnomalySecurityMLAnalyticsSettings( + SecurityMLAnalyticsSetting, discriminator="Anomaly" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents Anomaly Security ML Analytics Settings. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -2617,7 +2645,9 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class AnomalySecurityMLAnalyticsSettingsProperties(_Model): # pylint: disable=name-too-long +class AnomalySecurityMLAnalyticsSettingsProperties( + _Model +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """AnomalySecurityMLAnalytics settings base property bag. :ivar description: The description of the SecurityMLAnalyticsSettings. @@ -2733,7 +2763,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class AnomalyTimelineItem(EntityTimelineItem, discriminator="Anomaly"): +class AnomalyTimelineItem( + EntityTimelineItem, discriminator="Anomaly" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents anomaly timeline item. :ivar azure_resource_id: The anomaly azure resource id. Required. @@ -2826,7 +2858,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: self.kind = EntityTimelineKind.ANOMALY # type: ignore -class CcpAuthConfig(_Model): +class CcpAuthConfig(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Base Model for API authentication. You probably want to use the sub-classes and not this class directly. Known sub-classes are: @@ -2861,7 +2893,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ApiKeyAuthModel(CcpAuthConfig, discriminator="APIKey"): +class ApiKeyAuthModel( + CcpAuthConfig, discriminator="APIKey" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Model for authentication with the API Key. Will result in additional header on the request (default behavior) to the remote server: 'ApiKeyName: ApiKeyIdentifier ApiKey'. If 'IsApiKeyInPostPayload' is true it will send it in the body of the request and not the header. @@ -2915,7 +2949,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: self.type = CcpAuthType.API_KEY # type: ignore -class ApiPollingParameters(_Model): +class ApiPollingParameters(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents Codeless API Polling data connector. :ivar connector_ui_config: Config to describe the instructions blade. @@ -2954,7 +2988,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ASCCheckRequirements(DataConnectorsCheckRequirements, discriminator="AzureSecurityCenter"): +class ASCCheckRequirements( + DataConnectorsCheckRequirements, discriminator="AzureSecurityCenter" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents ASC (Azure Security Center) requirements check request. :ivar properties: ASC (Azure Security Center) requirements check properties. @@ -3008,7 +3044,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class ASCCheckRequirementsProperties(_Model): +class ASCCheckRequirementsProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """ASC (Azure Security Center) requirements check properties. :ivar subscription_id: The subscription id to connect to, and get the data from. @@ -3038,7 +3074,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ASCDataConnector(DataConnector, discriminator="AzureSecurityCenter"): +class ASCDataConnector( + DataConnector, discriminator="AzureSecurityCenter" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents ASC (Azure Security Center) data connector. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -3106,7 +3144,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class DataConnectorWithAlertsProperties(_Model): +class DataConnectorWithAlertsProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Data connector properties. :ivar data_types: The available data types for the connector. @@ -3136,7 +3174,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ASCDataConnectorProperties(DataConnectorWithAlertsProperties): +class ASCDataConnectorProperties( + DataConnectorWithAlertsProperties +): # pylint: disable=docstring-keyword-should-match-keyword-only """ASC (Azure Security Center) data connector properties. :ivar data_types: The available data types for the connector. @@ -3169,7 +3209,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class AssignmentItem(_Model): +class AssignmentItem(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """An entity describing a content item. :ivar resource_id: The resource id of the content item. @@ -3199,7 +3239,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class TIObject(Resource): +class TIObject(Resource): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a threat intelligence object in Azure Security Insights. You probably want to use the sub-classes and not this class directly. Known sub-classes are: @@ -3282,7 +3322,9 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class AttackPattern(TIObject, discriminator="AttackPattern"): +class AttackPattern( + TIObject, discriminator="AttackPattern" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents an attack pattern in Azure Security Insights. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -3354,7 +3396,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class AutomationRule(ProxyResource): +class AutomationRule(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """Concrete proxy resource types can be created by aliasing this type using a specific property type. @@ -3430,7 +3472,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class AutomationRuleAction(_Model): +class AutomationRuleAction(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes an automation rule action. You probably want to use the sub-classes and not this class directly. Known sub-classes are: @@ -3470,7 +3512,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class AutomationRuleAddIncidentTaskAction(AutomationRuleAction, discriminator="AddIncidentTask"): +class AutomationRuleAddIncidentTaskAction( + AutomationRuleAction, discriminator="AddIncidentTask" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes an automation rule action to add a task to an incident. :ivar order: Required. @@ -3509,7 +3553,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: self.action_type = ActionType.ADD_INCIDENT_TASK # type: ignore -class AutomationRuleBooleanCondition(_Model): +class AutomationRuleBooleanCondition(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """AutomationRuleBooleanCondition. :ivar operator: Known values are: "And" and "Or". @@ -3546,7 +3590,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class AutomationRuleCondition(_Model): +class AutomationRuleCondition(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes an automation rule condition. You probably want to use the sub-classes and not this class directly. Known sub-classes are: @@ -3583,7 +3627,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class AutomationRuleModifyPropertiesAction(AutomationRuleAction, discriminator="ModifyProperties"): +class AutomationRuleModifyPropertiesAction( + AutomationRuleAction, discriminator="ModifyProperties" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes an automation rule action to modify an object's properties. :ivar order: Required. @@ -3621,7 +3667,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: self.action_type = ActionType.MODIFY_PROPERTIES # type: ignore -class AutomationRuleProperties(_Model): +class AutomationRuleProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Automation rule properties. :ivar display_name: The display name of the automation rule. Required. @@ -3688,7 +3734,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class AutomationRulePropertyArrayChangedValuesCondition(_Model): # pylint: disable=name-too-long +class AutomationRulePropertyArrayChangedValuesCondition( + _Model +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """AutomationRulePropertyArrayChangedValuesCondition. :ivar array_type: Known values are: "Alerts", "Labels", "Tactics", and "Comments". @@ -3731,7 +3779,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class AutomationRulePropertyArrayValuesCondition(_Model): # pylint: disable=name-too-long +class AutomationRulePropertyArrayValuesCondition( + _Model +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """AutomationRulePropertyArrayValuesCondition. :ivar array_type: Known values are: "CustomDetails", "CustomDetailValues", and @@ -3779,7 +3829,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class AutomationRulePropertyValuesChangedCondition(_Model): # pylint: disable=name-too-long +class AutomationRulePropertyValuesChangedCondition( + _Model +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """AutomationRulePropertyValuesChangedCondition. :ivar property_name: Known values are: "IncidentSeverity", "IncidentStatus", and @@ -3837,7 +3889,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class AutomationRulePropertyValuesCondition(_Model): +class AutomationRulePropertyValuesCondition(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """AutomationRulePropertyValuesCondition. :ivar property_name: The property to evaluate in an automation rule property condition. Known @@ -3915,7 +3967,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class AutomationRuleRunPlaybookAction(AutomationRuleAction, discriminator="RunPlaybook"): +class AutomationRuleRunPlaybookAction( + AutomationRuleAction, discriminator="RunPlaybook" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes an automation rule action to run a playbook. :ivar order: Required. @@ -3953,7 +4007,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: self.action_type = ActionType.RUN_PLAYBOOK # type: ignore -class AutomationRuleTriggeringLogic(_Model): +class AutomationRuleTriggeringLogic(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes automation rule triggering logic. :ivar is_enabled: Determines whether the automation rule is enabled or disabled. Required. @@ -4012,7 +4066,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class Availability(_Model): +class Availability(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Connector Availability Status. :ivar status: The connector Availability Status. Default value is 1. @@ -4047,7 +4101,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class AWSAuthModel(CcpAuthConfig, discriminator="AWS"): +class AWSAuthModel(CcpAuthConfig, discriminator="AWS"): # pylint: disable=docstring-keyword-should-match-keyword-only """Model for API authentication with AWS. :ivar role_arn: AWS STS assume role ARN. Required. @@ -4119,7 +4173,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: self.kind = DataConnectorKind.AMAZON_WEB_SERVICES_CLOUD_TRAIL # type: ignore -class AwsCloudTrailDataConnector(DataConnector, discriminator="AmazonWebServicesCloudTrail"): +class AwsCloudTrailDataConnector( + DataConnector, discriminator="AmazonWebServicesCloudTrail" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents Amazon Web Services CloudTrail data connector. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -4187,7 +4243,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class AwsCloudTrailDataConnectorDataTypes(_Model): +class AwsCloudTrailDataConnectorDataTypes(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The available data types for Amazon Web Services CloudTrail data connector. :ivar logs: Logs data type. Required. @@ -4217,7 +4273,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class DataConnectorDataTypeCommon(_Model): +class DataConnectorDataTypeCommon(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Common field for data type in data connectors. :ivar state: Describe whether this data type connection is enabled or not. Required. Known @@ -4247,7 +4303,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class AwsCloudTrailDataConnectorDataTypesLogs(DataConnectorDataTypeCommon): +class AwsCloudTrailDataConnectorDataTypesLogs( + DataConnectorDataTypeCommon +): # pylint: disable=docstring-keyword-should-match-keyword-only """Logs data type. :ivar state: Describe whether this data type connection is enabled or not. Required. Known @@ -4273,7 +4331,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class AwsCloudTrailDataConnectorProperties(_Model): +class AwsCloudTrailDataConnectorProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Amazon Web Services CloudTrail data connector properties. :ivar aws_role_arn: The Aws Role Arn (with CloudTrailReadOnly policy) that is used to access @@ -4338,7 +4396,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: self.kind = DataConnectorKind.AMAZON_WEB_SERVICES_S3 # type: ignore -class AwsS3DataConnector(DataConnector, discriminator="AmazonWebServicesS3"): +class AwsS3DataConnector( + DataConnector, discriminator="AmazonWebServicesS3" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents Amazon Web Services S3 data connector. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -4406,7 +4466,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class AwsS3DataConnectorDataTypes(_Model): +class AwsS3DataConnectorDataTypes(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The available data types for Amazon Web Services S3 data connector. :ivar logs: Logs data type. Required. @@ -4436,7 +4496,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class AwsS3DataConnectorDataTypesLogs(DataConnectorDataTypeCommon): +class AwsS3DataConnectorDataTypesLogs( + DataConnectorDataTypeCommon +): # pylint: disable=docstring-keyword-should-match-keyword-only """Logs data type. :ivar state: Describe whether this data type connection is enabled or not. Required. Known @@ -4462,7 +4524,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class AwsS3DataConnectorProperties(_Model): +class AwsS3DataConnectorProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Amazon Web Services S3 data connector properties. :ivar destination_table: The logs destination table name in LogAnalytics. Required. @@ -4509,7 +4571,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class AzureDevOpsResourceInfo(_Model): +class AzureDevOpsResourceInfo(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Resources created in Azure DevOps repository. :ivar pipeline_id: Id of the pipeline created for the source-control. @@ -4546,7 +4608,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class AzureResourceEntity(Entity, discriminator="AzureResource"): +class AzureResourceEntity( + Entity, discriminator="AzureResource" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents an azure resource entity. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -4632,7 +4696,9 @@ class AzureResourceEntityProperties(EntityCommonProperties): """The subscription id of the resource.""" -class BasicAuthModel(CcpAuthConfig, discriminator="Basic"): +class BasicAuthModel( + CcpAuthConfig, discriminator="Basic" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Model for API authentication with basic flow - user name + password. :ivar user_name: The user name. Required. @@ -4670,7 +4736,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: self.type = CcpAuthType.BASIC # type: ignore -class BillingStatistic(ProxyResource): +class BillingStatistic(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """Billing statistic. You probably want to use the sub-classes and not this class directly. Known sub-classes are: @@ -4721,7 +4787,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class Bookmark(ProxyResource): +class Bookmark(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a bookmark in Azure Security Insights. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -4804,7 +4870,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class BookmarkEntityMappings(_Model): +class BookmarkEntityMappings(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes the entity mappings of a single entity. :ivar entity_type: The entity type. @@ -4841,7 +4907,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class BookmarkExpandParameters(_Model): +class BookmarkExpandParameters(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The parameters required to execute an expand operation on the given bookmark. :ivar end_time: The end date filter, so the only expansion results returned are before this @@ -4887,7 +4953,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class BookmarkExpandResponse(_Model): +class BookmarkExpandResponse(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The entity expansion result operation response. :ivar meta_data: The metadata from the expansion operation results. @@ -4924,7 +4990,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class BookmarkExpandResponseValue(_Model): +class BookmarkExpandResponseValue(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The expansion result values. :ivar entities: Array of the expansion result entities. @@ -4959,7 +5025,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class BookmarkProperties(_Model): +class BookmarkProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes bookmark properties. :ivar created: The time the bookmark was created. @@ -5084,7 +5150,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class BookmarkTimelineItem(EntityTimelineItem, discriminator="Bookmark"): +class BookmarkTimelineItem( + EntityTimelineItem, discriminator="Bookmark" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents bookmark timeline item. :ivar azure_resource_id: The bookmark azure resource id. Required. @@ -5164,7 +5232,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: self.kind = EntityTimelineKind.BOOKMARK # type: ignore -class BooleanConditionProperties(AutomationRuleCondition, discriminator="Boolean"): +class BooleanConditionProperties( + AutomationRuleCondition, discriminator="Boolean" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes an automation rule condition that applies a boolean operator (e.g AND, OR) to conditions. @@ -5200,7 +5270,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: self.condition_type = ConditionType.BOOLEAN # type: ignore -class CcpResponseConfig(_Model): +class CcpResponseConfig(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """A custom response configuration for a rule. :ivar events_json_paths: The json paths, '$' char is the json root. Required. @@ -5305,7 +5375,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ClientInfo(_Model): +class ClientInfo(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Information on the client (user or application) that made some action. :ivar email: The email of the client. @@ -5350,7 +5420,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class CloudApplicationEntity(Entity, discriminator="CloudApplication"): +class CloudApplicationEntity( + Entity, discriminator="CloudApplication" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a cloud application entity. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -5443,7 +5515,7 @@ class CloudApplicationEntityProperties(EntityCommonProperties): between several applications of the same type that a customer has.""" -class CloudError(_Model): +class CloudError(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Error response structure. :ivar error: Error data. @@ -5489,7 +5561,9 @@ class CloudErrorBody(_Model): """A message describing the error, intended to be suitable for display in a user interface.""" -class CodelessApiPollingDataConnector(DataConnector, discriminator="APIPolling"): +class CodelessApiPollingDataConnector( + DataConnector, discriminator="APIPolling" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents Codeless API Polling data connector. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -5557,7 +5631,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class CodelessConnectorPollingAuthProperties(_Model): +class CodelessConnectorPollingAuthProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Describe the authentication properties needed to successfully authenticate with the server. :ivar auth_type: The authentication type. Required. @@ -5669,7 +5743,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class CodelessConnectorPollingConfigProperties(_Model): +class CodelessConnectorPollingConfigProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Config to describe the polling config for API poller connector. :ivar is_active: The poller active status. @@ -5726,7 +5800,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class CodelessConnectorPollingPagingProperties(_Model): +class CodelessConnectorPollingPagingProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Describe the properties needed to make a pagination call. :ivar paging_type: Describes the type. could be 'None', 'PageToken', 'PageCount', 'TimeStamp'. @@ -5810,7 +5884,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class CodelessConnectorPollingRequestProperties(_Model): # pylint: disable=name-too-long +class CodelessConnectorPollingRequestProperties( + _Model +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """Describe the request properties needed to successfully pull from the server. :ivar api_endpoint: Describe the endpoint we should pull the data from. Required. @@ -5916,7 +5992,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class CodelessConnectorPollingResponseProperties(_Model): # pylint: disable=name-too-long +class CodelessConnectorPollingResponseProperties( + _Model +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """Describes the response from the external server. :ivar events_json_paths: Describes the path we should extract the data in the response. @@ -5970,7 +6048,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class CodelessParameters(_Model): +class CodelessParameters(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents Codeless UI data connector. :ivar connector_ui_config: Config to describe the instructions blade. @@ -6001,7 +6079,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class CodelessUiConnectorConfigProperties(_Model): +class CodelessUiConnectorConfigProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Config to describe the instructions blade. :ivar title: Connector blade title. Required. @@ -6108,7 +6186,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ConnectivityCriteria(_Model): +class ConnectivityCriteria(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Setting for the connector check connectivity. :ivar type: type of connectivity. "IsConnectedQuery" @@ -6145,7 +6223,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: class CodelessUiConnectorConfigPropertiesConnectivityCriteriaItem( ConnectivityCriteria -): # pylint: disable=name-too-long +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """CodelessUiConnectorConfigPropertiesConnectivityCriteriaItem. :ivar type: type of connectivity. "IsConnectedQuery" @@ -6173,7 +6251,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class LastDataReceivedDataType(_Model): +class LastDataReceivedDataType(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Data type for last data received. :ivar name: Name of the data type to show in the graph. can be use with @@ -6210,7 +6288,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class CodelessUiConnectorConfigPropertiesDataTypesItem(LastDataReceivedDataType): # pylint: disable=name-too-long +class CodelessUiConnectorConfigPropertiesDataTypesItem( + LastDataReceivedDataType +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """CodelessUiConnectorConfigPropertiesDataTypesItem. :ivar name: Name of the data type to show in the graph. can be use with @@ -6239,7 +6319,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class GraphQueries(_Model): +class GraphQueries(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The graph query to show the current data status. :ivar metric_name: the metric that the query is checking. @@ -6279,7 +6359,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class CodelessUiConnectorConfigPropertiesGraphQueriesItem(GraphQueries): # pylint: disable=name-too-long +class CodelessUiConnectorConfigPropertiesGraphQueriesItem( + GraphQueries +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """CodelessUiConnectorConfigPropertiesGraphQueriesItem. :ivar metric_name: the metric that the query is checking. @@ -6310,7 +6392,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class InstructionSteps(_Model): +class InstructionSteps(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Instruction steps to enable the connector. :ivar title: Instruction step title. @@ -6351,7 +6433,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class CodelessUiConnectorConfigPropertiesInstructionStepsItem(InstructionSteps): # pylint: disable=name-too-long +class CodelessUiConnectorConfigPropertiesInstructionStepsItem( + InstructionSteps +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """CodelessUiConnectorConfigPropertiesInstructionStepsItem. :ivar title: Instruction step title. @@ -6383,7 +6467,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class SampleQueries(_Model): +class SampleQueries(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The sample queries for the connector. :ivar description: The sample query description. @@ -6416,7 +6500,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class CodelessUiConnectorConfigPropertiesSampleQueriesItem(SampleQueries): # pylint: disable=name-too-long +class CodelessUiConnectorConfigPropertiesSampleQueriesItem( + SampleQueries +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """CodelessUiConnectorConfigPropertiesSampleQueriesItem. :ivar description: The sample query description. @@ -6444,7 +6530,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class CodelessUiDataConnector(DataConnector, discriminator="GenericUI"): +class CodelessUiDataConnector( + DataConnector, discriminator="GenericUI" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents Codeless UI data connector. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -6512,7 +6600,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class ConditionClause(_Model): +class ConditionClause(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a single clause to be evaluated by a NormalizedCondition. :ivar clause_connective: The connective used to join all values in this ConditionClause. Known @@ -6572,7 +6660,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ConditionProperties(_Model): +class ConditionProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a condition used to query for TI objects. :ivar stix_object_type: The STIX type for the objects returned by this query. @@ -6613,7 +6701,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ConnectedEntity(_Model): +class ConnectedEntity(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Expansion result connected entities. :ivar target_entity_id: Entity Id of the connected entity. @@ -6650,7 +6738,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ConnectivityCriterion(_Model): +class ConnectivityCriterion(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The criteria by which we determine whether the connector is connected or not. For Example, use a KQL query to check if the expected data type is flowing). @@ -6684,7 +6772,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ConnectorDataType(_Model): +class ConnectorDataType(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The data type which is created by the connector, including a query indicated when was the last time that data type was received in the workspace. @@ -6722,7 +6810,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ConnectorDefinitionsAvailability(_Model): +class ConnectorDefinitionsAvailability(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The exposure status of the connector to the customers. :ivar status: The exposure status of the connector to the customers. Available values are 0-4 @@ -6759,7 +6847,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ConnectorDefinitionsPermissions(_Model): +class ConnectorDefinitionsPermissions(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The required Permissions for the connector. :ivar tenant: Gets or sets the required tenant permissions for the connector. @@ -6809,7 +6897,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ConnectorDefinitionsResourceProvider(_Model): +class ConnectorDefinitionsResourceProvider(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The resource provider details include the required permissions for the user to create connections. The user should have the required permissions(Read\\Write, ..) in the specified scope ProviderPermissionsScope against the specified resource provider. @@ -6876,7 +6964,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ConnectorInstructionModelBase(_Model): +class ConnectorInstructionModelBase(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Instruction step details. :ivar parameters: The parameters for the setting. @@ -6911,7 +6999,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class CountQuery(_Model): +class CountQuery(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a query to run on the TI objects in the workspace. :ivar properties: Query properties. @@ -6961,7 +7049,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class CustomizableConnectionsConfig(_Model): +class CustomizableConnectionsConfig(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The UiConfig for 'Customizable' connector definition kind. :ivar template_spec_name: Gets or sets the template name. The template includes ARM templates @@ -7001,7 +7089,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class DataConnectorDefinition(ProxyResource): +class DataConnectorDefinition(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """An Azure resource, which encapsulate the entire info requires to display a data connector page in Azure portal, and the info required to define data connections. @@ -7054,7 +7142,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class CustomizableConnectorDefinition(DataConnectorDefinition, discriminator="Customizable"): +class CustomizableConnectorDefinition( + DataConnectorDefinition, discriminator="Customizable" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Connector definition for kind 'Customizable'. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -7123,7 +7213,9 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class CustomizableConnectorDefinitionProperties(_Model): # pylint: disable=name-too-long +class CustomizableConnectorDefinitionProperties( + _Model +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """The UiConfig for 'Customizable' connector definition kind. :ivar created_time_utc: Gets or sets the connector definition created date in UTC format. @@ -7175,7 +7267,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class CustomizableConnectorUiConfig(_Model): +class CustomizableConnectorUiConfig(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The UiConfig for 'Customizable' connector definition kind. :ivar id: Gets or sets custom connector id. optional field. @@ -7281,7 +7373,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class CustomPermissionDetails(_Model): +class CustomPermissionDetails(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The Custom permissions required for the connector. :ivar name: Gets or sets the custom permissions name. Required. @@ -7314,7 +7406,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class CustomsPermission(_Model): +class CustomsPermission(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Customs permissions required for the connector. :ivar name: Customs permissions name. @@ -7347,7 +7439,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class Customs(CustomsPermission): +class Customs(CustomsPermission): # pylint: disable=docstring-keyword-should-match-keyword-only """Customs permissions required for the connector. :ivar name: Customs permissions name. @@ -7375,7 +7467,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class DataConnectorConnectBody(_Model): +class DataConnectorConnectBody(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents Codeless API Polling data connector. :ivar kind: The authentication kind used to poll the data. Known values are: "Basic", "OAuth2", @@ -7473,7 +7565,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class DataConnectorRequirementsState(_Model): +class DataConnectorRequirementsState(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Data connector requirements status. :ivar authorization_state: Authorization state for this connector. Known values are: "Valid" @@ -7513,7 +7605,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class DataTypeDefinitions(_Model): +class DataTypeDefinitions(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The data type definition. :ivar data_type: The data type name. @@ -7541,7 +7633,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class DCRConfiguration(_Model): +class DCRConfiguration(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The configuration of the destination of the data. :ivar data_collection_endpoint: Represents the data collection ingestion endpoint in log @@ -7586,7 +7678,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class Deployment(_Model): +class Deployment(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Description about a deployment. :ivar deployment_id: Deployment identifier. @@ -7647,7 +7739,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class DeploymentInfo(_Model): +class DeploymentInfo(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Information regarding a deployment. :ivar deployment_fetch_status: Status while fetching the last deployment. Known values are: @@ -7690,7 +7782,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class DnsEntity(Entity, discriminator="DnsResolution"): +class DnsEntity(Entity, discriminator="DnsResolution"): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a dns entity. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -7791,7 +7883,9 @@ class DnsEntityProperties(EntityCommonProperties): """Ip entity identifiers for the resolved ip address.""" -class Dynamics365CheckRequirements(DataConnectorsCheckRequirements, discriminator="Dynamics365"): +class Dynamics365CheckRequirements( + DataConnectorsCheckRequirements, discriminator="Dynamics365" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents Dynamics365 requirements check request. :ivar properties: Dynamics365 requirements check properties. @@ -7845,7 +7939,9 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class Dynamics365CheckRequirementsProperties(DataConnectorTenantId): +class Dynamics365CheckRequirementsProperties( + DataConnectorTenantId +): # pylint: disable=docstring-keyword-should-match-keyword-only """Dynamics365 requirements check properties. :ivar tenant_id: The tenant id to connect to, and get the data from. Required. @@ -7870,7 +7966,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class Dynamics365DataConnector(DataConnector, discriminator="Dynamics365"): +class Dynamics365DataConnector( + DataConnector, discriminator="Dynamics365" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents Dynamics365 data connector. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -7938,7 +8036,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class Dynamics365DataConnectorDataTypes(_Model): +class Dynamics365DataConnectorDataTypes(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The available data types for Dynamics365 data connector. :ivar dynamics365_cds_activities: Common Data Service data type connection. Required. @@ -7971,7 +8069,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: class Dynamics365DataConnectorDataTypesDynamics365CdsActivities( DataConnectorDataTypeCommon -): # pylint: disable=name-too-long +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """Common Data Service data type connection. :ivar state: Describe whether this data type connection is enabled or not. Required. Known @@ -7997,7 +8095,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class Dynamics365DataConnectorProperties(DataConnectorTenantId): +class Dynamics365DataConnectorProperties( + DataConnectorTenantId +): # pylint: disable=docstring-keyword-should-match-keyword-only """Dynamics365 data connector properties. :ivar tenant_id: The tenant id to connect to, and get the data from. Required. @@ -8030,7 +8130,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class EnrichmentDomainBody(_Model): +class EnrichmentDomainBody(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Domain name to be enriched. :ivar domain: The domain name. @@ -8058,7 +8158,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class EnrichmentDomainWhois(_Model): +class EnrichmentDomainWhois(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Whois information for a given domain and associated metadata. :ivar domain: The domain for this whois record. @@ -8119,7 +8219,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class EnrichmentDomainWhoisContact(_Model): +class EnrichmentDomainWhoisContact(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """An individual contact associated with this domain. :ivar name: The name of this contact. @@ -8192,7 +8292,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class EnrichmentDomainWhoisContacts(_Model): +class EnrichmentDomainWhoisContacts(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The set of contacts associated with this domain. :ivar admin: The admin contact for this whois record. @@ -8243,7 +8343,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class EnrichmentDomainWhoisDetails(_Model): +class EnrichmentDomainWhoisDetails(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The whois record for a given domain. :ivar registrar: The registrar associated with this domain. @@ -8292,7 +8392,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class EnrichmentDomainWhoisRegistrarDetails(_Model): +class EnrichmentDomainWhoisRegistrarDetails(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The registrar associated with this domain. :ivar name: The name of this registrar. @@ -8351,7 +8451,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class EnrichmentIpAddressBody(_Model): +class EnrichmentIpAddressBody(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """IP address (v4 or v6) to be enriched. :ivar ip_address: The dotted-decimal or colon-separated string representation of the IP @@ -8380,7 +8480,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class EnrichmentIpGeodata(_Model): +class EnrichmentIpGeodata(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Geodata information for a given IP address. :ivar asn: The autonomous system number associated with this IP address. @@ -8504,7 +8604,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class EntityAnalytics(Settings, discriminator="EntityAnalytics"): +class EntityAnalytics( + Settings, discriminator="EntityAnalytics" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Settings with single toggle. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -8572,7 +8674,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class EntityAnalyticsProperties(_Model): +class EntityAnalyticsProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """EntityAnalytics property bag. :ivar entity_providers: The relevant entity providers that are synced. @@ -8602,7 +8704,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class EntityEdges(_Model): +class EntityEdges(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The edge that connects the entity to the other entity. :ivar target_entity_id: The target entity Id. @@ -8640,7 +8742,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class EntityExpandParameters(_Model): +class EntityExpandParameters(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The parameters required to execute an expand operation on the given entity. :ivar end_time: The end date filter, so the only expansion results returned are before this @@ -8686,7 +8788,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class EntityExpandResponse(_Model): +class EntityExpandResponse(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The entity expansion result operation response. :ivar meta_data: The metadata from the expansion operation results. @@ -8723,7 +8825,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class EntityExpandResponseValue(_Model): +class EntityExpandResponseValue(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The expansion result values. :ivar entities: Array of the expansion result entities. @@ -8758,7 +8860,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class EntityFieldMapping(_Model): +class EntityFieldMapping(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Map identifiers of a single entity. :ivar identifier: Alert V3 identifier. @@ -8791,7 +8893,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class EntityGetInsightsParameters(_Model): +class EntityGetInsightsParameters(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The parameters required to execute insights operation on the given entity. :ivar start_time: The start timeline date, so the results returned are after this date. @@ -8846,7 +8948,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class EntityGetInsightsResponse(_Model): +class EntityGetInsightsResponse(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The Get Insights result operation response. :ivar meta_data: The metadata from the get insights operation results. @@ -8883,7 +8985,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class EntityInsightItem(_Model): +class EntityInsightItem(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Entity insight Item. :ivar query_id: The query id of the insight. @@ -8933,7 +9035,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class EntityInsightItemQueryTimeInterval(_Model): +class EntityInsightItemQueryTimeInterval(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The Time interval that the query actually executed on. :ivar start_time: Insight query start time. @@ -8970,7 +9072,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class EntityManualTriggerRequestBody(_Model): +class EntityManualTriggerRequestBody(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes the request body for triggering a playbook on an entity. :ivar incident_arm_id: Incident ARM id. @@ -9012,7 +9114,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class EntityMapping(_Model): +class EntityMapping(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Single entity mapping for the alert rule. :ivar entity_type: The V3 type of the mapped entity. Known values are: "Account", "Host", "IP", @@ -9055,7 +9157,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class EntityQueryItem(_Model): +class EntityQueryItem(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """An abstract Query item for entity. You probably want to use the sub-classes and not this class directly. Known sub-classes are: @@ -9103,7 +9205,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class EntityQueryItemProperties(_Model): +class EntityQueryItemProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """An properties abstract Query item for entity. :ivar data_types: Data types for template. @@ -9162,7 +9264,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class EntityQueryItemPropertiesDataTypesItem(_Model): +class EntityQueryItemPropertiesDataTypesItem(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """EntityQueryItemPropertiesDataTypesItem. :ivar data_type: Data type name. @@ -9190,7 +9292,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class EntityTimelineParameters(_Model): +class EntityTimelineParameters(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The parameters required to execute s timeline operation on the given entity. :ivar kinds: Array of timeline Item kinds. @@ -9242,7 +9344,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class EntityTimelineResponse(_Model): +class EntityTimelineResponse(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The entity timeline result operation response. :ivar meta_data: The metadata from the timeline operation results. @@ -9279,7 +9381,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class Error(_Model): +class Error(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The error description for why a publication failed. :ivar member_resource_name: The member resource name for which the publication error occured. @@ -9359,7 +9461,7 @@ class ErrorDetail(_Model): """The error additional info.""" -class ErrorResponse(_Model): +class ErrorResponse(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Error response. :ivar error: The error object. @@ -9387,7 +9489,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class EventGroupingSettings(_Model): +class EventGroupingSettings(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Event grouping settings property bag. :ivar aggregation_kind: The event grouping aggregation kinds. Known values are: "SingleAlert" @@ -9419,7 +9521,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ExpansionEntityQueriesProperties(_Model): +class ExpansionEntityQueriesProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes expansion entity query properties. :ivar data_sources: List of the data sources that are required to run the query. @@ -9492,7 +9594,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ExpansionEntityQuery(EntityQuery, discriminator="Expansion"): +class ExpansionEntityQuery( + EntityQuery, discriminator="Expansion" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents Expansion entity query. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -9567,7 +9671,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class ExpansionResultAggregation(_Model): +class ExpansionResultAggregation(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Information of a specific aggregation in the expansion result. :ivar aggregation_type: The common type of the aggregation. (for e.g. entity field name). @@ -9626,7 +9730,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ExpansionResultsMetadata(_Model): +class ExpansionResultsMetadata(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Expansion result metadata. :ivar aggregations: Information of the aggregated nodes in the expansion result. @@ -9656,7 +9760,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class EyesOn(Settings, discriminator="EyesOn"): +class EyesOn(Settings, discriminator="EyesOn"): # pylint: disable=docstring-keyword-should-match-keyword-only """Settings with single toggle. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -9735,7 +9839,7 @@ class EyesOnSettingsProperties(_Model): """Determines whether the setting is enable or disabled.""" -class FieldMapping(_Model): +class FieldMapping(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """A single field mapping of the mapped entity. :ivar identifier: the V3 identifier of the entity. @@ -9770,7 +9874,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class FileEntity(Entity, discriminator="File"): +class FileEntity(Entity, discriminator="File"): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a file entity. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -9871,7 +9975,7 @@ class FileEntityProperties(EntityCommonProperties): """The Host entity id which the file belongs to.""" -class FileHashEntity(Entity, discriminator="FileHash"): +class FileHashEntity(Entity, discriminator="FileHash"): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a file hash entity. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -9959,7 +10063,7 @@ class FileHashEntityProperties(EntityCommonProperties): """The file hash value.""" -class FileImport(ProxyResource): +class FileImport(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a file import in Azure Security Insights. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -10034,7 +10138,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class FileImportProperties(_Model): +class FileImportProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes the FileImport's properties. :ivar ingestion_mode: Describes how to ingest the records in the file. Required. Known values @@ -10135,7 +10239,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class FileMetadata(_Model): +class FileMetadata(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a file. :ivar file_format: The format of the file. Known values are: "CSV", "JSON", and "Unspecified". @@ -10185,7 +10289,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class FusionAlertRule(AlertRule, discriminator="Fusion"): +class FusionAlertRule(AlertRule, discriminator="Fusion"): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents Fusion alert rule. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -10265,7 +10369,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class FusionAlertRuleProperties(_Model): +class FusionAlertRuleProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Fusion alert rule base property bag. :ivar alert_rule_template_name: The Name of the alert rule template used to create this rule. @@ -10348,7 +10452,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class FusionAlertRuleTemplate(AlertRuleTemplate, discriminator="Fusion"): +class FusionAlertRuleTemplate( + AlertRuleTemplate, discriminator="Fusion" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents Fusion alert rule template. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -10426,7 +10532,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class FusionAlertRuleTemplateProperties(_Model): +class FusionAlertRuleTemplateProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Fusion alert rule template properties. :ivar alert_rules_created_by_template_count: The number of alert rules that were created by @@ -10533,7 +10639,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class FusionScenarioExclusionPattern(_Model): +class FusionScenarioExclusionPattern(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a Fusion scenario exclusion patterns in Fusion detection. :ivar exclusion_pattern: Scenario exclusion pattern. Required. @@ -10570,7 +10676,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class FusionSourceSettings(_Model): +class FusionSourceSettings(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a supported source signal configuration in Fusion detection. :ivar enabled: Determines whether this source signal is enabled or disabled in Fusion @@ -10614,7 +10720,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class FusionSourceSubTypeSetting(_Model): +class FusionSourceSubTypeSetting(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a supported source subtype configuration under a source signal in Fusion detection. :ivar enabled: Determines whether this source subtype under source signal is enabled or @@ -10666,7 +10772,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class FusionSubTypeSeverityFilter(_Model): +class FusionSubTypeSeverityFilter(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents severity configuration for a source subtype consumed in Fusion detection. :ivar is_supported: Determines whether this source subtype supports severity configuration or @@ -10703,7 +10809,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class FusionSubTypeSeverityFiltersItem(_Model): +class FusionSubTypeSeverityFiltersItem(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a Severity filter setting for a given source subtype consumed in Fusion detection. :ivar severity: The Severity for a given source subtype consumed in Fusion detection. Required. @@ -10742,7 +10848,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class FusionTemplateSourceSetting(_Model): +class FusionTemplateSourceSetting(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a source signal consumed in Fusion detection. :ivar source_name: The name of a source signal consumed in Fusion detection. Required. @@ -10778,7 +10884,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class FusionTemplateSourceSubType(_Model): +class FusionTemplateSourceSubType(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a source subtype under a source signal consumed in Fusion detection. :ivar source_sub_type_name: The name of source subtype under a source signal consumed in Fusion @@ -10823,7 +10929,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class FusionTemplateSubTypeSeverityFilter(_Model): +class FusionTemplateSubTypeSeverityFilter(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents severity configurations available for a source subtype consumed in Fusion detection. :ivar is_supported: Determines whether severity configuration is supported for this source @@ -10861,7 +10967,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class GCPAuthModel(CcpAuthConfig, discriminator="GCP"): +class GCPAuthModel(CcpAuthConfig, discriminator="GCP"): # pylint: disable=docstring-keyword-should-match-keyword-only """Model for API authentication for all GCP kind connectors. :ivar service_account_email: GCP Service Account Email. Required. @@ -10908,7 +11014,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: self.type = CcpAuthType.GCP # type: ignore -class GCPAuthProperties(_Model): +class GCPAuthProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Google Cloud Platform auth section properties. :ivar service_account_email: The service account that is used to access the GCP project. @@ -10952,7 +11058,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class GCPDataConnector(DataConnector, discriminator="GCP"): +class GCPDataConnector( + DataConnector, discriminator="GCP" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents Google Cloud Platform data connector. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -11020,7 +11128,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class GCPDataConnectorProperties(_Model): +class GCPDataConnectorProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Google Cloud Platform data connector properties. :ivar connector_definition_name: The name of the connector definition that represents the UI @@ -11068,7 +11176,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class GCPRequestProperties(_Model): +class GCPRequestProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Google Cloud Platform request section properties. :ivar project_id: The GCP project id. Required. @@ -11103,7 +11211,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class GenericBlobSbsAuthModel(CcpAuthConfig, discriminator="ServiceBus"): +class GenericBlobSbsAuthModel( + CcpAuthConfig, discriminator="ServiceBus" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Model for API authentication for working with service bus or storage account. :ivar credentials_config: Credentials for service bus namespace, keyvault uri for access key. @@ -11186,7 +11296,7 @@ class GeoLocation(_Model): """State name.""" -class GetInsightsErrorKind(_Model): +class GetInsightsErrorKind(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """GetInsights Query Errors. :ivar kind: the query kind. Required. "Insight" @@ -11226,7 +11336,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class GetInsightsResultsMetadata(_Model): +class GetInsightsResultsMetadata(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Get Insights result metadata. :ivar total_count: the total items found for the insights request. Required. @@ -11261,7 +11371,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class GitHubAuthModel(CcpAuthConfig, discriminator="GitHub"): +class GitHubAuthModel( + CcpAuthConfig, discriminator="GitHub" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Model for API authentication for GitHub. For this authentication first we need to approve the Router app (Microsoft Security DevOps) to access the GitHub account, Then we only need the InstallationId to get the access token from @@ -11300,7 +11412,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: self.type = CcpAuthType.GIT_HUB # type: ignore -class GitHubResourceInfo(_Model): +class GitHubResourceInfo(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Resources created in GitHub repository. :ivar app_installation_id: GitHub application installation id. @@ -11330,7 +11442,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class GraphQuery(_Model): +class GraphQuery(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The graph query to show the volume of data arriving into the workspace over time. :ivar metric_name: Gets or sets the metric name that the query is checking. For example: 'Total @@ -11372,7 +11484,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class GroupingConfiguration(_Model): +class GroupingConfiguration(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Grouping configuration property bag. :ivar enabled: Grouping enabled. Required. @@ -11453,7 +11565,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class HostEntity(Entity, discriminator="Host"): +class HostEntity(Entity, discriminator="Host"): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a host entity. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -11530,7 +11642,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class HostEntityProperties(EntityCommonProperties): +class HostEntityProperties(EntityCommonProperties): # pylint: disable=docstring-keyword-should-match-keyword-only """Host entity property bag. :ivar additional_data: A bag of custom fields that should be part of the entity and will be @@ -11605,7 +11717,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class Hunt(ProxyResource): +class Hunt(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a Hunt in Azure Security Insights. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -11680,7 +11792,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class HuntComment(ProxyResource): +class HuntComment(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a Hunt Comment in Azure Security Insights. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -11746,7 +11858,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class HuntCommentProperties(_Model): +class HuntCommentProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes a hunt comment properties. :ivar message: The message for the comment. Required. @@ -11774,7 +11886,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class HuntingBookmark(Entity, discriminator="Bookmark"): +class HuntingBookmark(Entity, discriminator="Bookmark"): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a Hunting bookmark entity. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -11853,7 +11965,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class HuntingBookmarkProperties(EntityCommonProperties): +class HuntingBookmarkProperties(EntityCommonProperties): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes bookmark properties. :ivar additional_data: A bag of custom fields that should be part of the entity and will be @@ -11951,7 +12063,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class HuntOwner(_Model): +class HuntOwner(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes a user that the hunt is assigned to. :ivar email: The email of the user the hunt is assigned to. @@ -12007,7 +12119,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class HuntProperties(_Model): +class HuntProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes hunt properties. :ivar display_name: The display name of the hunt. Required. @@ -12082,7 +12194,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class HuntRelation(ProxyResource): +class HuntRelation(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a Hunt Relation in Azure Security Insights. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -12149,7 +12261,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class HuntRelationProperties(_Model): +class HuntRelationProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes hunt relation properties. :ivar related_resource_id: The id of the related resource. Required. @@ -12196,7 +12308,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class Identity(TIObject, discriminator="Identity"): +class Identity(TIObject, discriminator="Identity"): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents an identity in Azure Security Insights. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -12268,7 +12380,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class Incident(ProxyResource): +class Incident(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents an incident in Azure Security Insights. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -12400,7 +12512,7 @@ class IncidentAdditionalData(_Model): """The URL to the incident that the current incident was merged into.""" -class IncidentAlertList(_Model): +class IncidentAlertList(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """List of incident alerts. :ivar value: Array of incident alerts. Required. @@ -12428,7 +12540,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class IncidentBookmarkList(_Model): +class IncidentBookmarkList(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """List of incident bookmarks. :ivar value: Array of incident bookmarks. Required. @@ -12456,7 +12568,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class IncidentComment(ProxyResource): +class IncidentComment(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents an incident comment. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -12522,7 +12634,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class IncidentCommentProperties(_Model): +class IncidentCommentProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Incident comment property bag. :ivar message: The comment message. Required. @@ -12566,7 +12678,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class IncidentConfiguration(_Model): +class IncidentConfiguration(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Incident Configuration property bag. :ivar create_incident: Create incidents from alerts triggered by this analytics rule. Required. @@ -12604,7 +12716,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class IncidentEntitiesResponse(_Model): +class IncidentEntitiesResponse(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The incident related entities response. :ivar entities: Array of the incident related entities. @@ -12639,7 +12751,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class IncidentEntitiesResultsMetadata(_Model): +class IncidentEntitiesResultsMetadata(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Information of a specific aggregation in the incident related entities result. :ivar entity_kind: The kind of the aggregated entity. Required. Known values are: "Account", @@ -12684,7 +12796,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class IncidentInfo(_Model): +class IncidentInfo(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes related incident information for the bookmark. :ivar incident_id: Incident Id. @@ -12735,7 +12847,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class IncidentLabel(_Model): +class IncidentLabel(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents an incident label. :ivar label_name: The name of the label. Required. @@ -12767,7 +12879,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class IncidentOwnerInfo(_Model): +class IncidentOwnerInfo(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Information on the user an incident is assigned to. :ivar email: The email of the user the incident is assigned to. @@ -12823,7 +12935,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class IncidentProperties(_Model): +class IncidentProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes incident properties. :ivar title: The title of the incident. Required. @@ -12973,7 +13085,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class IncidentPropertiesAction(_Model): +class IncidentPropertiesAction(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """IncidentPropertiesAction. :ivar severity: The severity of the incident. Known values are: "High", "Medium", "Low", and @@ -13054,7 +13166,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class IncidentTask(ProxyResource): +class IncidentTask(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes incident task properties. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -13128,7 +13240,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class IncidentTaskProperties(_Model): +class IncidentTaskProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes the properties of an incident task. :ivar title: The title of the task. Required. @@ -13194,7 +13306,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class Indicator(TIObject, discriminator="Indicator"): +class Indicator(TIObject, discriminator="Indicator"): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents an indicator in Azure Security Insights. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -13273,7 +13385,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class IndicatorObservablesItem(_Model): +class IndicatorObservablesItem(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """An observable of this indicator. :ivar type: The type of the observable of this indicator. @@ -13306,7 +13418,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class InsightQueryItem(EntityQueryItem, discriminator="Insight"): +class InsightQueryItem( + EntityQueryItem, discriminator="Insight" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents Insight Query. :ivar id: Query Template ARM ID. @@ -13349,7 +13463,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: self.kind = EntityQueryKind.INSIGHT # type: ignore -class InsightQueryItemProperties(EntityQueryItemProperties): +class InsightQueryItemProperties( + EntityQueryItemProperties +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents Insight Query. :ivar data_types: Data types for template. @@ -13443,7 +13559,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class InsightQueryItemPropertiesAdditionalQuery(_Model): # pylint: disable=name-too-long +class InsightQueryItemPropertiesAdditionalQuery( + _Model +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """The activity query definitions. :ivar query: The insight query. @@ -13476,7 +13594,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class InsightQueryItemPropertiesDefaultTimeRange(_Model): # pylint: disable=name-too-long +class InsightQueryItemPropertiesDefaultTimeRange( + _Model +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """The insight chart query. :ivar before_range: The padding for the start time of the query. @@ -13513,7 +13633,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class InsightQueryItemPropertiesReferenceTimeRange(_Model): # pylint: disable=name-too-long +class InsightQueryItemPropertiesReferenceTimeRange( + _Model +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """The insight chart query. :ivar before_range: Additional query time for looking back. @@ -13543,7 +13665,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class InsightQueryItemPropertiesTableQuery(_Model): +class InsightQueryItemPropertiesTableQuery(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The insight table query. :ivar columns_definitions: List of insight column definitions. @@ -13586,7 +13708,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class InsightQueryItemPropertiesTableQueryColumnsDefinitionsItem(_Model): # pylint: disable=name-too-long +class InsightQueryItemPropertiesTableQueryColumnsDefinitionsItem( + _Model +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """InsightQueryItemPropertiesTableQueryColumnsDefinitionsItem. :ivar header: Insight column header. @@ -13629,7 +13753,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class InsightQueryItemPropertiesTableQueryQueriesDefinitionsItem(_Model): # pylint: disable=name-too-long +class InsightQueryItemPropertiesTableQueryQueriesDefinitionsItem( + _Model +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """InsightQueryItemPropertiesTableQueryQueriesDefinitionsItem. :ivar filter: Insight column header. @@ -13679,7 +13805,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: class InsightQueryItemPropertiesTableQueryQueriesDefinitionsPropertiesItemsItem( _Model -): # pylint: disable=name-too-long +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """InsightQueryItemPropertiesTableQueryQueriesDefinitionsPropertiesItemsItem. :ivar projected_name: Insight Link Definition Projected Name. @@ -13714,7 +13840,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class InsightsTableResult(_Model): +class InsightsTableResult(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Query results for table insights query. :ivar columns: Columns Metadata of the table. @@ -13749,7 +13875,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class InsightsTableResultColumnsItem(_Model): +class InsightsTableResultColumnsItem(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """InsightsTableResultColumnsItem. :ivar type: the type of the column. @@ -13782,7 +13908,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class InstructionStep(_Model): +class InstructionStep(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Instruction steps to enable the connector. :ivar title: Gets or sets the instruction step title. @@ -13831,7 +13957,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class InstructionStepDetails(_Model): +class InstructionStepDetails(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Instruction step details, to be displayed in the Instructions steps section in the connector's page in Sentinel Portal. @@ -13865,7 +13991,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class InstructionStepsInstructionsItem(ConnectorInstructionModelBase): +class InstructionStepsInstructionsItem( + ConnectorInstructionModelBase +): # pylint: disable=docstring-keyword-should-match-keyword-only """InstructionStepsInstructionsItem. :ivar parameters: The parameters for the setting. @@ -13894,7 +14022,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class IoTCheckRequirements(DataConnectorsCheckRequirements, discriminator="IOT"): +class IoTCheckRequirements( + DataConnectorsCheckRequirements, discriminator="IOT" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents IoT requirements check request. :ivar properties: IoT requirements check properties. @@ -13948,7 +14078,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class IoTCheckRequirementsProperties(_Model): +class IoTCheckRequirementsProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """IoT requirements check properties. :ivar subscription_id: The subscription id to connect to, and get the data from. @@ -13978,7 +14108,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class IoTDataConnector(DataConnector, discriminator="IOT"): +class IoTDataConnector( + DataConnector, discriminator="IOT" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents IoT data connector. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -14046,7 +14178,9 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class IoTDataConnectorProperties(DataConnectorWithAlertsProperties): +class IoTDataConnectorProperties( + DataConnectorWithAlertsProperties +): # pylint: disable=docstring-keyword-should-match-keyword-only """IoT data connector properties. :ivar data_types: The available data types for the connector. @@ -14079,7 +14213,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class IoTDeviceEntity(Entity, discriminator="IoTDevice"): +class IoTDeviceEntity(Entity, discriminator="IoTDevice"): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents an IoT device entity. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -14175,7 +14309,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class IoTDeviceEntityProperties(EntityCommonProperties): +class IoTDeviceEntityProperties(EntityCommonProperties): # pylint: disable=docstring-keyword-should-match-keyword-only """IoTDevice entity property bag. :ivar additional_data: A bag of custom fields that should be part of the entity and will be @@ -14323,7 +14457,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class IpEntity(Entity, discriminator="Ip"): +class IpEntity(Entity, discriminator="Ip"): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents an ip entity. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -14415,7 +14549,7 @@ class IpEntityProperties(EntityCommonProperties): """A list of TI contexts attached to the ip entity.""" -class Job(ProxyResource): +class Job(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """The assignment job. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -14481,7 +14615,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class JobItem(_Model): +class JobItem(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """An entity describing the publish status of a content item. :ivar resource_id: The resource id of the content item. @@ -14528,16 +14662,16 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class JobProperties(_Model): +class JobProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The job properties. :ivar end_time: The time the job completed. :vartype end_time: ~datetime.datetime :ivar items_property: List of items published by the job. :vartype items_property: list[~azure.mgmt.securityinsight.models.JobItem] - :ivar provisioning_state: State of the job. Known values are: "Accepted", "InProgress", - "Succeeded", "Failed", and "Canceled". - :vartype provisioning_state: str or ~azure.mgmt.securityinsight.models.ProvisioningState + :ivar provisioning_state: State of the job. Known values are: "Succeeded", "InProgress", + "Canceled", and "Failed". + :vartype provisioning_state: str or ~azure.mgmt.securityinsight.models.JobProvisioningState :ivar start_time: The time the job started. :vartype start_time: ~datetime.datetime :ivar error_message: Message to describe error, if an error exists. @@ -14550,11 +14684,11 @@ class JobProperties(_Model): name="items", visibility=["read", "create", "update", "delete", "query"], original_tsp_name="items" ) """List of items published by the job.""" - provisioning_state: Optional[Union[str, "_models.ProvisioningState"]] = rest_field( + provisioning_state: Optional[Union[str, "_models.JobProvisioningState"]] = rest_field( name="provisioningState", visibility=["read"] ) - """State of the job. Known values are: \"Accepted\", \"InProgress\", \"Succeeded\", \"Failed\", - and \"Canceled\".""" + """State of the job. Known values are: \"Succeeded\", \"InProgress\", \"Canceled\", and + \"Failed\".""" start_time: Optional[datetime.datetime] = rest_field(name="startTime", visibility=["read"], format="rfc3339") """The time the job started.""" error_message: Optional[str] = rest_field(name="errorMessage", visibility=["read"]) @@ -14578,7 +14712,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class JwtAuthModel(CcpAuthConfig, discriminator="JwtToken"): +class JwtAuthModel( + CcpAuthConfig, discriminator="JwtToken" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Model for API authentication with JWT. Simple exchange between user name + password to access token. @@ -14666,7 +14802,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: self.type = CcpAuthType.JWT_TOKEN # type: ignore -class MailboxEntity(Entity, discriminator="Mailbox"): +class MailboxEntity(Entity, discriminator="Mailbox"): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a mailbox entity. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -14769,7 +14905,9 @@ class MailboxEntityProperties(EntityCommonProperties): specific to mailbox object on office side.""" -class MailClusterEntity(Entity, discriminator="MailCluster"): +class MailClusterEntity( + Entity, discriminator="MailCluster" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a mail cluster entity. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -14930,7 +15068,9 @@ class MailClusterEntityProperties(EntityCommonProperties): """The cluster group.""" -class MailMessageEntity(Entity, discriminator="MailMessage"): +class MailMessageEntity( + Entity, discriminator="MailMessage" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a mail message entity. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -15023,7 +15163,9 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class MailMessageEntityProperties(EntityCommonProperties): +class MailMessageEntityProperties( + EntityCommonProperties +): # pylint: disable=docstring-keyword-should-match-keyword-only """Mail message entity property bag. :ivar additional_data: A bag of custom fields that should be part of the entity and will be @@ -15187,7 +15329,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class MalwareEntity(Entity, discriminator="Malware"): +class MalwareEntity(Entity, discriminator="Malware"): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a malware entity. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -15289,7 +15431,7 @@ class MalwareEntityProperties(EntityCommonProperties): """List of linked process entity identifiers on which the malware was found.""" -class ManualTriggerRequestBody(_Model): +class ManualTriggerRequestBody(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """ManualTriggerRequestBody. :ivar tenant_id: @@ -15323,7 +15465,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class MCASCheckRequirements(DataConnectorsCheckRequirements, discriminator="MicrosoftCloudAppSecurity"): +class MCASCheckRequirements( + DataConnectorsCheckRequirements, discriminator="MicrosoftCloudAppSecurity" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents MCAS (Microsoft Cloud App Security) requirements check request. :ivar properties: MCAS (Microsoft Cloud App Security) requirements check properties. @@ -15377,7 +15521,9 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class MCASCheckRequirementsProperties(DataConnectorTenantId): +class MCASCheckRequirementsProperties( + DataConnectorTenantId +): # pylint: disable=docstring-keyword-should-match-keyword-only """MCAS (Microsoft Cloud App Security) requirements check properties. :ivar tenant_id: The tenant id to connect to, and get the data from. Required. @@ -15402,7 +15548,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class MCASDataConnector(DataConnector, discriminator="MicrosoftCloudAppSecurity"): +class MCASDataConnector( + DataConnector, discriminator="MicrosoftCloudAppSecurity" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents MCAS (Microsoft Cloud App Security) data connector. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -15470,7 +15618,9 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class MCASDataConnectorDataTypes(AlertsDataTypeOfDataConnector): +class MCASDataConnectorDataTypes( + AlertsDataTypeOfDataConnector +): # pylint: disable=docstring-keyword-should-match-keyword-only """The available data types for MCAS (Microsoft Cloud App Security) data connector. :ivar alerts: Alerts data type connection. Required. @@ -15503,7 +15653,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class MCASDataConnectorProperties(DataConnectorTenantId): +class MCASDataConnectorProperties(DataConnectorTenantId): # pylint: disable=docstring-keyword-should-match-keyword-only """MCAS (Microsoft Cloud App Security) data connector properties. :ivar tenant_id: The tenant id to connect to, and get the data from. Required. @@ -15538,7 +15688,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: class MDATPCheckRequirements( DataConnectorsCheckRequirements, discriminator="MicrosoftDefenderAdvancedThreatProtection" -): +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents MDATP (Microsoft Defender Advanced Threat Protection) requirements check request. :ivar properties: MDATP (Microsoft Defender Advanced Threat Protection) requirements check @@ -15596,7 +15746,9 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class MDATPCheckRequirementsProperties(DataConnectorTenantId): +class MDATPCheckRequirementsProperties( + DataConnectorTenantId +): # pylint: disable=docstring-keyword-should-match-keyword-only """MDATP (Microsoft Defender Advanced Threat Protection) requirements check properties. :ivar tenant_id: The tenant id to connect to, and get the data from. Required. @@ -15621,7 +15773,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class MDATPDataConnector(DataConnector, discriminator="MicrosoftDefenderAdvancedThreatProtection"): +class MDATPDataConnector( + DataConnector, discriminator="MicrosoftDefenderAdvancedThreatProtection" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents MDATP (Microsoft Defender Advanced Threat Protection) data connector. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -15691,7 +15845,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class MDATPDataConnectorProperties(_Model): +class MDATPDataConnectorProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """MDATP (Microsoft Defender Advanced Threat Protection) data connector properties. :ivar tenant_id: The tenant id to connect to, and get the data from. Required. @@ -15726,7 +15880,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class MetadataAuthor(_Model): +class MetadataAuthor(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Publisher or creator of the content item. :ivar name: Name of the author. Company or person. @@ -15764,7 +15918,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class MetadataCategories(_Model): +class MetadataCategories(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """ies for the solution content item. :ivar domains: domain for the solution content item. @@ -15797,7 +15951,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class MetadataDependencies(_Model): +class MetadataDependencies(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex dependencies. @@ -15818,13 +15972,8 @@ class MetadataDependencies(_Model): :ivar name: Name of the content item. :vartype name: str :ivar operator: Operator used for list of dependencies in criteria array. Known values are: - "Equals", "NotEquals", "LessThan", "LessThanEqual", "GreaterThan", "GreaterThanEqual", - "StringContains", "StringNotContains", "StringStartsWith", "StringNotStartsWith", - "StringEndsWith", "StringNotEndsWith", "StringIsEmpty", "IsNull", "IsTrue", "IsFalse", - "ArrayContains", "ArrayNotContains", "OnOrAfterRelative", "AfterRelative", - "OnOrBeforeRelative", "BeforeRelative", "OnOrAfterAbsolute", "AfterAbsolute", - "OnOrBeforeAbsolute", and "BeforeAbsolute". - :vartype operator: str or ~azure.mgmt.securityinsight.models.Operator + "AND" and "OR". + :vartype operator: str or ~azure.mgmt.securityinsight.models.MetadataDependencyOperator :ivar criteria: This is the list of dependencies we must fulfill, according to the AND/OR operator. :vartype criteria: list[~azure.mgmt.securityinsight.models.MetadataDependencies] @@ -15845,16 +15994,10 @@ class MetadataDependencies(_Model): exact match is required.""" name: Optional[str] = rest_field(visibility=["read", "create", "update", "delete", "query"]) """Name of the content item.""" - operator: Optional[Union[str, "_models.Operator"]] = rest_field( + operator: Optional[Union[str, "_models.MetadataDependencyOperator"]] = rest_field( visibility=["read", "create", "update", "delete", "query"] ) - """Operator used for list of dependencies in criteria array. Known values are: \"Equals\", - \"NotEquals\", \"LessThan\", \"LessThanEqual\", \"GreaterThan\", \"GreaterThanEqual\", - \"StringContains\", \"StringNotContains\", \"StringStartsWith\", \"StringNotStartsWith\", - \"StringEndsWith\", \"StringNotEndsWith\", \"StringIsEmpty\", \"IsNull\", \"IsTrue\", - \"IsFalse\", \"ArrayContains\", \"ArrayNotContains\", \"OnOrAfterRelative\", \"AfterRelative\", - \"OnOrBeforeRelative\", \"BeforeRelative\", \"OnOrAfterAbsolute\", \"AfterAbsolute\", - \"OnOrBeforeAbsolute\", and \"BeforeAbsolute\".""" + """Operator used for list of dependencies in criteria array. Known values are: \"AND\" and \"OR\".""" criteria: Optional[list["_models.MetadataDependencies"]] = rest_field( visibility=["read", "create", "update", "delete", "query"] ) @@ -15868,7 +16011,7 @@ def __init__( kind: Optional[Union[str, "_models.Kind"]] = None, version: Optional[str] = None, name: Optional[str] = None, - operator: Optional[Union[str, "_models.Operator"]] = None, + operator: Optional[Union[str, "_models.MetadataDependencyOperator"]] = None, criteria: Optional[list["_models.MetadataDependencies"]] = None, ) -> None: ... @@ -15883,7 +16026,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class MetadataModel(ProxyResource): +class MetadataModel(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """Metadata resource definition. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -15969,7 +16112,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class MetadataPatch(ResourceWithEtag): +class MetadataPatch(ResourceWithEtag): # pylint: disable=docstring-keyword-should-match-keyword-only """Metadata patch request body. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -16053,7 +16196,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class MetadataProperties(_Model): +class MetadataProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Metadata property bag. :ivar content_id: Static ID for the content. Used to identify dependencies and content from @@ -16215,7 +16358,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class MetadataPropertiesPatch(_Model): +class MetadataPropertiesPatch(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Metadata property bag for patch requests. This is the same as the MetadataProperties, but with nothing required. @@ -16378,7 +16521,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class MetadataSource(_Model): +class MetadataSource(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The original source of the content item, where it comes from. :ivar kind: Source type of the content. Required. Known values are: "LocalWorkspace", @@ -16418,7 +16561,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class MetadataSupport(_Model): +class MetadataSupport(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Support information for the content item. :ivar tier: Type of support for content item. Required. Known values are: "Microsoft", @@ -16465,7 +16608,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: class MicrosoftPurviewInformationProtectionCheckRequirements( DataConnectorsCheckRequirements, discriminator="MicrosoftPurviewInformationProtection" -): # pylint: disable=name-too-long +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """Represents MicrosoftPurviewInformationProtection requirements check request. :ivar properties: MicrosoftPurviewInformationProtection requirements check properties. @@ -16524,7 +16667,7 @@ def __setattr__(self, key: str, value: Any) -> None: class MicrosoftPurviewInformationProtectionCheckRequirementsProperties( DataConnectorTenantId -): # pylint: disable=name-too-long +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """MicrosoftPurviewInformationProtection requirements check properties. :ivar tenant_id: The tenant id to connect to, and get the data from. Required. @@ -16549,7 +16692,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class MicrosoftPurviewInformationProtectionConnectorDataTypes(_Model): # pylint: disable=name-too-long +class MicrosoftPurviewInformationProtectionConnectorDataTypes( + _Model +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """The available data types for Microsoft Purview Information Protection data connector. :ivar logs: Logs data type. Required. @@ -16582,7 +16727,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: class MicrosoftPurviewInformationProtectionConnectorDataTypesLogs( DataConnectorDataTypeCommon -): # pylint: disable=name-too-long +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """Logs data type. :ivar state: Describe whether this data type connection is enabled or not. Required. Known @@ -16610,7 +16755,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: class MicrosoftPurviewInformationProtectionDataConnector( DataConnector, discriminator="MicrosoftPurviewInformationProtection" -): # pylint: disable=name-too-long +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """Represents Microsoft Purview Information Protection data connector. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -16682,7 +16827,7 @@ def __setattr__(self, key: str, value: Any) -> None: class MicrosoftPurviewInformationProtectionDataConnectorProperties( DataConnectorTenantId -): # pylint: disable=name-too-long +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """Microsoft Purview Information Protection data connector properties. :ivar tenant_id: The tenant id to connect to, and get the data from. Required. @@ -16718,7 +16863,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: class MicrosoftSecurityIncidentCreationAlertRule( AlertRule, discriminator="MicrosoftSecurityIncidentCreation" -): # pylint: disable=name-too-long +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """Represents MicrosoftSecurityIncidentCreation rule. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -16797,7 +16942,9 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class MicrosoftSecurityIncidentCreationAlertRuleCommonProperties(_Model): # pylint: disable=name-too-long +class MicrosoftSecurityIncidentCreationAlertRuleCommonProperties( + _Model +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """MicrosoftSecurityIncidentCreation rule common property bag. :ivar display_names_filter: the alerts' displayNames on which the cases will be generated. @@ -16859,7 +17006,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: class MicrosoftSecurityIncidentCreationAlertRuleProperties( MicrosoftSecurityIncidentCreationAlertRuleCommonProperties -): # pylint: disable=name-too-long +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """MicrosoftSecurityIncidentCreation rule property bag. :ivar display_names_filter: the alerts' displayNames on which the cases will be generated. @@ -16929,7 +17076,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: class MicrosoftSecurityIncidentCreationAlertRuleTemplate( AlertRuleTemplate, discriminator="MicrosoftSecurityIncidentCreation" -): # pylint: disable=name-too-long +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """Represents MicrosoftSecurityIncidentCreation rule template. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -17009,7 +17156,7 @@ def __setattr__(self, key: str, value: Any) -> None: class MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties( AlertRuleTemplatePropertiesBase -): # pylint: disable=name-too-long +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """MicrosoftSecurityIncidentCreation rule template properties. :ivar alert_rules_created_by_template_count: The number of alert rules that were created by @@ -17089,7 +17236,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class MLBehaviorAnalyticsAlertRule(AlertRule, discriminator="MLBehaviorAnalytics"): +class MLBehaviorAnalyticsAlertRule( + AlertRule, discriminator="MLBehaviorAnalytics" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents MLBehaviorAnalytics alert rule. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -17167,7 +17316,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class MLBehaviorAnalyticsAlertRuleProperties(_Model): +class MLBehaviorAnalyticsAlertRuleProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """MLBehaviorAnalytics alert rule base property bag. :ivar alert_rule_template_name: The Name of the alert rule template used to create this rule. @@ -17235,7 +17384,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class MLBehaviorAnalyticsAlertRuleTemplate(AlertRuleTemplate, discriminator="MLBehaviorAnalytics"): +class MLBehaviorAnalyticsAlertRuleTemplate( + AlertRuleTemplate, discriminator="MLBehaviorAnalytics" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents MLBehaviorAnalytics alert rule template. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -17314,7 +17465,7 @@ def __setattr__(self, key: str, value: Any) -> None: class MLBehaviorAnalyticsAlertRuleTemplateProperties( AlertRuleTemplateWithMitreProperties -): # pylint: disable=name-too-long +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """MLBehaviorAnalytics alert rule template properties. :ivar alert_rules_created_by_template_count: The number of alert rules that were created by @@ -17374,7 +17525,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class MSTICheckRequirements(DataConnectorsCheckRequirements, discriminator="MicrosoftThreatIntelligence"): +class MSTICheckRequirements( + DataConnectorsCheckRequirements, discriminator="MicrosoftThreatIntelligence" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents Microsoft Threat Intelligence requirements check request. :ivar properties: Microsoft Threat Intelligence requirements check properties. @@ -17429,7 +17582,9 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class MSTICheckRequirementsProperties(DataConnectorTenantId): +class MSTICheckRequirementsProperties( + DataConnectorTenantId +): # pylint: disable=docstring-keyword-should-match-keyword-only """Microsoft Threat Intelligence requirements check properties. :ivar tenant_id: The tenant id to connect to, and get the data from. Required. @@ -17454,7 +17609,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class MSTIDataConnector(DataConnector, discriminator="MicrosoftThreatIntelligence"): +class MSTIDataConnector( + DataConnector, discriminator="MicrosoftThreatIntelligence" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents Microsoft Threat Intelligence data connector. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -17522,7 +17679,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class MSTIDataConnectorDataTypes(_Model): +class MSTIDataConnectorDataTypes(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The available data types for Microsoft Threat Intelligence Platforms data connector. :ivar microsoft_emerging_threat_feed: Data type for Microsoft Threat Intelligence Platforms @@ -17556,7 +17713,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: class MSTIDataConnectorDataTypesMicrosoftEmergingThreatFeed( DataConnectorDataTypeCommon -): # pylint: disable=name-too-long +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """Data type for Microsoft Threat Intelligence Platforms data connector. :ivar state: Describe whether this data type connection is enabled or not. Required. Known @@ -17590,7 +17747,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class MSTIDataConnectorProperties(DataConnectorTenantId): +class MSTIDataConnectorProperties(DataConnectorTenantId): # pylint: disable=docstring-keyword-should-match-keyword-only """Microsoft Threat Intelligence data connector properties. :ivar tenant_id: The tenant id to connect to, and get the data from. Required. @@ -17623,7 +17780,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class MtpCheckRequirements(DataConnectorsCheckRequirements, discriminator="MicrosoftThreatProtection"): +class MtpCheckRequirements( + DataConnectorsCheckRequirements, discriminator="MicrosoftThreatProtection" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents MTP (Microsoft Threat Protection) requirements check request. :ivar properties: MTP (Microsoft Threat Protection) requirements check properties. @@ -17677,7 +17836,9 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class MTPCheckRequirementsProperties(DataConnectorTenantId): +class MTPCheckRequirementsProperties( + DataConnectorTenantId +): # pylint: disable=docstring-keyword-should-match-keyword-only """MTP (Microsoft Threat Protection) requirements check properties. :ivar tenant_id: The tenant id to connect to, and get the data from. Required. @@ -17702,7 +17863,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class MTPDataConnector(DataConnector, discriminator="MicrosoftThreatProtection"): +class MTPDataConnector( + DataConnector, discriminator="MicrosoftThreatProtection" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents MTP (Microsoft Threat Protection) data connector. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -17770,7 +17933,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class MTPDataConnectorDataTypes(_Model): +class MTPDataConnectorDataTypes(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The available data types for Microsoft Threat Protection Platforms data connector. :ivar incidents: Incidents data type for Microsoft Threat Protection Platforms data connector. @@ -17808,7 +17971,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class MTPDataConnectorDataTypesAlerts(DataConnectorDataTypeCommon): +class MTPDataConnectorDataTypesAlerts( + DataConnectorDataTypeCommon +): # pylint: disable=docstring-keyword-should-match-keyword-only """Alerts data type for Microsoft Threat Protection Platforms data connector. :ivar state: Describe whether this data type connection is enabled or not. Required. Known @@ -17834,7 +17999,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class MTPDataConnectorDataTypesIncidents(DataConnectorDataTypeCommon): +class MTPDataConnectorDataTypesIncidents( + DataConnectorDataTypeCommon +): # pylint: disable=docstring-keyword-should-match-keyword-only """Incidents data type for Microsoft Threat Protection Platforms data connector. :ivar state: Describe whether this data type connection is enabled or not. Required. Known @@ -17860,7 +18027,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class MTPDataConnectorProperties(DataConnectorTenantId): +class MTPDataConnectorProperties(DataConnectorTenantId): # pylint: disable=docstring-keyword-should-match-keyword-only """MTP (Microsoft Threat Protection) data connector properties. :ivar tenant_id: The tenant id to connect to, and get the data from. Required. @@ -17900,7 +18067,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class MtpFilteredProviders(_Model): +class MtpFilteredProviders(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents the connector's Filtered providers. :ivar alerts: Alerts filtered providers. When filters are not applied, all alerts will stream @@ -17934,7 +18101,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class NicEntity(Entity, discriminator="Nic"): +class NicEntity(Entity, discriminator="Nic"): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents an network interface entity. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -18052,7 +18219,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: self.type = CcpAuthType.NONE # type: ignore -class NrtAlertRule(AlertRule, discriminator="NRT"): +class NrtAlertRule(AlertRule, discriminator="NRT"): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents NRT alert rule. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -18140,7 +18307,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class NrtAlertRuleProperties(_Model): +class NrtAlertRuleProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Nrt alert rule base property bag. :ivar alert_rule_template_name: The Name of the alert rule template used to create this rule. @@ -18295,7 +18462,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class NrtAlertRuleTemplate(AlertRuleTemplate, discriminator="NRT"): +class NrtAlertRuleTemplate( + AlertRuleTemplate, discriminator="NRT" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents NRT alert rule template. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -18378,7 +18547,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class NrtAlertRuleTemplateProperties(_Model): +class NrtAlertRuleTemplateProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """NRT alert rule template properties. :ivar tactics: The tactics of the alert rule. @@ -18519,7 +18688,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class OAuthModel(CcpAuthConfig, discriminator="OAuth2"): +class OAuthModel(CcpAuthConfig, discriminator="OAuth2"): # pylint: disable=docstring-keyword-should-match-keyword-only """Model for API authentication with OAuth2. :ivar authorization_code: The user's authorization code. @@ -18646,7 +18815,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: self.type = CcpAuthType.O_AUTH2 # type: ignore -class Office365ProjectCheckRequirements(DataConnectorsCheckRequirements, discriminator="Office365Project"): +class Office365ProjectCheckRequirements( + DataConnectorsCheckRequirements, discriminator="Office365Project" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents Office365 Project requirements check request. :ivar properties: Office365 Project requirements check properties. @@ -18701,7 +18872,9 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class Office365ProjectCheckRequirementsProperties(DataConnectorTenantId): # pylint: disable=name-too-long +class Office365ProjectCheckRequirementsProperties( + DataConnectorTenantId +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """Office365 Project requirements check properties. :ivar tenant_id: The tenant id to connect to, and get the data from. Required. @@ -18726,7 +18899,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class Office365ProjectConnectorDataTypes(_Model): +class Office365ProjectConnectorDataTypes(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The available data types for Office Microsoft Project data connector. :ivar logs: Logs data type. Required. @@ -18756,7 +18929,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class Office365ProjectConnectorDataTypesLogs(DataConnectorDataTypeCommon): +class Office365ProjectConnectorDataTypesLogs( + DataConnectorDataTypeCommon +): # pylint: disable=docstring-keyword-should-match-keyword-only """Logs data type. :ivar state: Describe whether this data type connection is enabled or not. Required. Known @@ -18782,7 +18957,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class Office365ProjectDataConnector(DataConnector, discriminator="Office365Project"): +class Office365ProjectDataConnector( + DataConnector, discriminator="Office365Project" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents Office Microsoft Project data connector. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -18850,7 +19027,9 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class Office365ProjectDataConnectorProperties(DataConnectorTenantId): +class Office365ProjectDataConnectorProperties( + DataConnectorTenantId +): # pylint: disable=docstring-keyword-should-match-keyword-only """Office Microsoft Project data connector properties. :ivar tenant_id: The tenant id to connect to, and get the data from. Required. @@ -18883,7 +19062,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class OfficeATPCheckRequirements(DataConnectorsCheckRequirements, discriminator="OfficeATP"): +class OfficeATPCheckRequirements( + DataConnectorsCheckRequirements, discriminator="OfficeATP" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents OfficeATP (Office 365 Advanced Threat Protection) requirements check request. :ivar properties: OfficeATP (Office 365 Advanced Threat Protection) requirements check @@ -18938,7 +19119,9 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class OfficeATPCheckRequirementsProperties(DataConnectorTenantId): +class OfficeATPCheckRequirementsProperties( + DataConnectorTenantId +): # pylint: disable=docstring-keyword-should-match-keyword-only """OfficeATP (Office 365 Advanced Threat Protection) requirements check properties. :ivar tenant_id: The tenant id to connect to, and get the data from. Required. @@ -18963,7 +19146,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class OfficeATPDataConnector(DataConnector, discriminator="OfficeATP"): +class OfficeATPDataConnector( + DataConnector, discriminator="OfficeATP" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents OfficeATP (Office 365 Advanced Threat Protection) data connector. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -19031,7 +19216,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class OfficeATPDataConnectorProperties(_Model): +class OfficeATPDataConnectorProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """OfficeATP (Office 365 Advanced Threat Protection) data connector properties. :ivar tenant_id: The tenant id to connect to, and get the data from. Required. @@ -19066,7 +19251,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class OfficeConsent(ProxyResource): +class OfficeConsent(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """Consent for Office365 tenant that already made. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -19127,7 +19312,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class OfficeConsentProperties(_Model): +class OfficeConsentProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Consent property bag. :ivar tenant_id: The tenantId of the Office365 with the consent. @@ -19160,7 +19345,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class OfficeDataConnector(DataConnector, discriminator="Office365"): +class OfficeDataConnector( + DataConnector, discriminator="Office365" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents office data connector. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -19228,7 +19415,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class OfficeDataConnectorDataTypes(_Model): +class OfficeDataConnectorDataTypes(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The available data types for office data connector. :ivar exchange: Exchange data type connection. Required. @@ -19272,7 +19459,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class OfficeDataConnectorDataTypesExchange(DataConnectorDataTypeCommon): +class OfficeDataConnectorDataTypesExchange( + DataConnectorDataTypeCommon +): # pylint: disable=docstring-keyword-should-match-keyword-only """Exchange data type connection. :ivar state: Describe whether this data type connection is enabled or not. Required. Known @@ -19298,7 +19487,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class OfficeDataConnectorDataTypesSharePoint(DataConnectorDataTypeCommon): +class OfficeDataConnectorDataTypesSharePoint( + DataConnectorDataTypeCommon +): # pylint: disable=docstring-keyword-should-match-keyword-only """SharePoint data type connection. :ivar state: Describe whether this data type connection is enabled or not. Required. Known @@ -19324,7 +19515,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class OfficeDataConnectorDataTypesTeams(DataConnectorDataTypeCommon): +class OfficeDataConnectorDataTypesTeams( + DataConnectorDataTypeCommon +): # pylint: disable=docstring-keyword-should-match-keyword-only """Teams data type connection. :ivar state: Describe whether this data type connection is enabled or not. Required. Known @@ -19350,7 +19543,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class OfficeDataConnectorProperties(DataConnectorTenantId): +class OfficeDataConnectorProperties( + DataConnectorTenantId +): # pylint: disable=docstring-keyword-should-match-keyword-only """Office data connector properties. :ivar tenant_id: The tenant id to connect to, and get the data from. Required. @@ -19383,7 +19578,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class OfficeIRMCheckRequirements(DataConnectorsCheckRequirements, discriminator="OfficeIRM"): +class OfficeIRMCheckRequirements( + DataConnectorsCheckRequirements, discriminator="OfficeIRM" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents OfficeIRM (Microsoft Insider Risk Management) requirements check request. :ivar properties: OfficeIRM (Microsoft Insider Risk Management) requirements check properties. @@ -19437,7 +19634,9 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class OfficeIRMCheckRequirementsProperties(DataConnectorTenantId): +class OfficeIRMCheckRequirementsProperties( + DataConnectorTenantId +): # pylint: disable=docstring-keyword-should-match-keyword-only """OfficeIRM (Microsoft Insider Risk Management) requirements check properties. :ivar tenant_id: The tenant id to connect to, and get the data from. Required. @@ -19462,7 +19661,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class OfficeIRMDataConnector(DataConnector, discriminator="OfficeIRM"): +class OfficeIRMDataConnector( + DataConnector, discriminator="OfficeIRM" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents OfficeIRM (Microsoft Insider Risk Management) data connector. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -19530,7 +19731,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class OfficeIRMDataConnectorProperties(_Model): +class OfficeIRMDataConnectorProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """OfficeIRM (Microsoft Insider Risk Management) data connector properties. :ivar tenant_id: The tenant id to connect to, and get the data from. Required. @@ -19565,7 +19766,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class OfficePowerBICheckRequirements(DataConnectorsCheckRequirements, discriminator="OfficePowerBI"): +class OfficePowerBICheckRequirements( + DataConnectorsCheckRequirements, discriminator="OfficePowerBI" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents Office PowerBI requirements check request. :ivar properties: Office Power BI requirements check properties. @@ -19620,7 +19823,9 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class OfficePowerBICheckRequirementsProperties(DataConnectorTenantId): +class OfficePowerBICheckRequirementsProperties( + DataConnectorTenantId +): # pylint: disable=docstring-keyword-should-match-keyword-only """Office PowerBI requirements check properties. :ivar tenant_id: The tenant id to connect to, and get the data from. Required. @@ -19645,7 +19850,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class OfficePowerBIConnectorDataTypes(_Model): +class OfficePowerBIConnectorDataTypes(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The available data types for Office Microsoft PowerBI data connector. :ivar logs: Logs data type. Required. @@ -19675,7 +19880,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class OfficePowerBIConnectorDataTypesLogs(DataConnectorDataTypeCommon): +class OfficePowerBIConnectorDataTypesLogs( + DataConnectorDataTypeCommon +): # pylint: disable=docstring-keyword-should-match-keyword-only """Logs data type. :ivar state: Describe whether this data type connection is enabled or not. Required. Known @@ -19701,7 +19908,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class OfficePowerBIDataConnector(DataConnector, discriminator="OfficePowerBI"): +class OfficePowerBIDataConnector( + DataConnector, discriminator="OfficePowerBI" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents Office Microsoft PowerBI data connector. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -19769,7 +19978,9 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class OfficePowerBIDataConnectorProperties(DataConnectorTenantId): +class OfficePowerBIDataConnectorProperties( + DataConnectorTenantId +): # pylint: disable=docstring-keyword-should-match-keyword-only """Office Microsoft PowerBI data connector properties. :ivar tenant_id: The tenant id to connect to, and get the data from. Required. @@ -19802,7 +20013,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class Operation(_Model): +class Operation(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Operation provided by provider. :ivar display: Properties of the operation. @@ -19849,7 +20060,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class OperationDisplay(_Model): +class OperationDisplay(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Properties of the operation. :ivar description: Description of the operation. @@ -19892,7 +20103,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class OracleAuthModel(CcpAuthConfig, discriminator="Oracle"): +class OracleAuthModel( + CcpAuthConfig, discriminator="Oracle" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Model for API authentication for Oracle. :ivar tenant_id: Oracle tenant ID. Required. @@ -19942,7 +20155,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: self.type = CcpAuthType.ORACLE # type: ignore -class PackageBaseProperties(_Model): +class PackageBaseProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes package properties. :ivar content_id: The content id of the package. @@ -20120,7 +20333,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class PackageModel(ProxyResource): +class PackageModel(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a Package in Azure Security Insights. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -20210,7 +20423,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class PackageProperties(PackageBaseProperties): +class PackageProperties(PackageBaseProperties): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes package properties. :ivar content_id: The content id of the package. @@ -20307,7 +20520,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class Permissions(_Model): +class Permissions(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Permissions required for the connector. :ivar resource_provider: Resource provider permissions required for the connector. @@ -20345,7 +20558,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class PermissionsCustomsItem(Customs): +class PermissionsCustomsItem(Customs): # pylint: disable=docstring-keyword-should-match-keyword-only """PermissionsCustomsItem. :ivar name: Customs permissions name. @@ -20373,7 +20586,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ResourceProvider(_Model): +class ResourceProvider(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Resource provider permissions required for the connector. :ivar provider: Provider name. Known values are: "Microsoft.OperationalInsights/solutions", @@ -20442,7 +20655,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class PermissionsResourceProviderItem(ResourceProvider): +class PermissionsResourceProviderItem(ResourceProvider): # pylint: disable=docstring-keyword-should-match-keyword-only """PermissionsResourceProviderItem. :ivar provider: Provider name. Known values are: "Microsoft.OperationalInsights/solutions", @@ -20484,7 +20697,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class PlaybookActionProperties(_Model): +class PlaybookActionProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """PlaybookActionProperties. :ivar logic_app_resource_id: The resource id of the playbook resource. Required. @@ -20519,7 +20732,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class PremiumMdtiDataConnectorDataTypes(_Model): +class PremiumMdtiDataConnectorDataTypes(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The available data types for Microsoft Defender for Threat Intelligence Premium data connector. :ivar connector: Data type for Microsoft Defender for Threat Intelligence Premium data @@ -20551,7 +20764,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class PremiumMdtiDataConnectorDataTypesConnector(DataConnectorDataTypeCommon): # pylint: disable=name-too-long +class PremiumMdtiDataConnectorDataTypesConnector( + DataConnectorDataTypeCommon +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """Data type for Microsoft Defender for Threat Intelligence Premium data connector. :ivar state: Describe whether this data type connection is enabled or not. Required. Known @@ -20577,7 +20792,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class PremiumMdtiDataConnectorProperties(DataConnectorTenantId): +class PremiumMdtiDataConnectorProperties( + DataConnectorTenantId +): # pylint: disable=docstring-keyword-should-match-keyword-only """Microsoft Defender for Threat Intelligence Premium data connector properties. :ivar tenant_id: The tenant id to connect to, and get the data from. Required. @@ -20629,7 +20846,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: class PremiumMicrosoftDefenderForThreatIntelligence( DataConnector, discriminator="PremiumMicrosoftDefenderForThreatIntelligence" -): # pylint: disable=name-too-long +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """Represents Microsoft Defender for Threat Intelligence Premium data connector. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -20698,7 +20915,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class ProcessEntity(Entity, discriminator="Process"): +class ProcessEntity(Entity, discriminator="Process"): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a process entity. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -20775,7 +20992,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class ProcessEntityProperties(EntityCommonProperties): +class ProcessEntityProperties(EntityCommonProperties): # pylint: disable=docstring-keyword-should-match-keyword-only """Process entity property bag. :ivar additional_data: A bag of custom fields that should be part of the entity and will be @@ -20847,7 +21064,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ProductPackageModel(ProxyResource): +class ProductPackageModel(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a Package in Azure Security Insights. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -20940,7 +21157,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class ProductPackageProperties(_Model): +class ProductPackageProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes package properties. :ivar content_id: The content id of the package. @@ -21140,7 +21357,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ProductTemplateModel(ProxyResource): +class ProductTemplateModel(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """Template resource definition. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -21233,7 +21450,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class ProductTemplateProperties(_Model): +class ProductTemplateProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Template property bag. :ivar content_id: Static ID for the content. Used to identify dependencies and content from @@ -21459,7 +21676,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class PropertyArrayChangedConditionProperties(AutomationRuleCondition, discriminator="PropertyArrayChanged"): +class PropertyArrayChangedConditionProperties( + AutomationRuleCondition, discriminator="PropertyArrayChanged" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes an automation rule condition that evaluates an array property's value change. :ivar condition_properties: @@ -21494,7 +21713,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: self.condition_type = ConditionType.PROPERTY_ARRAY_CHANGED # type: ignore -class PropertyArrayConditionProperties(AutomationRuleCondition, discriminator="PropertyArray"): +class PropertyArrayConditionProperties( + AutomationRuleCondition, discriminator="PropertyArray" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes an automation rule condition that evaluates an array property's value. :ivar condition_properties: @@ -21529,7 +21750,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: self.condition_type = ConditionType.PROPERTY_ARRAY # type: ignore -class PropertyChangedConditionProperties(AutomationRuleCondition, discriminator="PropertyChanged"): +class PropertyChangedConditionProperties( + AutomationRuleCondition, discriminator="PropertyChanged" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes an automation rule condition that evaluates a property's value change. :ivar condition_properties: @@ -21564,7 +21787,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: self.condition_type = ConditionType.PROPERTY_CHANGED # type: ignore -class PropertyConditionProperties(AutomationRuleCondition, discriminator="Property"): +class PropertyConditionProperties( + AutomationRuleCondition, discriminator="Property" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes an automation rule condition that evaluates a property's value. :ivar condition_properties: @@ -21604,19 +21829,19 @@ class PullRequest(_Model): :ivar url: URL of pull request. :vartype url: str - :ivar state: State of the pull request. Known values are: "Active", "InProgress", "Dismissed", - "CompletedByUser", and "CompletedBySystem". - :vartype state: str or ~azure.mgmt.securityinsight.models.State + :ivar state: State of the pull request. Known values are: "Open" and "Closed". + :vartype state: str or ~azure.mgmt.securityinsight.models.PullRequestState """ url: Optional[str] = rest_field(visibility=["read"]) """URL of pull request.""" - state: Optional[Union[str, "_models.State"]] = rest_field(visibility=["read"]) - """State of the pull request. Known values are: \"Active\", \"InProgress\", \"Dismissed\", - \"CompletedByUser\", and \"CompletedBySystem\".""" + state: Optional[Union[str, "_models.PullRequestState"]] = rest_field(visibility=["read"]) + """State of the pull request. Known values are: \"Open\" and \"Closed\".""" -class PurviewAuditCheckRequirements(DataConnectorsCheckRequirements, discriminator="PurviewAudit"): +class PurviewAuditCheckRequirements( + DataConnectorsCheckRequirements, discriminator="PurviewAudit" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents PurviewAudit requirements check request. :ivar properties: PurviewAudit requirements check properties. @@ -21670,7 +21895,9 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class PurviewAuditCheckRequirementsProperties(DataConnectorTenantId): +class PurviewAuditCheckRequirementsProperties( + DataConnectorTenantId +): # pylint: disable=docstring-keyword-should-match-keyword-only """PurviewAudit requirements check properties. :ivar tenant_id: The tenant id to connect to, and get the data from. Required. @@ -21695,7 +21922,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class PurviewAuditConnectorDataTypes(_Model): +class PurviewAuditConnectorDataTypes(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The available data types for PurviewAudit data connector. :ivar logs: Logs data type. Required. @@ -21725,7 +21952,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class PurviewAuditConnectorDataTypesLogs(DataConnectorDataTypeCommon): +class PurviewAuditConnectorDataTypesLogs( + DataConnectorDataTypeCommon +): # pylint: disable=docstring-keyword-should-match-keyword-only """Logs data type. :ivar state: Describe whether this data type connection is enabled or not. Required. Known @@ -21751,7 +21980,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class PurviewAuditDataConnector(DataConnector, discriminator="PurviewAudit"): +class PurviewAuditDataConnector( + DataConnector, discriminator="PurviewAudit" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents PurviewAudit data connector. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -21819,7 +22050,9 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class PurviewAuditDataConnectorProperties(DataConnectorTenantId): +class PurviewAuditDataConnectorProperties( + DataConnectorTenantId +): # pylint: disable=docstring-keyword-should-match-keyword-only """PurviewAudit data connector properties. :ivar tenant_id: The tenant id to connect to, and get the data from. Required. @@ -21874,7 +22107,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class Query(_Model): +class Query(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a query to run on the TI objects in the workspace. :ivar condition: Represents a condition used to query for TI objects. @@ -21927,7 +22160,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class QueryCondition(_Model): +class QueryCondition(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a condition used to query for TI objects. :ivar stix_object_type: The STIX type for the objects returned by this query. @@ -21972,7 +22205,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class QueryProperties(_Model): +class QueryProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes the query properties. :ivar condition: Represents a condition used to query for TI objects. @@ -22002,7 +22235,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class QuerySortBy(_Model): +class QuerySortBy(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Specifies how to sort the query results. :ivar direction: The direction to sort the results by. Known values are: "ASC" and "DESC". @@ -22037,7 +22270,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class Recommendation(ProxyResource): +class Recommendation(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """Recommendation object. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -22114,7 +22347,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class RecommendationPatch(_Model): +class RecommendationPatch(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Recommendation Fields to update. :ivar properties: Recommendation Fields Properties to update. @@ -22144,7 +22377,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class RecommendationPatchProperties(_Model): +class RecommendationPatchProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Recommendation Fields Properties to update. :ivar state: State of the recommendation. Known values are: "Active", "InProgress", @@ -22176,7 +22409,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class RecommendationProperties(_Model): +class RecommendationProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Recommendation properties object. :ivar recommendation_type_id: Id of the recommendation type. Required. @@ -22267,7 +22500,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class RecommendedSuggestion(_Model): +class RecommendedSuggestion(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """What suggestions should be taken to complete the recommendation. :ivar suggestion_type_id: Id of the suggestion type. Required. @@ -22319,7 +22552,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ReevaluateResponse(_Model): +class ReevaluateResponse(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Reevaluate response object. :ivar last_evaluated_time_utc: The time stamp (UTC) when the recommendation was last evaluated. @@ -22349,7 +22582,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class RegistryKeyEntity(Entity, discriminator="RegistryKey"): +class RegistryKeyEntity( + Entity, discriminator="RegistryKey" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a registry key entity. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -22441,7 +22676,9 @@ class RegistryKeyEntityProperties(EntityCommonProperties): """The registry key path.""" -class RegistryValueEntity(Entity, discriminator="RegistryValue"): +class RegistryValueEntity( + Entity, discriminator="RegistryValue" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a registry value entity. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -22539,7 +22776,7 @@ class RegistryValueEntityProperties(EntityCommonProperties): \"ExpandString\", \"Binary\", \"DWord\", \"MultiString\", and \"QWord\".""" -class Relation(ProxyResource): +class Relation(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a relation between two resources. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -22610,7 +22847,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class RelationProperties(_Model): +class RelationProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Relation property bag. :ivar related_resource_id: The resource ID of the related resource. Required. @@ -22652,7 +22889,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class Relationship(TIObject, discriminator="Relationship"): +class Relationship( + TIObject, discriminator="Relationship" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a relationship in Azure Security Insights. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -22726,7 +22965,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class RelationshipHint(_Model): +class RelationshipHint(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """An object used to help follow relationships from this object to other STIX objects. :ivar field_name: @@ -22757,7 +22996,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class Repo(_Model): +class Repo(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a repository. :ivar url: The url to access the repository. @@ -22802,7 +23041,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class Repository(_Model): +class Repository(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """metadata of a repository. :ivar url: Url of repository. Required. @@ -22846,7 +23085,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class RepositoryAccess(_Model): +class RepositoryAccess(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Credentials to access repository. :ivar kind: The kind of repository access credentials. Required. Known values are: "OAuth", @@ -22906,7 +23145,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class RepositoryAccessObject(_Model): +class RepositoryAccessObject(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Credentials to access repository. :ivar repository_access: RepositoryAccess properties. Required. @@ -22956,7 +23195,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class RepositoryAccessProperties(_Model): +class RepositoryAccessProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Credentials to access repository. :ivar properties: RepositoryAccess properties. Required. @@ -22986,7 +23225,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class RepositoryResourceInfo(_Model): +class RepositoryResourceInfo(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Resources created in user's repository for the source-control. :ivar webhook: The webhook object created for the source-control. @@ -23027,7 +23266,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class RequiredPermissions(_Model): +class RequiredPermissions(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Required permissions for the connector. :ivar action: action permission. @@ -23070,7 +23309,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ResourceProviderRequiredPermissions(_Model): +class ResourceProviderRequiredPermissions(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Required permissions for the connector resource provider that define in ResourceProviders. For more information about the permissions see here. @@ -23116,7 +23355,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class RestApiPollerDataConnector(DataConnector, discriminator="RestApiPoller"): +class RestApiPollerDataConnector( + DataConnector, discriminator="RestApiPoller" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents Rest Api Poller data connector. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -23194,7 +23435,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class RestApiPollerDataConnectorProperties(_Model): +class RestApiPollerDataConnectorProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Rest Api Poller data connector properties. :ivar connector_definition_name: The connector definition name (the dataConnectorDefinition @@ -23277,7 +23518,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class RestApiPollerRequestConfig(_Model): +class RestApiPollerRequestConfig(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The request configuration. :ivar api_endpoint: The API endpoint. Required. @@ -23426,7 +23667,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class RestApiPollerRequestPagingConfig(_Model): +class RestApiPollerRequestPagingConfig(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The request paging configuration. :ivar paging_type: Type of paging. Required. Known values are: "LinkHeader", "NextPageToken", @@ -23470,7 +23711,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class SapSolutionUsageStatistic(BillingStatistic, discriminator="SapSolutionUsage"): +class SapSolutionUsageStatistic( + BillingStatistic, discriminator="SapSolutionUsage" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Billing statistic about the Microsoft Sentinel solution for SAP Usage. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -23549,7 +23792,9 @@ class SapSolutionUsageStatisticProperties(_Model): """The latest count of active SAP system IDs under the Microsoft Sentinel solution for SAP Usage.""" -class ScheduledAlertRule(AlertRule, discriminator="Scheduled"): +class ScheduledAlertRule( + AlertRule, discriminator="Scheduled" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents scheduled alert rule. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -23641,7 +23886,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class ScheduledAlertRuleCommonProperties(_Model): +class ScheduledAlertRuleCommonProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Scheduled alert rule template property bag. :ivar query: The query that creates alerts for this rule. @@ -23745,7 +23990,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ScheduledAlertRuleProperties(ScheduledAlertRuleCommonProperties): +class ScheduledAlertRuleProperties( + ScheduledAlertRuleCommonProperties +): # pylint: disable=docstring-keyword-should-match-keyword-only """Scheduled alert rule base property bag. :ivar query: The query that creates alerts for this rule. @@ -23886,7 +24133,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ScheduledAlertRuleTemplate(AlertRuleTemplate, discriminator="Scheduled"): +class ScheduledAlertRuleTemplate( + AlertRuleTemplate, discriminator="Scheduled" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents scheduled alert rule template. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -23974,7 +24223,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class ScheduledAlertRuleTemplateProperties(_Model): +class ScheduledAlertRuleTemplateProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Scheduled alert rule template properties. :ivar alert_rules_created_by_template_count: The number of alert rules that were created by @@ -24152,7 +24401,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class SecurityAlert(Entity, discriminator="SecurityAlert"): +class SecurityAlert( + Entity, discriminator="SecurityAlert" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a security alert entity. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -24245,7 +24496,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class SecurityAlertProperties(EntityCommonProperties): +class SecurityAlertProperties(EntityCommonProperties): # pylint: disable=docstring-keyword-should-match-keyword-only """SecurityAlert entity property bag. :ivar additional_data: A bag of custom fields that should be part of the entity and will be @@ -24423,7 +24674,9 @@ class SecurityAlertPropertiesConfidenceReasonsItem(_Model): # pylint: disable=n """The type (category) of the reason.""" -class SecurityAlertTimelineItem(EntityTimelineItem, discriminator="SecurityAlert"): +class SecurityAlertTimelineItem( + EntityTimelineItem, discriminator="SecurityAlert" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents security alert timeline item. :ivar azure_resource_id: The alert azure resource id. Required. @@ -24525,7 +24778,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: self.kind = EntityTimelineKind.SECURITY_ALERT # type: ignore -class SecurityGroupEntity(Entity, discriminator="SecurityGroup"): +class SecurityGroupEntity( + Entity, discriminator="SecurityGroup" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a security group entity. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -24619,7 +24874,7 @@ class SecurityGroupEntityProperties(EntityCommonProperties): the group.""" -class SecurityMLAnalyticsSettingsDataSource(_Model): +class SecurityMLAnalyticsSettingsDataSource(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """security ml analytics settings data sources. :ivar connector_id: The connector id that provides the following data types. @@ -24656,7 +24911,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class SentinelEntityMapping(_Model): +class SentinelEntityMapping(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """A single sentinel entity mapping. :ivar column_name: the column name to be mapped to the SentinelEntities. @@ -24686,7 +24941,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class SentinelOnboardingState(ProxyResource): +class SentinelOnboardingState(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """Sentinel onboarding state. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -24752,7 +25007,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class SentinelOnboardingStateProperties(_Model): +class SentinelOnboardingStateProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The Sentinel onboarding state properties. :ivar customer_managed_key: Flag that indicates the status of the CMK setting. @@ -24782,7 +25037,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class SentinelOnboardingStatesList(_Model): +class SentinelOnboardingStatesList(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """List of the Sentinel onboarding states. :ivar value: Array of Sentinel onboarding states. Required. @@ -24812,7 +25067,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ServicePrincipal(_Model): +class ServicePrincipal(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Service principal metadata. :ivar id: Id of service principal. @@ -24854,7 +25109,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class SessionAuthModel(CcpAuthConfig, discriminator="Session"): +class SessionAuthModel( + CcpAuthConfig, discriminator="Session" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Model for API authentication with session cookie. :ivar user_name: The user name attribute key value. Required. @@ -24932,7 +25189,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: self.type = CcpAuthType.SESSION # type: ignore -class SourceControl(ProxyResource): +class SourceControl(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a SourceControl in Azure Security Insights. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -25012,7 +25269,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class SourceControlProperties(_Model): +class SourceControlProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes source control properties. :ivar id: The id (a Guid) of the source control. @@ -25115,7 +25372,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class SubmissionMailEntity(Entity, discriminator="SubmissionMail"): +class SubmissionMailEntity( + Entity, discriminator="SubmissionMail" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a submission mail entity. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -25249,7 +25508,7 @@ class SubmissionMailEntityProperties(EntityCommonProperties): """The submission type for the given instance. This maps to Junk, Phish, Malware or NotJunk.""" -class SystemData(_Model): +class SystemData(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Metadata pertaining to creation and last modification of the resource. :ivar created_by: The identity that created the resource. @@ -25345,7 +25604,7 @@ class TeamInformation(_Model): """The description of the team.""" -class TemplateModel(ProxyResource): +class TemplateModel(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """Template resource definition. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -25439,7 +25698,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class TemplateProperties(_Model): +class TemplateProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Template property bag. :ivar content_id: Static ID for the content. Used to identify dependencies and content from @@ -25671,7 +25930,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ThreatActor(TIObject, discriminator="ThreatActor"): +class ThreatActor(TIObject, discriminator="ThreatActor"): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a threat actor in Azure Security Insights. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -25775,7 +26034,9 @@ class ThreatIntelligence(_Model): """Threat type (e.g. \"Botnet\").""" -class ThreatIntelligenceAlertRule(AlertRule, discriminator="ThreatIntelligence"): +class ThreatIntelligenceAlertRule( + AlertRule, discriminator="ThreatIntelligence" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents Threat Intelligence alert rule. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -25853,7 +26114,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class ThreatIntelligenceAlertRuleProperties(_Model): +class ThreatIntelligenceAlertRuleProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Threat Intelligence alert rule base property bag. :ivar alert_rule_template_name: The Name of the alert rule template used to create this rule. @@ -25921,7 +26182,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ThreatIntelligenceAlertRuleTemplate(AlertRuleTemplate, discriminator="ThreatIntelligence"): +class ThreatIntelligenceAlertRuleTemplate( + AlertRuleTemplate, discriminator="ThreatIntelligence" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents Threat Intelligence alert rule template. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -26000,7 +26263,7 @@ def __setattr__(self, key: str, value: Any) -> None: class ThreatIntelligenceAlertRuleTemplateProperties( AlertRuleTemplateWithMitreProperties -): # pylint: disable=name-too-long +): # pylint: disable=name-too-long,docstring-keyword-should-match-keyword-only """Threat Intelligence alert rule template properties. :ivar alert_rules_created_by_template_count: The number of alert rules that were created by @@ -26060,7 +26323,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ThreatIntelligenceAppendTags(_Model): +class ThreatIntelligenceAppendTags(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Array of tags to be appended to the threat intelligence indicator. :ivar threat_intelligence_tags: List of tags to be appended. @@ -26103,7 +26366,7 @@ class ThreatIntelligenceCount(_Model): Required.""" -class ThreatIntelligenceExternalReference(_Model): +class ThreatIntelligenceExternalReference(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes external reference. :ivar description: External reference description. @@ -26155,7 +26418,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ThreatIntelligenceFilteringCriteria(_Model): +class ThreatIntelligenceFilteringCriteria(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Filtering criteria for querying threat intelligence indicators. :ivar page_size: Page size. @@ -26259,7 +26522,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ThreatIntelligenceGranularMarkingModel(_Model): +class ThreatIntelligenceGranularMarkingModel(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes threat granular marking model entity. :ivar language: Language granular marking model. @@ -26299,7 +26562,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ThreatIntelligenceInformation(ProxyResource): +class ThreatIntelligenceInformation(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """Threat intelligence information object. You probably want to use the sub-classes and not this class directly. Known sub-classes are: @@ -26351,7 +26614,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ThreatIntelligenceIndicatorModel(ThreatIntelligenceInformation, discriminator="indicator"): +class ThreatIntelligenceIndicatorModel( + ThreatIntelligenceInformation, discriminator="indicator" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Threat intelligence indicator entity. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -26450,7 +26715,9 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class ThreatIntelligenceIndicatorProperties(EntityCommonProperties): +class ThreatIntelligenceIndicatorProperties( + EntityCommonProperties +): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes threat intelligence entity properties. :ivar additional_data: A bag of custom fields that should be part of the entity and will be @@ -26655,7 +26922,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ThreatIntelligenceKillChainPhase(_Model): +class ThreatIntelligenceKillChainPhase(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes threat kill chain phase entity. :ivar kill_chain_name: Kill chainName name. @@ -26690,7 +26957,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ThreatIntelligenceMetric(_Model): +class ThreatIntelligenceMetric(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes threat intelligence metric. :ivar last_updated_time_utc: Last updated indicator metric. @@ -26744,7 +27011,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ThreatIntelligenceMetricEntity(_Model): +class ThreatIntelligenceMetricEntity(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes threat intelligence metric entity. :ivar metric_name: Metric name. @@ -26781,7 +27048,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ThreatIntelligenceMetrics(_Model): +class ThreatIntelligenceMetrics(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Threat intelligence metrics. :ivar properties: Threat intelligence metrics. @@ -26811,7 +27078,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ThreatIntelligenceMetricsList(_Model): +class ThreatIntelligenceMetricsList(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """List of all the threat intelligence metric fields (type/threat type/source). :ivar value: Array of threat intelligence metric fields (type/threat type/source). Required. @@ -26841,7 +27108,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ThreatIntelligenceParsedPattern(_Model): +class ThreatIntelligenceParsedPattern(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes parsed pattern entity. :ivar pattern_type_key: Pattern type key. @@ -26879,7 +27146,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ThreatIntelligenceParsedPatternTypeValue(_Model): +class ThreatIntelligenceParsedPatternTypeValue(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes threat kill chain phase entity. :ivar value_type: Type of the value. @@ -26912,7 +27179,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ThreatIntelligenceSortingCriteria(_Model): +class ThreatIntelligenceSortingCriteria(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """List of available columns for sorting. :ivar item_key: Column name. @@ -26950,7 +27217,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class TICheckRequirements(DataConnectorsCheckRequirements, discriminator="ThreatIntelligence"): +class TICheckRequirements( + DataConnectorsCheckRequirements, discriminator="ThreatIntelligence" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Threat Intelligence Platforms data connector check requirements. :ivar properties: Threat Intelligence Platforms data connector check required properties. @@ -27004,7 +27273,9 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class TICheckRequirementsProperties(DataConnectorTenantId): +class TICheckRequirementsProperties( + DataConnectorTenantId +): # pylint: disable=docstring-keyword-should-match-keyword-only """Threat Intelligence Platforms data connector required properties. :ivar tenant_id: The tenant id to connect to, and get the data from. Required. @@ -27029,7 +27300,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class TIDataConnector(DataConnector, discriminator="ThreatIntelligence"): +class TIDataConnector( + DataConnector, discriminator="ThreatIntelligence" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents threat intelligence data connector. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -27097,7 +27370,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class TIDataConnectorDataTypes(_Model): +class TIDataConnectorDataTypes(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The available data types for TI (Threat Intelligence) data connector. :ivar indicators: Data type for indicators connection. Required. @@ -27127,7 +27400,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class TIDataConnectorDataTypesIndicators(DataConnectorDataTypeCommon): +class TIDataConnectorDataTypesIndicators( + DataConnectorDataTypeCommon +): # pylint: disable=docstring-keyword-should-match-keyword-only """Data type for indicators connection. :ivar state: Describe whether this data type connection is enabled or not. Required. Known @@ -27153,7 +27428,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class TIDataConnectorProperties(DataConnectorTenantId): +class TIDataConnectorProperties(DataConnectorTenantId): # pylint: disable=docstring-keyword-should-match-keyword-only """TI (Threat Intelligence) data connector properties. :ivar tenant_id: The tenant id to connect to, and get the data from. Required. @@ -27193,7 +27468,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class TimelineAggregation(_Model): +class TimelineAggregation(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """timeline aggregation information per kind. :ivar count: the total items found for a kind. Required. @@ -27230,7 +27505,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class TimelineError(_Model): +class TimelineError(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Timeline Query Errors. :ivar kind: the query kind. Required. Known values are: "Activity", "Bookmark", @@ -27272,7 +27547,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class TimelineResultsMetadata(_Model): +class TimelineResultsMetadata(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Expansion result metadata. :ivar total_count: the total items found for the timeline request. Required. @@ -27376,7 +27651,9 @@ class TIObjectCommonProperties(_Model): that can be prepended to the object ID in order to efficiently locate the target TI object.""" -class TiTaxiiCheckRequirements(DataConnectorsCheckRequirements, discriminator="ThreatIntelligenceTaxii"): +class TiTaxiiCheckRequirements( + DataConnectorsCheckRequirements, discriminator="ThreatIntelligenceTaxii" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Threat Intelligence TAXII data connector check requirements. :ivar properties: Threat Intelligence TAXII check required properties. @@ -27430,7 +27707,9 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class TiTaxiiCheckRequirementsProperties(DataConnectorTenantId): +class TiTaxiiCheckRequirementsProperties( + DataConnectorTenantId +): # pylint: disable=docstring-keyword-should-match-keyword-only """Threat Intelligence TAXII data connector required properties. :ivar tenant_id: The tenant id to connect to, and get the data from. Required. @@ -27455,7 +27734,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class TiTaxiiDataConnector(DataConnector, discriminator="ThreatIntelligenceTaxii"): +class TiTaxiiDataConnector( + DataConnector, discriminator="ThreatIntelligenceTaxii" +): # pylint: disable=docstring-keyword-should-match-keyword-only """Data connector to pull Threat intelligence data from TAXII 2.0/2.1 server. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -27534,7 +27815,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class TiTaxiiDataConnectorDataTypes(_Model): +class TiTaxiiDataConnectorDataTypes(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The available data types for Threat Intelligence TAXII data connector. :ivar taxii_client: Data type for TAXII connector. Required. @@ -27565,7 +27846,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class TiTaxiiDataConnectorDataTypesTaxiiClient(DataConnectorDataTypeCommon): +class TiTaxiiDataConnectorDataTypesTaxiiClient( + DataConnectorDataTypeCommon +): # pylint: disable=docstring-keyword-should-match-keyword-only """Data type for TAXII connector. :ivar state: Describe whether this data type connection is enabled or not. Required. Known @@ -27591,7 +27874,9 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class TiTaxiiDataConnectorProperties(DataConnectorTenantId): +class TiTaxiiDataConnectorProperties( + DataConnectorTenantId +): # pylint: disable=docstring-keyword-should-match-keyword-only """Threat Intelligence TAXII data connector properties. :ivar tenant_id: The tenant id to connect to, and get the data from. Required. @@ -27679,7 +27964,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class TriggeredAnalyticsRuleRun(ProxyResource): +class TriggeredAnalyticsRuleRun(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """The triggered analytics rule run. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -27751,7 +28036,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class TriggeredAnalyticsRuleRunProperties(_Model): +class TriggeredAnalyticsRuleRunProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The triggered analytics rule run Properties. :ivar execution_time_utc: Required. @@ -27808,7 +28093,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class Ueba(Settings, discriminator="Ueba"): +class Ueba(Settings, discriminator="Ueba"): # pylint: disable=docstring-keyword-should-match-keyword-only """Settings with single toggle. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -27876,7 +28161,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class UebaProperties(_Model): +class UebaProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Ueba property bag. :ivar data_sources: The relevant data sources that enriched by ueba. @@ -27906,7 +28191,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class UrlEntity(Entity, discriminator="Url"): +class UrlEntity(Entity, discriminator="Url"): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a url entity. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -27988,7 +28273,7 @@ class UrlEntityProperties(EntityCommonProperties): """A full URL the entity points to.""" -class UserInfo(_Model): +class UserInfo(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """User information that made some action. :ivar email: The email of the user. @@ -28024,7 +28309,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class ValidationError(_Model): +class ValidationError(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes an error encountered in the file during validation. :ivar record_index: The number of the record that has the error. @@ -28096,7 +28381,7 @@ class WarningBody(_Model): details: Optional[list["_models.WarningBody"]] = rest_field(visibility=["read"]) -class Watchlist(ProxyResource): +class Watchlist(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a Watchlist in Azure Security Insights. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -28185,7 +28470,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class WatchlistItem(ProxyResource): +class WatchlistItem(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """Represents a Watchlist Item in Azure Security Insights. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -28262,7 +28547,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class WatchlistItemProperties(_Model): +class WatchlistItemProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes watchlist item properties. :ivar watchlist_item_type: The type of the watchlist item. @@ -28351,7 +28636,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class WatchlistProperties(_Model): +class WatchlistProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Describes watchlist properties. :ivar watchlist_id: The id (a Guid) of the watchlist. @@ -28403,9 +28688,10 @@ class WatchlistProperties(_Model): :ivar upload_status: The status of the Watchlist upload : New, InProgress or Complete. **Note** : When a Watchlist upload status is InProgress, the Watchlist cannot be deleted. :vartype upload_status: str - :ivar provisioning_state: Describes provisioning state. Known values are: "Accepted", - "InProgress", "Succeeded", "Failed", and "Canceled". - :vartype provisioning_state: str or ~azure.mgmt.securityinsight.models.ProvisioningState + :ivar provisioning_state: Describes provisioning state. Known values are: "New", "InProgress", + "Uploading", "Deleting", "Succeeded", "Failed", and "Canceled". + :vartype provisioning_state: str or + ~azure.mgmt.securityinsight.models.WatchlistProvisioningState """ watchlist_id: Optional[str] = rest_field( @@ -28484,11 +28770,11 @@ class WatchlistProperties(_Model): ) """The status of the Watchlist upload : New, InProgress or Complete. **Note** : When a Watchlist upload status is InProgress, the Watchlist cannot be deleted.""" - provisioning_state: Optional[Union[str, "_models.ProvisioningState"]] = rest_field( + provisioning_state: Optional[Union[str, "_models.WatchlistProvisioningState"]] = rest_field( name="provisioningState", visibility=["read"] ) - """Describes provisioning state. Known values are: \"Accepted\", \"InProgress\", \"Succeeded\", - \"Failed\", and \"Canceled\".""" + """Describes provisioning state. Known values are: \"New\", \"InProgress\", \"Uploading\", + \"Deleting\", \"Succeeded\", \"Failed\", and \"Canceled\".""" @overload def __init__( @@ -28528,7 +28814,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class Webhook(_Model): +class Webhook(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """Detail about the webhook object. :ivar webhook_id: Unique identifier for the webhook. @@ -28599,7 +28885,7 @@ class WorkloadIdentityFederation(_Model): """Issuer of Workload Identity Federation.""" -class WorkspaceManagerAssignment(ProxyResource): +class WorkspaceManagerAssignment(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """The workspace manager assignment. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -28664,7 +28950,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class WorkspaceManagerAssignmentProperties(_Model): +class WorkspaceManagerAssignmentProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The workspace manager assignment properties. :ivar target_resource_name: The resource name of the workspace manager group targeted by the @@ -28673,9 +28959,9 @@ class WorkspaceManagerAssignmentProperties(_Model): :ivar last_job_end_time: The time the last job associated to this assignment ended at. :vartype last_job_end_time: ~datetime.datetime :ivar last_job_provisioning_state: State of the last job associated to this assignment. Known - values are: "Accepted", "InProgress", "Succeeded", "Failed", and "Canceled". + values are: "Succeeded", "InProgress", "Canceled", and "Failed". :vartype last_job_provisioning_state: str or - ~azure.mgmt.securityinsight.models.ProvisioningState + ~azure.mgmt.securityinsight.models.JobProvisioningState :ivar items_property: List of resources included in this workspace manager assignment. Required. :vartype items_property: list[~azure.mgmt.securityinsight.models.AssignmentItem] @@ -28690,11 +28976,11 @@ class WorkspaceManagerAssignmentProperties(_Model): name="lastJobEndTime", visibility=["read"], format="rfc3339" ) """The time the last job associated to this assignment ended at.""" - last_job_provisioning_state: Optional[Union[str, "_models.ProvisioningState"]] = rest_field( + last_job_provisioning_state: Optional[Union[str, "_models.JobProvisioningState"]] = rest_field( name="lastJobProvisioningState", visibility=["read"] ) - """State of the last job associated to this assignment. Known values are: \"Accepted\", - \"InProgress\", \"Succeeded\", \"Failed\", and \"Canceled\".""" + """State of the last job associated to this assignment. Known values are: \"Succeeded\", + \"InProgress\", \"Canceled\", and \"Failed\".""" items_property: list["_models.AssignmentItem"] = rest_field( name="items", visibility=["read", "create", "update", "delete", "query"], original_tsp_name="items" ) @@ -28719,7 +29005,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class WorkspaceManagerConfiguration(ProxyResource): +class WorkspaceManagerConfiguration(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """The workspace manager configuration. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -28784,7 +29070,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class WorkspaceManagerConfigurationProperties(_Model): +class WorkspaceManagerConfigurationProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The workspace manager configuration properties. :ivar mode: The current mode of the workspace manager configuration. Required. Known values @@ -28814,7 +29100,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class WorkspaceManagerGroup(ProxyResource): +class WorkspaceManagerGroup(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """The workspace manager group. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -28879,7 +29165,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class WorkspaceManagerGroupProperties(_Model): +class WorkspaceManagerGroupProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The workspace manager group properties. :ivar description: The description of the workspace manager group. @@ -28920,7 +29206,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) -class WorkspaceManagerMember(ProxyResource): +class WorkspaceManagerMember(ProxyResource): # pylint: disable=docstring-keyword-should-match-keyword-only """The workspace manager member. :ivar id: Fully qualified resource ID for the resource. Ex - @@ -28985,7 +29271,7 @@ def __setattr__(self, key: str, value: Any) -> None: super().__setattr__(key, value) -class WorkspaceManagerMemberProperties(_Model): +class WorkspaceManagerMemberProperties(_Model): # pylint: disable=docstring-keyword-should-match-keyword-only """The workspace manager member properties. :ivar target_workspace_resource_id: Fully qualified resource ID of the target Sentinel diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/operations/_operations.py b/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/operations/_operations.py index 2d997060834b..b1bfbbd1c4f5 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/operations/_operations.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/operations/_operations.py @@ -32,15 +32,15 @@ from azure.mgmt.core.exceptions import ARMErrorFormat from azure.mgmt.core.polling.arm_polling import ARMPolling -from .. import models as _models +from .. import models as _models, types as _types from .._configuration import SecurityInsightsMgmtClientConfiguration from .._utils.model_base import SdkJSONEncoder, _deserialize, _failsafe_deserialize from .._utils.serialization import Deserializer, Serializer from .._utils.utils import ClientMixinABC +from .._validation import api_version_validation T = TypeVar("T") ClsType = Optional[Callable[[PipelineResponse[HttpRequest, HttpResponse], T, dict[str, Any]], Any]] -JSON = MutableMapping[str, Any] List = list _SERIALIZER = Serializer() @@ -51,7 +51,7 @@ def build_operations_list_request(**kwargs: Any) -> HttpRequest: _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -72,7 +72,7 @@ def build_alert_rules_get_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -102,7 +102,7 @@ def build_alert_rules_create_or_update_request( # pylint: disable=name-too-long _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -132,7 +132,7 @@ def build_alert_rules_delete_request( ) -> HttpRequest: _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules/{ruleId}" path_format_arguments = { @@ -156,7 +156,7 @@ def build_alert_rules_list_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -184,7 +184,7 @@ def build_alert_rule_templates_get_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -213,7 +213,7 @@ def build_alert_rule_templates_list_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -241,7 +241,7 @@ def build_automation_rules_get_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -271,7 +271,7 @@ def build_automation_rules_create_or_update_request( # pylint: disable=name-too _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -302,7 +302,7 @@ def build_automation_rules_delete_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -331,7 +331,7 @@ def build_automation_rules_list_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -359,7 +359,7 @@ def build_incidents_get_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -389,7 +389,7 @@ def build_incidents_create_or_update_request( _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -419,7 +419,7 @@ def build_incidents_delete_request( ) -> HttpRequest: _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}" path_format_arguments = { @@ -451,7 +451,7 @@ def build_incidents_list_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -488,7 +488,7 @@ def build_incidents_run_playbook_request( _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -519,7 +519,7 @@ def build_incidents_list_alerts_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -548,7 +548,7 @@ def build_incidents_list_bookmarks_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -577,7 +577,7 @@ def build_incidents_list_entities_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -606,7 +606,7 @@ def build_bookmarks_get_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -636,7 +636,7 @@ def build_bookmarks_create_or_update_request( _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -666,7 +666,7 @@ def build_bookmarks_delete_request( ) -> HttpRequest: _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/bookmarks/{bookmarkId}" path_format_arguments = { @@ -690,7 +690,7 @@ def build_bookmarks_list_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -722,7 +722,7 @@ def build_data_connector_definitions_get_request( # pylint: disable=name-too-lo _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -758,7 +758,7 @@ def build_data_connector_definitions_create_or_update_request( # pylint: disabl _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -794,7 +794,7 @@ def build_data_connector_definitions_delete_request( # pylint: disable=name-too ) -> HttpRequest: _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectorDefinitions/{dataConnectorDefinitionName}" path_format_arguments = { @@ -820,7 +820,7 @@ def build_data_connector_definitions_list_request( # pylint: disable=name-too-l _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -848,7 +848,7 @@ def build_data_connectors_get_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -878,7 +878,7 @@ def build_data_connectors_create_or_update_request( # pylint: disable=name-too- _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -908,7 +908,7 @@ def build_data_connectors_delete_request( ) -> HttpRequest: _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors/{dataConnectorId}" path_format_arguments = { @@ -932,7 +932,7 @@ def build_data_connectors_list_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -961,7 +961,7 @@ def build_data_connectors_connect_request( _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors/{dataConnectorId}/connect" path_format_arguments = { @@ -988,7 +988,7 @@ def build_data_connectors_disconnect_request( ) -> HttpRequest: _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors/{dataConnectorId}/disconnect" path_format_arguments = { @@ -1017,7 +1017,7 @@ def build_incident_comments_get_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -1053,7 +1053,7 @@ def build_incident_comments_create_or_update_request( # pylint: disable=name-to _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -1089,7 +1089,7 @@ def build_incident_comments_delete_request( ) -> HttpRequest: _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/comments/{incidentCommentId}" path_format_arguments = { @@ -1123,7 +1123,7 @@ def build_incident_comments_list_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -1165,7 +1165,7 @@ def build_bookmark_relations_get_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -1201,7 +1201,7 @@ def build_bookmark_relations_create_or_update_request( # pylint: disable=name-t _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -1237,7 +1237,7 @@ def build_bookmark_relations_delete_request( ) -> HttpRequest: _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/bookmarks/{bookmarkId}/relations/{relationName}" path_format_arguments = { @@ -1271,7 +1271,7 @@ def build_bookmark_relations_list_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -1313,7 +1313,7 @@ def build_entity_relations_get_relation_request( # pylint: disable=name-too-lon _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -1348,7 +1348,7 @@ def build_incident_tasks_get_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -1384,7 +1384,7 @@ def build_incident_tasks_create_or_update_request( # pylint: disable=name-too-l _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -1420,7 +1420,7 @@ def build_incident_tasks_delete_request( ) -> HttpRequest: _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/tasks/{incidentTaskId}" path_format_arguments = { @@ -1445,7 +1445,7 @@ def build_incident_tasks_list_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -1478,7 +1478,7 @@ def build_sentinel_onboarding_states_get_request( # pylint: disable=name-too-lo _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -1514,7 +1514,7 @@ def build_sentinel_onboarding_states_create_request( # pylint: disable=name-too _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -1550,7 +1550,7 @@ def build_sentinel_onboarding_states_delete_request( # pylint: disable=name-too ) -> HttpRequest: _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/onboardingStates/{sentinelOnboardingStateName}" path_format_arguments = { @@ -1576,7 +1576,7 @@ def build_sentinel_onboarding_states_list_request( # pylint: disable=name-too-l _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -1604,7 +1604,7 @@ def build_security_ml_analytics_settings_get_request( # pylint: disable=name-to _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -1634,7 +1634,7 @@ def build_security_ml_analytics_settings_create_or_update_request( # pylint: di _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -1664,7 +1664,7 @@ def build_security_ml_analytics_settings_delete_request( # pylint: disable=name ) -> HttpRequest: _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/securityMLAnalyticsSettings/{settingsResourceName}" path_format_arguments = { @@ -1688,7 +1688,7 @@ def build_security_ml_analytics_settings_list_request( # pylint: disable=name-t _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -1716,7 +1716,7 @@ def build_source_controls_get_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -1746,7 +1746,7 @@ def build_source_controls_create_request( _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -1777,7 +1777,7 @@ def build_source_controls_list_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -1806,7 +1806,7 @@ def build_source_controls_delete_request( _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -1837,7 +1837,7 @@ def build_watchlists_get_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -1867,7 +1867,7 @@ def build_watchlists_create_or_update_request( # pylint: disable=name-too-long _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -1897,7 +1897,7 @@ def build_watchlists_delete_request( ) -> HttpRequest: _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/watchlists/{watchlistAlias}" path_format_arguments = { @@ -1926,7 +1926,7 @@ def build_watchlists_list_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -1961,7 +1961,7 @@ def build_watchlist_items_get_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -1997,7 +1997,7 @@ def build_watchlist_items_create_or_update_request( # pylint: disable=name-too- _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -2033,7 +2033,7 @@ def build_watchlist_items_delete_request( ) -> HttpRequest: _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/watchlists/{watchlistAlias}/watchlistItems/{watchlistItemId}" path_format_arguments = { @@ -2064,7 +2064,7 @@ def build_watchlist_items_list_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -2095,7 +2095,7 @@ def build_billing_statistics_get_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -2124,7 +2124,7 @@ def build_billing_statistics_list_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -2152,7 +2152,7 @@ def build_entities_get_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -2181,7 +2181,7 @@ def build_entities_list_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -2210,7 +2210,7 @@ def build_entities_run_playbook_request( _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/entities/{entityIdentifier}/runPlaybook" path_format_arguments = { @@ -2239,7 +2239,7 @@ def build_entities_expand_request( _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -2276,7 +2276,7 @@ def build_entities_queries_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -2307,7 +2307,7 @@ def build_entities_get_insights_request( _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -2338,7 +2338,7 @@ def build_entity_queries_get_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -2368,7 +2368,7 @@ def build_entity_queries_create_or_update_request( # pylint: disable=name-too-l _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -2398,7 +2398,7 @@ def build_entity_queries_delete_request( ) -> HttpRequest: _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/entityQueries/{entityQueryId}" path_format_arguments = { @@ -2427,7 +2427,7 @@ def build_entity_queries_list_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -2457,7 +2457,7 @@ def build_entity_query_templates_get_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -2491,7 +2491,7 @@ def build_entity_query_templates_list_request( # pylint: disable=name-too-long _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -2521,7 +2521,7 @@ def build_file_imports_get_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -2551,7 +2551,7 @@ def build_file_imports_create_request( _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -2582,7 +2582,7 @@ def build_file_imports_delete_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -2619,7 +2619,7 @@ def build_file_imports_list_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -2655,7 +2655,7 @@ def build_hunts_get_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -2685,7 +2685,7 @@ def build_hunts_create_or_update_request( _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -2715,7 +2715,7 @@ def build_hunts_delete_request( ) -> HttpRequest: _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/hunts/{huntId}" path_format_arguments = { @@ -2747,7 +2747,7 @@ def build_hunts_list_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -2788,7 +2788,7 @@ def build_hunt_comments_get_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -2824,7 +2824,7 @@ def build_hunt_comments_create_or_update_request( # pylint: disable=name-too-lo _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -2860,7 +2860,7 @@ def build_hunt_comments_delete_request( ) -> HttpRequest: _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/hunts/{huntId}/comments/{huntCommentId}" path_format_arguments = { @@ -2894,7 +2894,7 @@ def build_hunt_comments_list_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -2936,7 +2936,7 @@ def build_hunt_relations_get_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -2972,7 +2972,7 @@ def build_hunt_relations_create_or_update_request( # pylint: disable=name-too-l _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -3008,7 +3008,7 @@ def build_hunt_relations_delete_request( ) -> HttpRequest: _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/hunts/{huntId}/relations/{huntRelationId}" path_format_arguments = { @@ -3042,7 +3042,7 @@ def build_hunt_relations_list_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -3079,7 +3079,7 @@ def build_office_consents_get_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -3107,7 +3107,7 @@ def build_office_consents_delete_request( ) -> HttpRequest: _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/officeConsents/{consentId}" path_format_arguments = { @@ -3131,7 +3131,7 @@ def build_office_consents_list_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -3159,7 +3159,7 @@ def build_product_settings_get_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -3189,7 +3189,7 @@ def build_product_settings_update_request( _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -3219,7 +3219,7 @@ def build_product_settings_delete_request( ) -> HttpRequest: _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/settings/{settingsName}" path_format_arguments = { @@ -3243,7 +3243,7 @@ def build_product_settings_list_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -3275,7 +3275,7 @@ def build_workspace_manager_assignments_get_request( # pylint: disable=name-too _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -3311,7 +3311,7 @@ def build_workspace_manager_assignments_create_or_update_request( # pylint: dis _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -3347,7 +3347,7 @@ def build_workspace_manager_assignments_delete_request( # pylint: disable=name- ) -> HttpRequest: _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/workspaceManagerAssignments/{workspaceManagerAssignmentName}" path_format_arguments = { @@ -3380,7 +3380,7 @@ def build_workspace_manager_assignments_list_request( # pylint: disable=name-to _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -3418,7 +3418,7 @@ def build_workspace_manager_configurations_get_request( # pylint: disable=name- _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -3454,7 +3454,7 @@ def build_workspace_manager_configurations_create_or_update_request( # pylint: _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -3490,7 +3490,7 @@ def build_workspace_manager_configurations_delete_request( # pylint: disable=na ) -> HttpRequest: _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/workspaceManagerConfigurations/{workspaceManagerConfigurationName}" path_format_arguments = { @@ -3523,7 +3523,7 @@ def build_workspace_manager_configurations_list_request( # pylint: disable=name _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -3561,7 +3561,7 @@ def build_workspace_manager_groups_get_request( # pylint: disable=name-too-long _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -3597,7 +3597,7 @@ def build_workspace_manager_groups_create_or_update_request( # pylint: disable= _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -3633,7 +3633,7 @@ def build_workspace_manager_groups_delete_request( # pylint: disable=name-too-l ) -> HttpRequest: _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/workspaceManagerGroups/{workspaceManagerGroupName}" path_format_arguments = { @@ -3666,7 +3666,7 @@ def build_workspace_manager_groups_list_request( # pylint: disable=name-too-lon _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -3704,7 +3704,7 @@ def build_workspace_manager_members_get_request( # pylint: disable=name-too-lon _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -3740,7 +3740,7 @@ def build_workspace_manager_members_create_or_update_request( # pylint: disable _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -3776,7 +3776,7 @@ def build_workspace_manager_members_delete_request( # pylint: disable=name-too- ) -> HttpRequest: _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/workspaceManagerMembers/{workspaceManagerMemberName}" path_format_arguments = { @@ -3809,7 +3809,7 @@ def build_workspace_manager_members_list_request( # pylint: disable=name-too-lo _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -3844,7 +3844,7 @@ def build_alert_rule_trigger_rule_run_request( # pylint: disable=name-too-long _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules/{ruleId}/triggerRuleRun" path_format_arguments = { @@ -3872,7 +3872,7 @@ def build_actions_get_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -3903,7 +3903,7 @@ def build_actions_create_or_update_request( _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -3934,7 +3934,7 @@ def build_actions_delete_request( ) -> HttpRequest: _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules/{ruleId}/actions/{actionId}" path_format_arguments = { @@ -3959,7 +3959,7 @@ def build_actions_list_by_alert_rule_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -3989,7 +3989,7 @@ def build_bookmark_expand_request( _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -4020,7 +4020,7 @@ def build_content_packages_get_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -4060,7 +4060,7 @@ def build_content_packages_list_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -4103,7 +4103,7 @@ def build_content_package_install_request( _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -4133,7 +4133,7 @@ def build_content_package_uninstall_request( ) -> HttpRequest: _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/contentPackages/{packageId}" path_format_arguments = { @@ -4157,7 +4157,7 @@ def build_product_package_get_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -4195,7 +4195,7 @@ def build_product_packages_list_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -4233,7 +4233,7 @@ def build_product_template_get_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -4273,7 +4273,7 @@ def build_product_templates_list_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -4315,7 +4315,7 @@ def build_content_template_get_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -4345,7 +4345,7 @@ def build_content_template_install_request( _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -4375,7 +4375,7 @@ def build_content_template_delete_request( ) -> HttpRequest: _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/contentTemplates/{templateId}" path_format_arguments = { @@ -4411,7 +4411,7 @@ def build_content_templates_list_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -4460,7 +4460,7 @@ def build_incident_relations_get_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -4496,7 +4496,7 @@ def build_incident_relations_create_or_update_request( # pylint: disable=name-t _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -4532,7 +4532,7 @@ def build_incident_relations_delete_request( ) -> HttpRequest: _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/relations/{relationName}" path_format_arguments = { @@ -4566,7 +4566,7 @@ def build_incident_relations_list_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -4612,7 +4612,7 @@ def build_entities_relations_list_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -4649,7 +4649,7 @@ def build_metadata_get_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -4679,7 +4679,7 @@ def build_metadata_create_request( _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -4711,7 +4711,7 @@ def build_metadata_update_request( _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -4741,7 +4741,7 @@ def build_metadata_delete_request( ) -> HttpRequest: _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/metadata/{metadataName}" path_format_arguments = { @@ -4773,7 +4773,7 @@ def build_metadata_list_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -4809,7 +4809,7 @@ def build_threat_intelligence_indicator_get_request( # pylint: disable=name-too _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -4839,7 +4839,7 @@ def build_threat_intelligence_indicator_create_request( # pylint: disable=name- _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -4869,7 +4869,7 @@ def build_threat_intelligence_indicator_delete_request( # pylint: disable=name- ) -> HttpRequest: _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/threatIntelligence/main/indicators/{name}" path_format_arguments = { @@ -4894,7 +4894,7 @@ def build_threat_intelligence_indicator_append_tags_request( # pylint: disable= _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/threatIntelligence/main/indicators/{name}/appendTags" path_format_arguments = { @@ -4923,7 +4923,7 @@ def build_threat_intelligence_indicator_replace_tags_request( # pylint: disable _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -4955,7 +4955,7 @@ def build_threat_intelligence_indicator_create_indicator_request( # pylint: dis _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -4986,7 +4986,7 @@ def build_threat_intelligence_indicator_query_indicators_request( # pylint: dis _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -5024,7 +5024,7 @@ def build_threat_intelligence_indicators_list_request( # pylint: disable=name-t _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -5061,7 +5061,7 @@ def build_data_connectors_check_requirements_post_request( # pylint: disable=na _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -5092,7 +5092,7 @@ def build_source_control_list_repositories_request( # pylint: disable=name-too- _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -5122,7 +5122,7 @@ def build_threat_intelligence_indicator_metrics_list_request( # pylint: disable _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -5155,7 +5155,7 @@ def build_threat_intelligence_count_request( _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -5191,7 +5191,7 @@ def build_threat_intelligence_query_request( _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -5223,7 +5223,7 @@ def build_entities_get_timeline_list_request( _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -5254,7 +5254,7 @@ def build_get_single_recommendation_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -5284,7 +5284,7 @@ def build_update_recommendation_request( _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -5315,7 +5315,7 @@ def build_get_recommendations_list_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -5343,7 +5343,7 @@ def build_reevaluate_recommendation_request( _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -5372,7 +5372,7 @@ def build_triggered_analytics_rule_run_get_request( # pylint: disable=name-too- _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -5401,7 +5401,7 @@ def build_get_triggered_analytics_rule_runs_list_request( # pylint: disable=nam _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -5433,7 +5433,7 @@ def build_workspace_manager_assignment_jobs_create_request( # pylint: disable=n _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -5469,7 +5469,7 @@ def build_workspace_manager_assignment_jobs_get_request( # pylint: disable=name _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -5505,7 +5505,7 @@ def build_workspace_manager_assignment_jobs_delete_request( # pylint: disable=n ) -> HttpRequest: _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) # Construct URL _url = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/workspaceManagerAssignments/{workspaceManagerAssignmentName}/jobs/{jobName}" path_format_arguments = { @@ -5540,7 +5540,7 @@ def build_workspace_manager_assignment_jobs_list_request( # pylint: disable=nam _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -5582,7 +5582,7 @@ def build_security_insights_mgmt_list_geodata_by_ip_request( # pylint: disable= _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -5618,7 +5618,7 @@ def build_security_insights_mgmt_list_whois_by_domain_request( # pylint: disabl _params = case_insensitive_dict(kwargs.pop("params", {}) or {}) content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-07-01-preview")) + api_version: str = kwargs.pop("api_version", _params.pop("api-version", "2025-10-01-preview")) accept = _headers.pop("Accept", "application/json") # Construct URL @@ -5643,7 +5643,7 @@ def build_security_insights_mgmt_list_whois_by_domain_request( # pylint: disabl return HttpRequest(method="POST", url=_url, params=_params, headers=_headers, **kwargs) -class Operations: +class Operations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -5755,7 +5755,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class AlertRulesOperations: +class AlertRulesOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -5883,7 +5883,7 @@ def create_or_update( resource_group_name: str, workspace_name: str, rule_id: str, - alert_rule: JSON, + alert_rule: _types.AlertRule, *, content_type: str = "application/json", **kwargs: Any @@ -5898,7 +5898,7 @@ def create_or_update( :param rule_id: Alert rule ID. Required. :type rule_id: str :param alert_rule: The alert rule. Required. - :type alert_rule: JSON + :type alert_rule: ~azure.mgmt.securityinsight.types.AlertRule :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -5943,7 +5943,7 @@ def create_or_update( resource_group_name: str, workspace_name: str, rule_id: str, - alert_rule: Union[_models.AlertRule, JSON, IO[bytes]], + alert_rule: Union[_models.AlertRule, _types.AlertRule, IO[bytes]], **kwargs: Any ) -> _models.AlertRule: """Creates or updates the alert rule. @@ -5955,9 +5955,9 @@ def create_or_update( :type workspace_name: str :param rule_id: Alert rule ID. Required. :type rule_id: str - :param alert_rule: The alert rule. Is one of the following types: AlertRule, JSON, IO[bytes] - Required. - :type alert_rule: ~azure.mgmt.securityinsight.models.AlertRule or JSON or IO[bytes] + :param alert_rule: The alert rule. Is either a AlertRule type or a IO[bytes] type. Required. + :type alert_rule: ~azure.mgmt.securityinsight.models.AlertRule or + ~azure.mgmt.securityinsight.types.AlertRule or IO[bytes] :return: AlertRule. The AlertRule is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.AlertRule :raises ~azure.core.exceptions.HttpResponseError: @@ -6193,7 +6193,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class AlertRuleTemplatesOperations: +class AlertRuleTemplatesOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -6390,7 +6390,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class AutomationRulesOperations: +class AutomationRulesOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -6520,7 +6520,7 @@ def create_or_update( resource_group_name: str, workspace_name: str, automation_rule_id: str, - automation_rule_to_upsert: Optional[JSON] = None, + automation_rule_to_upsert: Optional[_types.AutomationRule] = None, *, content_type: str = "application/json", **kwargs: Any @@ -6535,7 +6535,7 @@ def create_or_update( :param automation_rule_id: The automation rule ID. Required. :type automation_rule_id: str :param automation_rule_to_upsert: The automation rule. Default value is None. - :type automation_rule_to_upsert: JSON + :type automation_rule_to_upsert: ~azure.mgmt.securityinsight.types.AutomationRule :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -6580,7 +6580,7 @@ def create_or_update( resource_group_name: str, workspace_name: str, automation_rule_id: str, - automation_rule_to_upsert: Optional[Union[_models.AutomationRule, JSON, IO[bytes]]] = None, + automation_rule_to_upsert: Optional[Union[_models.AutomationRule, _types.AutomationRule, IO[bytes]]] = None, **kwargs: Any ) -> _models.AutomationRule: """Creates or updates the automation rule. @@ -6592,10 +6592,10 @@ def create_or_update( :type workspace_name: str :param automation_rule_id: The automation rule ID. Required. :type automation_rule_id: str - :param automation_rule_to_upsert: The automation rule. Is one of the following types: - AutomationRule, JSON, IO[bytes] Default value is None. - :type automation_rule_to_upsert: ~azure.mgmt.securityinsight.models.AutomationRule or JSON or - IO[bytes] + :param automation_rule_to_upsert: The automation rule. Is either a AutomationRule type or a + IO[bytes] type. Default value is None. + :type automation_rule_to_upsert: ~azure.mgmt.securityinsight.models.AutomationRule or + ~azure.mgmt.securityinsight.types.AutomationRule or IO[bytes] :return: AutomationRule. The AutomationRule is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.AutomationRule :raises ~azure.core.exceptions.HttpResponseError: @@ -6846,7 +6846,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class IncidentsOperations: +class IncidentsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -6974,7 +6974,7 @@ def create_or_update( resource_group_name: str, workspace_name: str, incident_id: str, - incident: JSON, + incident: _types.Incident, *, content_type: str = "application/json", **kwargs: Any @@ -6989,7 +6989,7 @@ def create_or_update( :param incident_id: Incident ID. Required. :type incident_id: str :param incident: The incident. Required. - :type incident: JSON + :type incident: ~azure.mgmt.securityinsight.types.Incident :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -7034,7 +7034,7 @@ def create_or_update( resource_group_name: str, workspace_name: str, incident_id: str, - incident: Union[_models.Incident, JSON, IO[bytes]], + incident: Union[_models.Incident, _types.Incident, IO[bytes]], **kwargs: Any ) -> _models.Incident: """Creates or updates an incident. @@ -7046,9 +7046,9 @@ def create_or_update( :type workspace_name: str :param incident_id: Incident ID. Required. :type incident_id: str - :param incident: The incident. Is one of the following types: Incident, JSON, IO[bytes] - Required. - :type incident: ~azure.mgmt.securityinsight.models.Incident or JSON or IO[bytes] + :param incident: The incident. Is either a Incident type or a IO[bytes] type. Required. + :type incident: ~azure.mgmt.securityinsight.models.Incident or + ~azure.mgmt.securityinsight.types.Incident or IO[bytes] :return: Incident. The Incident is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.Incident :raises ~azure.core.exceptions.HttpResponseError: @@ -7346,7 +7346,7 @@ def run_playbook( resource_group_name: str, workspace_name: str, incident_identifier: str, - request_body: Optional[JSON] = None, + request_body: Optional[_types.ManualTriggerRequestBody] = None, *, content_type: str = "application/json", **kwargs: Any @@ -7362,7 +7362,7 @@ def run_playbook( :type incident_identifier: str :param request_body: Describes the request body for triggering a playbook on an incident. Default value is None. - :type request_body: JSON + :type request_body: ~azure.mgmt.securityinsight.types.ManualTriggerRequestBody :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -7408,7 +7408,9 @@ def run_playbook( resource_group_name: str, workspace_name: str, incident_identifier: str, - request_body: Optional[Union[_models.ManualTriggerRequestBody, JSON, IO[bytes]]] = None, + request_body: Optional[ + Union[_models.ManualTriggerRequestBody, _types.ManualTriggerRequestBody, IO[bytes]] + ] = None, **kwargs: Any ) -> Any: """Triggers playbook on a specific incident. @@ -7421,9 +7423,9 @@ def run_playbook( :param incident_identifier: The incident identifier. Required. :type incident_identifier: str :param request_body: Describes the request body for triggering a playbook on an incident. Is - one of the following types: ManualTriggerRequestBody, JSON, IO[bytes] Default value is None. - :type request_body: ~azure.mgmt.securityinsight.models.ManualTriggerRequestBody or JSON or - IO[bytes] + either a ManualTriggerRequestBody type or a IO[bytes] type. Default value is None. + :type request_body: ~azure.mgmt.securityinsight.models.ManualTriggerRequestBody or + ~azure.mgmt.securityinsight.types.ManualTriggerRequestBody or IO[bytes] :return: any :rtype: any :raises ~azure.core.exceptions.HttpResponseError: @@ -7727,7 +7729,7 @@ def list_entities( return deserialized # type: ignore -class BookmarksOperations: +class BookmarksOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -7855,7 +7857,7 @@ def create_or_update( resource_group_name: str, workspace_name: str, bookmark_id: str, - bookmark: JSON, + bookmark: _types.Bookmark, *, content_type: str = "application/json", **kwargs: Any @@ -7870,7 +7872,7 @@ def create_or_update( :param bookmark_id: Bookmark ID. Required. :type bookmark_id: str :param bookmark: The bookmark. Required. - :type bookmark: JSON + :type bookmark: ~azure.mgmt.securityinsight.types.Bookmark :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -7915,7 +7917,7 @@ def create_or_update( resource_group_name: str, workspace_name: str, bookmark_id: str, - bookmark: Union[_models.Bookmark, JSON, IO[bytes]], + bookmark: Union[_models.Bookmark, _types.Bookmark, IO[bytes]], **kwargs: Any ) -> _models.Bookmark: """Creates or updates the bookmark. @@ -7927,9 +7929,9 @@ def create_or_update( :type workspace_name: str :param bookmark_id: Bookmark ID. Required. :type bookmark_id: str - :param bookmark: The bookmark. Is one of the following types: Bookmark, JSON, IO[bytes] - Required. - :type bookmark: ~azure.mgmt.securityinsight.models.Bookmark or JSON or IO[bytes] + :param bookmark: The bookmark. Is either a Bookmark type or a IO[bytes] type. Required. + :type bookmark: ~azure.mgmt.securityinsight.models.Bookmark or + ~azure.mgmt.securityinsight.types.Bookmark or IO[bytes] :return: Bookmark. The Bookmark is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.Bookmark :raises ~azure.core.exceptions.HttpResponseError: @@ -8165,7 +8167,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class DataConnectorDefinitionsOperations: +class DataConnectorDefinitionsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -8295,7 +8297,7 @@ def create_or_update( resource_group_name: str, workspace_name: str, data_connector_definition_name: str, - connector_definition_input: JSON, + connector_definition_input: _types.DataConnectorDefinition, *, content_type: str = "application/json", **kwargs: Any @@ -8310,7 +8312,7 @@ def create_or_update( :param data_connector_definition_name: The data connector definition name. Required. :type data_connector_definition_name: str :param connector_definition_input: The data connector definition. Required. - :type connector_definition_input: JSON + :type connector_definition_input: ~azure.mgmt.securityinsight.types.DataConnectorDefinition :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -8355,7 +8357,7 @@ def create_or_update( resource_group_name: str, workspace_name: str, data_connector_definition_name: str, - connector_definition_input: Union[_models.DataConnectorDefinition, JSON, IO[bytes]], + connector_definition_input: Union[_models.DataConnectorDefinition, _types.DataConnectorDefinition, IO[bytes]], **kwargs: Any ) -> _models.DataConnectorDefinition: """Creates or updates the data connector definition. @@ -8367,10 +8369,10 @@ def create_or_update( :type workspace_name: str :param data_connector_definition_name: The data connector definition name. Required. :type data_connector_definition_name: str - :param connector_definition_input: The data connector definition. Is one of the following - types: DataConnectorDefinition, JSON, IO[bytes] Required. + :param connector_definition_input: The data connector definition. Is either a + DataConnectorDefinition type or a IO[bytes] type. Required. :type connector_definition_input: ~azure.mgmt.securityinsight.models.DataConnectorDefinition or - JSON or IO[bytes] + ~azure.mgmt.securityinsight.types.DataConnectorDefinition or IO[bytes] :return: DataConnectorDefinition. The DataConnectorDefinition is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.DataConnectorDefinition :raises ~azure.core.exceptions.HttpResponseError: @@ -8609,7 +8611,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class DataConnectorsOperations: +class DataConnectorsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -8739,7 +8741,7 @@ def create_or_update( resource_group_name: str, workspace_name: str, data_connector_id: str, - data_connector: JSON, + data_connector: _types.DataConnector, *, content_type: str = "application/json", **kwargs: Any @@ -8754,7 +8756,7 @@ def create_or_update( :param data_connector_id: Connector ID. Required. :type data_connector_id: str :param data_connector: The data connector. Required. - :type data_connector: JSON + :type data_connector: ~azure.mgmt.securityinsight.types.DataConnector :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -8799,7 +8801,7 @@ def create_or_update( resource_group_name: str, workspace_name: str, data_connector_id: str, - data_connector: Union[_models.DataConnector, JSON, IO[bytes]], + data_connector: Union[_models.DataConnector, _types.DataConnector, IO[bytes]], **kwargs: Any ) -> _models.DataConnector: """Creates or updates the data connector. @@ -8811,9 +8813,10 @@ def create_or_update( :type workspace_name: str :param data_connector_id: Connector ID. Required. :type data_connector_id: str - :param data_connector: The data connector. Is one of the following types: DataConnector, JSON, - IO[bytes] Required. - :type data_connector: ~azure.mgmt.securityinsight.models.DataConnector or JSON or IO[bytes] + :param data_connector: The data connector. Is either a DataConnector type or a IO[bytes] type. + Required. + :type data_connector: ~azure.mgmt.securityinsight.models.DataConnector or + ~azure.mgmt.securityinsight.types.DataConnector or IO[bytes] :return: DataConnector. The DataConnector is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.DataConnector :raises ~azure.core.exceptions.HttpResponseError: @@ -9084,7 +9087,7 @@ def connect( resource_group_name: str, workspace_name: str, data_connector_id: str, - connect_body: JSON, + connect_body: _types.DataConnectorConnectBody, *, content_type: str = "application/json", **kwargs: Any @@ -9099,7 +9102,7 @@ def connect( :param data_connector_id: Connector ID. Required. :type data_connector_id: str :param connect_body: The content of the action request. Required. - :type connect_body: JSON + :type connect_body: ~azure.mgmt.securityinsight.types.DataConnectorConnectBody :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -9139,12 +9142,26 @@ def connect( """ @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "data_connector_id", + "content_type", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def connect( # pylint: disable=inconsistent-return-statements self, resource_group_name: str, workspace_name: str, data_connector_id: str, - connect_body: Union[_models.DataConnectorConnectBody, JSON, IO[bytes]], + connect_body: Union[_models.DataConnectorConnectBody, _types.DataConnectorConnectBody, IO[bytes]], **kwargs: Any ) -> None: """Connects a data connector. @@ -9156,10 +9173,10 @@ def connect( # pylint: disable=inconsistent-return-statements :type workspace_name: str :param data_connector_id: Connector ID. Required. :type data_connector_id: str - :param connect_body: The content of the action request. Is one of the following types: - DataConnectorConnectBody, JSON, IO[bytes] Required. - :type connect_body: ~azure.mgmt.securityinsight.models.DataConnectorConnectBody or JSON or - IO[bytes] + :param connect_body: The content of the action request. Is either a DataConnectorConnectBody + type or a IO[bytes] type. Required. + :type connect_body: ~azure.mgmt.securityinsight.models.DataConnectorConnectBody or + ~azure.mgmt.securityinsight.types.DataConnectorConnectBody or IO[bytes] :return: None :rtype: None :raises ~azure.core.exceptions.HttpResponseError: @@ -9220,6 +9237,19 @@ def connect( # pylint: disable=inconsistent-return-statements return cls(pipeline_response, None, {}) # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "data_connector_id", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def disconnect( # pylint: disable=inconsistent-return-statements self, resource_group_name: str, workspace_name: str, data_connector_id: str, **kwargs: Any ) -> None: @@ -9282,7 +9312,7 @@ def disconnect( # pylint: disable=inconsistent-return-statements return cls(pipeline_response, None, {}) # type: ignore -class IncidentCommentsOperations: +class IncidentCommentsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -9419,7 +9449,7 @@ def create_or_update( workspace_name: str, incident_id: str, incident_comment_id: str, - incident_comment: JSON, + incident_comment: _types.IncidentComment, *, content_type: str = "application/json", **kwargs: Any @@ -9436,7 +9466,7 @@ def create_or_update( :param incident_comment_id: Incident comment ID. Required. :type incident_comment_id: str :param incident_comment: The incident comment. Required. - :type incident_comment: JSON + :type incident_comment: ~azure.mgmt.securityinsight.types.IncidentComment :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -9485,7 +9515,7 @@ def create_or_update( workspace_name: str, incident_id: str, incident_comment_id: str, - incident_comment: Union[_models.IncidentComment, JSON, IO[bytes]], + incident_comment: Union[_models.IncidentComment, _types.IncidentComment, IO[bytes]], **kwargs: Any ) -> _models.IncidentComment: """Creates or updates a comment for a given incident. @@ -9499,9 +9529,10 @@ def create_or_update( :type incident_id: str :param incident_comment_id: Incident comment ID. Required. :type incident_comment_id: str - :param incident_comment: The incident comment. Is one of the following types: IncidentComment, - JSON, IO[bytes] Required. - :type incident_comment: ~azure.mgmt.securityinsight.models.IncidentComment or JSON or IO[bytes] + :param incident_comment: The incident comment. Is either a IncidentComment type or a IO[bytes] + type. Required. + :type incident_comment: ~azure.mgmt.securityinsight.models.IncidentComment or + ~azure.mgmt.securityinsight.types.IncidentComment or IO[bytes] :return: IncidentComment. The IncidentComment is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.IncidentComment :raises ~azure.core.exceptions.HttpResponseError: @@ -9771,7 +9802,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class BookmarkRelationsOperations: +class BookmarkRelationsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -9791,6 +9822,21 @@ def __init__(self, *args, **kwargs) -> None: self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "bookmark_id", + "relation_name", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def get( self, resource_group_name: str, workspace_name: str, bookmark_id: str, relation_name: str, **kwargs: Any ) -> _models.Relation: @@ -9908,7 +9954,7 @@ def create_or_update( workspace_name: str, bookmark_id: str, relation_name: str, - relation: JSON, + relation: _types.Relation, *, content_type: str = "application/json", **kwargs: Any @@ -9925,7 +9971,7 @@ def create_or_update( :param relation_name: Relation Name. Required. :type relation_name: str :param relation: Resource create parameters. Required. - :type relation: JSON + :type relation: ~azure.mgmt.securityinsight.types.Relation :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -9968,13 +10014,29 @@ def create_or_update( """ @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "bookmark_id", + "relation_name", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def create_or_update( self, resource_group_name: str, workspace_name: str, bookmark_id: str, relation_name: str, - relation: Union[_models.Relation, JSON, IO[bytes]], + relation: Union[_models.Relation, _types.Relation, IO[bytes]], **kwargs: Any ) -> _models.Relation: """Creates the bookmark relation. @@ -9988,9 +10050,10 @@ def create_or_update( :type bookmark_id: str :param relation_name: Relation Name. Required. :type relation_name: str - :param relation: Resource create parameters. Is one of the following types: Relation, JSON, - IO[bytes] Required. - :type relation: ~azure.mgmt.securityinsight.models.Relation or JSON or IO[bytes] + :param relation: Resource create parameters. Is either a Relation type or a IO[bytes] type. + Required. + :type relation: ~azure.mgmt.securityinsight.models.Relation or + ~azure.mgmt.securityinsight.types.Relation or IO[bytes] :return: Relation. The Relation is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.Relation :raises ~azure.core.exceptions.HttpResponseError: @@ -10065,6 +10128,20 @@ def create_or_update( return deserialized # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "bookmark_id", + "relation_name", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def delete( # pylint: disable=inconsistent-return-statements self, resource_group_name: str, workspace_name: str, bookmark_id: str, relation_name: str, **kwargs: Any ) -> None: @@ -10130,6 +10207,24 @@ def delete( # pylint: disable=inconsistent-return-statements return cls(pipeline_response, None, {}) # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "bookmark_id", + "filter", + "orderby", + "top", + "skip_token", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def list( self, resource_group_name: str, @@ -10260,7 +10355,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class EntityRelationsOperations: +class EntityRelationsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -10280,6 +10375,21 @@ def __init__(self, *args, **kwargs) -> None: self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "entity_id", + "relation_name", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def get_relation( self, resource_group_name: str, workspace_name: str, entity_id: str, relation_name: str, **kwargs: Any ) -> _models.Relation: @@ -10358,7 +10468,7 @@ def get_relation( return deserialized # type: ignore -class IncidentTasksOperations: +class IncidentTasksOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -10495,7 +10605,7 @@ def create_or_update( workspace_name: str, incident_id: str, incident_task_id: str, - incident_task: JSON, + incident_task: _types.IncidentTask, *, content_type: str = "application/json", **kwargs: Any @@ -10512,7 +10622,7 @@ def create_or_update( :param incident_task_id: Incident task ID. Required. :type incident_task_id: str :param incident_task: The incident task. Required. - :type incident_task: JSON + :type incident_task: ~azure.mgmt.securityinsight.types.IncidentTask :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -10561,7 +10671,7 @@ def create_or_update( workspace_name: str, incident_id: str, incident_task_id: str, - incident_task: Union[_models.IncidentTask, JSON, IO[bytes]], + incident_task: Union[_models.IncidentTask, _types.IncidentTask, IO[bytes]], **kwargs: Any ) -> _models.IncidentTask: """Creates or updates the incident task. @@ -10575,9 +10685,10 @@ def create_or_update( :type incident_id: str :param incident_task_id: Incident task ID. Required. :type incident_task_id: str - :param incident_task: The incident task. Is one of the following types: IncidentTask, JSON, - IO[bytes] Required. - :type incident_task: ~azure.mgmt.securityinsight.models.IncidentTask or JSON or IO[bytes] + :param incident_task: The incident task. Is either a IncidentTask type or a IO[bytes] type. + Required. + :type incident_task: ~azure.mgmt.securityinsight.models.IncidentTask or + ~azure.mgmt.securityinsight.types.IncidentTask or IO[bytes] :return: IncidentTask. The IncidentTask is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.IncidentTask :raises ~azure.core.exceptions.HttpResponseError: @@ -10822,7 +10933,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class SentinelOnboardingStatesOperations: +class SentinelOnboardingStatesOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -10956,7 +11067,7 @@ def create( resource_group_name: str, workspace_name: str, sentinel_onboarding_state_name: str, - sentinel_onboarding_state_parameter: Optional[JSON] = None, + sentinel_onboarding_state_parameter: Optional[_types.SentinelOnboardingState] = None, *, content_type: str = "application/json", **kwargs: Any @@ -10973,7 +11084,8 @@ def create( :type sentinel_onboarding_state_name: str :param sentinel_onboarding_state_parameter: The Sentinel onboarding state parameter. Default value is None. - :type sentinel_onboarding_state_parameter: JSON + :type sentinel_onboarding_state_parameter: + ~azure.mgmt.securityinsight.types.SentinelOnboardingState :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -11020,7 +11132,9 @@ def create( resource_group_name: str, workspace_name: str, sentinel_onboarding_state_name: str, - sentinel_onboarding_state_parameter: Optional[Union[_models.SentinelOnboardingState, JSON, IO[bytes]]] = None, + sentinel_onboarding_state_parameter: Optional[ + Union[_models.SentinelOnboardingState, _types.SentinelOnboardingState, IO[bytes]] + ] = None, **kwargs: Any ) -> _models.SentinelOnboardingState: """Create Sentinel onboarding state. @@ -11033,10 +11147,11 @@ def create( :param sentinel_onboarding_state_name: The Sentinel onboarding state name. Supports - default. Required. :type sentinel_onboarding_state_name: str - :param sentinel_onboarding_state_parameter: The Sentinel onboarding state parameter. Is one of - the following types: SentinelOnboardingState, JSON, IO[bytes] Default value is None. + :param sentinel_onboarding_state_parameter: The Sentinel onboarding state parameter. Is either + a SentinelOnboardingState type or a IO[bytes] type. Default value is None. :type sentinel_onboarding_state_parameter: - ~azure.mgmt.securityinsight.models.SentinelOnboardingState or JSON or IO[bytes] + ~azure.mgmt.securityinsight.models.SentinelOnboardingState or + ~azure.mgmt.securityinsight.types.SentinelOnboardingState or IO[bytes] :return: SentinelOnboardingState. The SentinelOnboardingState is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.SentinelOnboardingState :raises ~azure.core.exceptions.HttpResponseError: @@ -11250,7 +11365,7 @@ def list( return deserialized # type: ignore -class SecurityMLAnalyticsSettingsOperations: +class SecurityMLAnalyticsSettingsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -11383,7 +11498,7 @@ def create_or_update( resource_group_name: str, workspace_name: str, settings_resource_name: str, - security_ml_analytics_setting: JSON, + security_ml_analytics_setting: _types.SecurityMLAnalyticsSetting, *, content_type: str = "application/json", **kwargs: Any @@ -11398,7 +11513,8 @@ def create_or_update( :param settings_resource_name: Security ML Analytics Settings resource name. Required. :type settings_resource_name: str :param security_ml_analytics_setting: The security ML Analytics setting. Required. - :type security_ml_analytics_setting: JSON + :type security_ml_analytics_setting: + ~azure.mgmt.securityinsight.types.SecurityMLAnalyticsSetting :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -11445,7 +11561,9 @@ def create_or_update( resource_group_name: str, workspace_name: str, settings_resource_name: str, - security_ml_analytics_setting: Union[_models.SecurityMLAnalyticsSetting, JSON, IO[bytes]], + security_ml_analytics_setting: Union[ + _models.SecurityMLAnalyticsSetting, _types.SecurityMLAnalyticsSetting, IO[bytes] + ], **kwargs: Any ) -> _models.SecurityMLAnalyticsSetting: """Creates or updates the Security ML Analytics Settings. @@ -11457,10 +11575,11 @@ def create_or_update( :type workspace_name: str :param settings_resource_name: Security ML Analytics Settings resource name. Required. :type settings_resource_name: str - :param security_ml_analytics_setting: The security ML Analytics setting. Is one of the - following types: SecurityMLAnalyticsSetting, JSON, IO[bytes] Required. + :param security_ml_analytics_setting: The security ML Analytics setting. Is either a + SecurityMLAnalyticsSetting type or a IO[bytes] type. Required. :type security_ml_analytics_setting: - ~azure.mgmt.securityinsight.models.SecurityMLAnalyticsSetting or JSON or IO[bytes] + ~azure.mgmt.securityinsight.models.SecurityMLAnalyticsSetting or + ~azure.mgmt.securityinsight.types.SecurityMLAnalyticsSetting or IO[bytes] :return: SecurityMLAnalyticsSetting. The SecurityMLAnalyticsSetting is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.SecurityMLAnalyticsSetting @@ -11700,7 +11819,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class SourceControlsOperations: +class SourceControlsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -11830,7 +11949,7 @@ def create( resource_group_name: str, workspace_name: str, source_control_id: str, - source_control: JSON, + source_control: _types.SourceControl, *, content_type: str = "application/json", **kwargs: Any @@ -11845,7 +11964,7 @@ def create( :param source_control_id: Source control Id. Required. :type source_control_id: str :param source_control: The SourceControl. Required. - :type source_control: JSON + :type source_control: ~azure.mgmt.securityinsight.types.SourceControl :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -11890,7 +12009,7 @@ def create( resource_group_name: str, workspace_name: str, source_control_id: str, - source_control: Union[_models.SourceControl, JSON, IO[bytes]], + source_control: Union[_models.SourceControl, _types.SourceControl, IO[bytes]], **kwargs: Any ) -> _models.SourceControl: """Creates a source control. @@ -11902,9 +12021,10 @@ def create( :type workspace_name: str :param source_control_id: Source control Id. Required. :type source_control_id: str - :param source_control: The SourceControl. Is one of the following types: SourceControl, JSON, - IO[bytes] Required. - :type source_control: ~azure.mgmt.securityinsight.models.SourceControl or JSON or IO[bytes] + :param source_control: The SourceControl. Is either a SourceControl type or a IO[bytes] type. + Required. + :type source_control: ~azure.mgmt.securityinsight.models.SourceControl or + ~azure.mgmt.securityinsight.types.SourceControl or IO[bytes] :return: SourceControl. The SourceControl is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.SourceControl :raises ~azure.core.exceptions.HttpResponseError: @@ -12113,7 +12233,7 @@ def delete( resource_group_name: str, workspace_name: str, source_control_id: str, - repository_access: JSON, + repository_access: _types.RepositoryAccessProperties, *, content_type: str = "application/json", **kwargs: Any @@ -12128,7 +12248,7 @@ def delete( :param source_control_id: Source control Id. Required. :type source_control_id: str :param repository_access: The repository access credentials. Required. - :type repository_access: JSON + :type repository_access: ~azure.mgmt.securityinsight.types.RepositoryAccessProperties :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -12173,7 +12293,7 @@ def delete( resource_group_name: str, workspace_name: str, source_control_id: str, - repository_access: Union[_models.RepositoryAccessProperties, JSON, IO[bytes]], + repository_access: Union[_models.RepositoryAccessProperties, _types.RepositoryAccessProperties, IO[bytes]], **kwargs: Any ) -> _models.Warning: """Delete a source control. @@ -12185,10 +12305,10 @@ def delete( :type workspace_name: str :param source_control_id: Source control Id. Required. :type source_control_id: str - :param repository_access: The repository access credentials. Is one of the following types: - RepositoryAccessProperties, JSON, IO[bytes] Required. - :type repository_access: ~azure.mgmt.securityinsight.models.RepositoryAccessProperties or JSON - or IO[bytes] + :param repository_access: The repository access credentials. Is either a + RepositoryAccessProperties type or a IO[bytes] type. Required. + :type repository_access: ~azure.mgmt.securityinsight.models.RepositoryAccessProperties or + ~azure.mgmt.securityinsight.types.RepositoryAccessProperties or IO[bytes] :return: Warning. The Warning is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.Warning :raises ~azure.core.exceptions.HttpResponseError: @@ -12262,7 +12382,7 @@ def delete( return deserialized # type: ignore -class WatchlistsOperations: +class WatchlistsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -12361,7 +12481,7 @@ def _create_or_update_initial( resource_group_name: str, workspace_name: str, watchlist_alias: str, - watchlist: Union[_models.Watchlist, JSON, IO[bytes]], + watchlist: Union[_models.Watchlist, _types.Watchlist, IO[bytes]], **kwargs: Any ) -> Iterator[bytes]: error_map: MutableMapping = { @@ -12426,7 +12546,6 @@ def _create_or_update_initial( response_headers["Azure-AsyncOperation"] = self._deserialize( "str", response.headers.get("Azure-AsyncOperation") ) - response_headers["Retry-After"] = self._deserialize("int", response.headers.get("Retry-After")) deserialized = response.iter_bytes() if _decompress else response.iter_raw() @@ -12474,7 +12593,7 @@ def begin_create_or_update( resource_group_name: str, workspace_name: str, watchlist_alias: str, - watchlist: JSON, + watchlist: _types.Watchlist, *, content_type: str = "application/json", **kwargs: Any @@ -12491,7 +12610,7 @@ def begin_create_or_update( :param watchlist_alias: The watchlist alias. Required. :type watchlist_alias: str :param watchlist: The watchlist. Required. - :type watchlist: JSON + :type watchlist: ~azure.mgmt.securityinsight.types.Watchlist :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -12540,7 +12659,7 @@ def begin_create_or_update( resource_group_name: str, workspace_name: str, watchlist_alias: str, - watchlist: Union[_models.Watchlist, JSON, IO[bytes]], + watchlist: Union[_models.Watchlist, _types.Watchlist, IO[bytes]], **kwargs: Any ) -> LROPoller[_models.Watchlist]: """Create or update a Watchlist and its Watchlist Items (bulk creation, e.g. through text/csv @@ -12554,9 +12673,9 @@ def begin_create_or_update( :type workspace_name: str :param watchlist_alias: The watchlist alias. Required. :type watchlist_alias: str - :param watchlist: The watchlist. Is one of the following types: Watchlist, JSON, IO[bytes] - Required. - :type watchlist: ~azure.mgmt.securityinsight.models.Watchlist or JSON or IO[bytes] + :param watchlist: The watchlist. Is either a Watchlist type or a IO[bytes] type. Required. + :type watchlist: ~azure.mgmt.securityinsight.models.Watchlist or + ~azure.mgmt.securityinsight.types.Watchlist or IO[bytes] :return: An instance of LROPoller that returns Watchlist. The Watchlist is compatible with MutableMapping :rtype: ~azure.core.polling.LROPoller[~azure.mgmt.securityinsight.models.Watchlist] @@ -12671,7 +12790,6 @@ def _delete_initial( "str", response.headers.get("Azure-AsyncOperation") ) response_headers["Location"] = self._deserialize("str", response.headers.get("Location")) - response_headers["Retry-After"] = self._deserialize("int", response.headers.get("Retry-After")) deserialized = response.iter_bytes() if _decompress else response.iter_raw() @@ -12683,7 +12801,7 @@ def _delete_initial( @distributed_trace def begin_delete( self, resource_group_name: str, workspace_name: str, watchlist_alias: str, **kwargs: Any - ) -> LROPoller[None]: + ) -> LROPoller[_models.Watchlist]: """Delete a watchlist. :param resource_group_name: The name of the resource group. The name is case insensitive. @@ -12693,14 +12811,15 @@ def begin_delete( :type workspace_name: str :param watchlist_alias: The watchlist alias. Required. :type watchlist_alias: str - :return: An instance of LROPoller that returns None - :rtype: ~azure.core.polling.LROPoller[None] + :return: An instance of LROPoller that returns Watchlist. The Watchlist is compatible with + MutableMapping + :rtype: ~azure.core.polling.LROPoller[~azure.mgmt.securityinsight.models.Watchlist] :raises ~azure.core.exceptions.HttpResponseError: """ _headers = kwargs.pop("headers", {}) or {} _params = kwargs.pop("params", {}) or {} - cls: ClsType[None] = kwargs.pop("cls", None) + cls: ClsType[_models.Watchlist] = kwargs.pop("cls", None) polling: Union[bool, PollingMethod] = kwargs.pop("polling", True) lro_delay = kwargs.pop("polling_interval", self._config.polling_interval) cont_token: Optional[str] = kwargs.pop("continuation_token", None) @@ -12717,9 +12836,18 @@ def begin_delete( raw_result.http_response.read() # type: ignore kwargs.pop("error_map", None) - def get_long_running_output(pipeline_response): # pylint: disable=inconsistent-return-statements + def get_long_running_output(pipeline_response): + response_headers = {} + response = pipeline_response.http_response + response_headers["Azure-AsyncOperation"] = self._deserialize( + "str", response.headers.get("Azure-AsyncOperation") + ) + response_headers["Location"] = self._deserialize("str", response.headers.get("Location")) + + deserialized = _deserialize(_models.Watchlist, response.json()) if cls: - return cls(pipeline_response, None, {}) # type: ignore + return cls(pipeline_response, deserialized, response_headers) # type: ignore + return deserialized path_format_arguments = { "endpoint": self._serialize.url("self._config.base_url", self._config.base_url, "str", skip_quote=True), @@ -12734,13 +12862,15 @@ def get_long_running_output(pipeline_response): # pylint: disable=inconsistent- else: polling_method = polling if cont_token: - return LROPoller[None].from_continuation_token( + return LROPoller[_models.Watchlist].from_continuation_token( polling_method=polling_method, continuation_token=cont_token, client=self._client, deserialization_callback=get_long_running_output, ) - return LROPoller[None](self._client, raw_result, get_long_running_output, polling_method) # type: ignore + return LROPoller[_models.Watchlist]( + self._client, raw_result, get_long_running_output, polling_method # type: ignore + ) @distributed_trace def list( @@ -12851,7 +12981,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class WatchlistItemsOperations: +class WatchlistItemsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -12988,7 +13118,7 @@ def create_or_update( workspace_name: str, watchlist_alias: str, watchlist_item_id: str, - watchlist_item: JSON, + watchlist_item: _types.WatchlistItem, *, content_type: str = "application/json", **kwargs: Any @@ -13005,7 +13135,7 @@ def create_or_update( :param watchlist_item_id: The watchlist item id (GUID). Required. :type watchlist_item_id: str :param watchlist_item: The watchlist item. Required. - :type watchlist_item: JSON + :type watchlist_item: ~azure.mgmt.securityinsight.types.WatchlistItem :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -13054,7 +13184,7 @@ def create_or_update( workspace_name: str, watchlist_alias: str, watchlist_item_id: str, - watchlist_item: Union[_models.WatchlistItem, JSON, IO[bytes]], + watchlist_item: Union[_models.WatchlistItem, _types.WatchlistItem, IO[bytes]], **kwargs: Any ) -> _models.WatchlistItem: """Create or update a watchlist item. @@ -13068,9 +13198,10 @@ def create_or_update( :type watchlist_alias: str :param watchlist_item_id: The watchlist item id (GUID). Required. :type watchlist_item_id: str - :param watchlist_item: The watchlist item. Is one of the following types: WatchlistItem, JSON, - IO[bytes] Required. - :type watchlist_item: ~azure.mgmt.securityinsight.models.WatchlistItem or JSON or IO[bytes] + :param watchlist_item: The watchlist item. Is either a WatchlistItem type or a IO[bytes] type. + Required. + :type watchlist_item: ~azure.mgmt.securityinsight.models.WatchlistItem or + ~azure.mgmt.securityinsight.types.WatchlistItem or IO[bytes] :return: WatchlistItem. The WatchlistItem is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.WatchlistItem :raises ~azure.core.exceptions.HttpResponseError: @@ -13327,7 +13458,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class BillingStatisticsOperations: +class BillingStatisticsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -13347,6 +13478,20 @@ def __init__(self, *args, **kwargs) -> None: self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "billing_statistic_name", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def get( self, resource_group_name: str, workspace_name: str, billing_statistic_name: str, **kwargs: Any ) -> _models.BillingStatistic: @@ -13422,6 +13567,13 @@ def get( return deserialized # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": ["api_version", "subscription_id", "resource_group_name", "workspace_name", "accept"] + }, + api_versions_list=["2025-10-01-preview"], + ) def list( self, resource_group_name: str, workspace_name: str, **kwargs: Any ) -> ItemPaged["_models.BillingStatistic"]: @@ -13524,7 +13676,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class EntitiesOperations: +class EntitiesOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -13544,6 +13696,20 @@ def __init__(self, *args, **kwargs) -> None: self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "entity_id", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def get(self, resource_group_name: str, workspace_name: str, entity_id: str, **kwargs: Any) -> _models.Entity: """Gets an entity. @@ -13617,6 +13783,13 @@ def get(self, resource_group_name: str, workspace_name: str, entity_id: str, **k return deserialized # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": ["api_version", "subscription_id", "resource_group_name", "workspace_name", "accept"] + }, + api_versions_list=["2025-10-01-preview"], + ) def list(self, resource_group_name: str, workspace_name: str, **kwargs: Any) -> ItemPaged["_models.Entity"]: """Gets all entities. @@ -13753,7 +13926,7 @@ def run_playbook( resource_group_name: str, workspace_name: str, entity_identifier: str, - request_body: Optional[JSON] = None, + request_body: Optional[_types.EntityManualTriggerRequestBody] = None, *, content_type: str = "application/json", **kwargs: Any @@ -13769,7 +13942,7 @@ def run_playbook( :type entity_identifier: str :param request_body: Describes the request body for triggering a playbook on an entity. Default value is None. - :type request_body: JSON + :type request_body: ~azure.mgmt.securityinsight.types.EntityManualTriggerRequestBody :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -13815,7 +13988,9 @@ def run_playbook( # pylint: disable=inconsistent-return-statements resource_group_name: str, workspace_name: str, entity_identifier: str, - request_body: Optional[Union[_models.EntityManualTriggerRequestBody, JSON, IO[bytes]]] = None, + request_body: Optional[ + Union[_models.EntityManualTriggerRequestBody, _types.EntityManualTriggerRequestBody, IO[bytes]] + ] = None, **kwargs: Any ) -> None: """Triggers playbook on a specific entity. @@ -13827,10 +14002,10 @@ def run_playbook( # pylint: disable=inconsistent-return-statements :type workspace_name: str :param entity_identifier: entity ID. Required. :type entity_identifier: str - :param request_body: Describes the request body for triggering a playbook on an entity. Is one - of the following types: EntityManualTriggerRequestBody, JSON, IO[bytes] Default value is None. - :type request_body: ~azure.mgmt.securityinsight.models.EntityManualTriggerRequestBody or JSON - or IO[bytes] + :param request_body: Describes the request body for triggering a playbook on an entity. Is + either a EntityManualTriggerRequestBody type or a IO[bytes] type. Default value is None. + :type request_body: ~azure.mgmt.securityinsight.models.EntityManualTriggerRequestBody or + ~azure.mgmt.securityinsight.types.EntityManualTriggerRequestBody or IO[bytes] :return: None :rtype: None :raises ~azure.core.exceptions.HttpResponseError: @@ -13931,7 +14106,7 @@ def expand( resource_group_name: str, workspace_name: str, entity_id: str, - parameters: JSON, + parameters: _types.EntityExpandParameters, *, content_type: str = "application/json", **kwargs: Any @@ -13947,7 +14122,7 @@ def expand( :type entity_id: str :param parameters: The parameters required to execute an expand operation on the given entity. Required. - :type parameters: JSON + :type parameters: ~azure.mgmt.securityinsight.types.EntityExpandParameters :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -13988,12 +14163,27 @@ def expand( """ @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "entity_id", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def expand( self, resource_group_name: str, workspace_name: str, entity_id: str, - parameters: Union[_models.EntityExpandParameters, JSON, IO[bytes]], + parameters: Union[_models.EntityExpandParameters, _types.EntityExpandParameters, IO[bytes]], **kwargs: Any ) -> _models.EntityExpandResponse: """Expands an entity. @@ -14006,9 +14196,9 @@ def expand( :param entity_id: entity ID. Required. :type entity_id: str :param parameters: The parameters required to execute an expand operation on the given entity. - Is one of the following types: EntityExpandParameters, JSON, IO[bytes] Required. - :type parameters: ~azure.mgmt.securityinsight.models.EntityExpandParameters or JSON or - IO[bytes] + Is either a EntityExpandParameters type or a IO[bytes] type. Required. + :type parameters: ~azure.mgmt.securityinsight.models.EntityExpandParameters or + ~azure.mgmt.securityinsight.types.EntityExpandParameters or IO[bytes] :return: EntityExpandResponse. The EntityExpandResponse is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.EntityExpandResponse :raises ~azure.core.exceptions.HttpResponseError: @@ -14082,6 +14272,21 @@ def expand( return deserialized # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "entity_id", + "kind", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def queries( self, resource_group_name: str, @@ -14232,7 +14437,7 @@ def get_insights( resource_group_name: str, workspace_name: str, entity_id: str, - parameters: JSON, + parameters: _types.EntityGetInsightsParameters, *, content_type: str = "application/json", **kwargs: Any @@ -14247,7 +14452,7 @@ def get_insights( :param entity_id: entity ID. Required. :type entity_id: str :param parameters: The parameters required to execute insights on the given entity. Required. - :type parameters: JSON + :type parameters: ~azure.mgmt.securityinsight.types.EntityGetInsightsParameters :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -14289,12 +14494,27 @@ def get_insights( """ @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "entity_id", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def get_insights( self, resource_group_name: str, workspace_name: str, entity_id: str, - parameters: Union[_models.EntityGetInsightsParameters, JSON, IO[bytes]], + parameters: Union[_models.EntityGetInsightsParameters, _types.EntityGetInsightsParameters, IO[bytes]], **kwargs: Any ) -> _models.EntityGetInsightsResponse: """Execute Insights for an entity. @@ -14306,10 +14526,10 @@ def get_insights( :type workspace_name: str :param entity_id: entity ID. Required. :type entity_id: str - :param parameters: The parameters required to execute insights on the given entity. Is one of - the following types: EntityGetInsightsParameters, JSON, IO[bytes] Required. - :type parameters: ~azure.mgmt.securityinsight.models.EntityGetInsightsParameters or JSON or - IO[bytes] + :param parameters: The parameters required to execute insights on the given entity. Is either a + EntityGetInsightsParameters type or a IO[bytes] type. Required. + :type parameters: ~azure.mgmt.securityinsight.models.EntityGetInsightsParameters or + ~azure.mgmt.securityinsight.types.EntityGetInsightsParameters or IO[bytes] :return: EntityGetInsightsResponse. The EntityGetInsightsResponse is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.EntityGetInsightsResponse @@ -14384,7 +14604,7 @@ def get_insights( return deserialized # type: ignore -class EntityQueriesOperations: +class EntityQueriesOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -14404,6 +14624,20 @@ def __init__(self, *args, **kwargs) -> None: self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "entity_query_id", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def get( self, resource_group_name: str, workspace_name: str, entity_query_id: str, **kwargs: Any ) -> _models.EntityQuery: @@ -14514,7 +14748,7 @@ def create_or_update( resource_group_name: str, workspace_name: str, entity_query_id: str, - entity_query: JSON, + entity_query: _types.CustomEntityQuery, *, content_type: str = "application/json", **kwargs: Any @@ -14529,7 +14763,7 @@ def create_or_update( :param entity_query_id: entity query ID. Required. :type entity_query_id: str :param entity_query: The entity query we want to create or update. Required. - :type entity_query: JSON + :type entity_query: ~azure.mgmt.securityinsight.types.CustomEntityQuery :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -14569,12 +14803,27 @@ def create_or_update( """ @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "entity_query_id", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def create_or_update( self, resource_group_name: str, workspace_name: str, entity_query_id: str, - entity_query: Union[_models.CustomEntityQuery, JSON, IO[bytes]], + entity_query: Union[_models.CustomEntityQuery, _types.CustomEntityQuery, IO[bytes]], **kwargs: Any ) -> _models.EntityQuery: """Creates or updates the entity query. @@ -14586,9 +14835,10 @@ def create_or_update( :type workspace_name: str :param entity_query_id: entity query ID. Required. :type entity_query_id: str - :param entity_query: The entity query we want to create or update. Is one of the following - types: CustomEntityQuery, JSON, IO[bytes] Required. - :type entity_query: ~azure.mgmt.securityinsight.models.CustomEntityQuery or JSON or IO[bytes] + :param entity_query: The entity query we want to create or update. Is either a + CustomEntityQuery type or a IO[bytes] type. Required. + :type entity_query: ~azure.mgmt.securityinsight.models.CustomEntityQuery or + ~azure.mgmt.securityinsight.types.CustomEntityQuery or IO[bytes] :return: EntityQuery. The EntityQuery is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.EntityQuery :raises ~azure.core.exceptions.HttpResponseError: @@ -14662,6 +14912,19 @@ def create_or_update( return deserialized # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "entity_query_id", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def delete( # pylint: disable=inconsistent-return-statements self, resource_group_name: str, workspace_name: str, entity_query_id: str, **kwargs: Any ) -> None: @@ -14724,6 +14987,20 @@ def delete( # pylint: disable=inconsistent-return-statements return cls(pipeline_response, None, {}) # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "kind", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def list( self, resource_group_name: str, @@ -14836,7 +15113,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class EntityQueryTemplatesOperations: +class EntityQueryTemplatesOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -14856,6 +15133,20 @@ def __init__(self, *args, **kwargs) -> None: self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "entity_query_template_id", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def get( self, resource_group_name: str, workspace_name: str, entity_query_template_id: str, **kwargs: Any ) -> _models.EntityQueryTemplate: @@ -14931,6 +15222,20 @@ def get( return deserialized # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "kind", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def list( self, resource_group_name: str, @@ -15043,7 +15348,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class FileImportsOperations: +class FileImportsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -15063,6 +15368,20 @@ def __init__(self, *args, **kwargs) -> None: self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "file_import_id", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def get( self, resource_group_name: str, workspace_name: str, file_import_id: str, **kwargs: Any ) -> _models.FileImport: @@ -15173,7 +15492,7 @@ def create( resource_group_name: str, workspace_name: str, file_import_id: str, - file_import: JSON, + file_import: _types.FileImport, *, content_type: str = "application/json", **kwargs: Any @@ -15188,7 +15507,7 @@ def create( :param file_import_id: File import ID. Required. :type file_import_id: str :param file_import: The file import. Required. - :type file_import: JSON + :type file_import: ~azure.mgmt.securityinsight.types.FileImport :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -15228,12 +15547,27 @@ def create( """ @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "file_import_id", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def create( self, resource_group_name: str, workspace_name: str, file_import_id: str, - file_import: Union[_models.FileImport, JSON, IO[bytes]], + file_import: Union[_models.FileImport, _types.FileImport, IO[bytes]], **kwargs: Any ) -> _models.FileImport: """Creates the file import. @@ -15245,9 +15579,9 @@ def create( :type workspace_name: str :param file_import_id: File import ID. Required. :type file_import_id: str - :param file_import: The file import. Is one of the following types: FileImport, JSON, IO[bytes] - Required. - :type file_import: ~azure.mgmt.securityinsight.models.FileImport or JSON or IO[bytes] + :param file_import: The file import. Is either a FileImport type or a IO[bytes] type. Required. + :type file_import: ~azure.mgmt.securityinsight.models.FileImport or + ~azure.mgmt.securityinsight.types.FileImport or IO[bytes] :return: FileImport. The FileImport is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.FileImport :raises ~azure.core.exceptions.HttpResponseError: @@ -15320,6 +15654,20 @@ def create( return deserialized # type: ignore + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "file_import_id", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def _delete_initial( self, resource_group_name: str, workspace_name: str, file_import_id: str, **kwargs: Any ) -> Iterator[bytes]: @@ -15382,6 +15730,20 @@ def _delete_initial( return deserialized # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "file_import_id", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def begin_delete( self, resource_group_name: str, workspace_name: str, file_import_id: str, **kwargs: Any ) -> LROPoller[_models.FileImport]: @@ -15453,6 +15815,23 @@ def get_long_running_output(pipeline_response): ) @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "filter", + "orderby", + "top", + "skip_token", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def list( self, resource_group_name: str, @@ -15579,7 +15958,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class HuntsOperations: +class HuntsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -15599,6 +15978,20 @@ def __init__(self, *args, **kwargs) -> None: self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "hunt_id", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def get(self, resource_group_name: str, workspace_name: str, hunt_id: str, **kwargs: Any) -> _models.Hunt: """Gets a hunt, without relations and comments. @@ -15707,7 +16100,7 @@ def create_or_update( resource_group_name: str, workspace_name: str, hunt_id: str, - hunt: JSON, + hunt: _types.Hunt, *, content_type: str = "application/json", **kwargs: Any @@ -15722,7 +16115,7 @@ def create_or_update( :param hunt_id: The hunt id (GUID). Required. :type hunt_id: str :param hunt: The hunt. Required. - :type hunt: JSON + :type hunt: ~azure.mgmt.securityinsight.types.Hunt :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -15762,12 +16155,27 @@ def create_or_update( """ @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "hunt_id", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def create_or_update( self, resource_group_name: str, workspace_name: str, hunt_id: str, - hunt: Union[_models.Hunt, JSON, IO[bytes]], + hunt: Union[_models.Hunt, _types.Hunt, IO[bytes]], **kwargs: Any ) -> _models.Hunt: """Create or update a hunt. @@ -15779,8 +16187,9 @@ def create_or_update( :type workspace_name: str :param hunt_id: The hunt id (GUID). Required. :type hunt_id: str - :param hunt: The hunt. Is one of the following types: Hunt, JSON, IO[bytes] Required. - :type hunt: ~azure.mgmt.securityinsight.models.Hunt or JSON or IO[bytes] + :param hunt: The hunt. Is either a Hunt type or a IO[bytes] type. Required. + :type hunt: ~azure.mgmt.securityinsight.models.Hunt or ~azure.mgmt.securityinsight.types.Hunt + or IO[bytes] :return: Hunt. The Hunt is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.Hunt :raises ~azure.core.exceptions.HttpResponseError: @@ -15854,6 +16263,13 @@ def create_or_update( return deserialized # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": ["api_version", "subscription_id", "resource_group_name", "workspace_name", "hunt_id"] + }, + api_versions_list=["2025-10-01-preview"], + ) def delete( # pylint: disable=inconsistent-return-statements self, resource_group_name: str, workspace_name: str, hunt_id: str, **kwargs: Any ) -> None: @@ -15916,6 +16332,23 @@ def delete( # pylint: disable=inconsistent-return-statements return cls(pipeline_response, None, {}) # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "filter", + "orderby", + "top", + "skip_token", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def list( self, resource_group_name: str, @@ -16042,7 +16475,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class HuntCommentsOperations: +class HuntCommentsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -16062,6 +16495,21 @@ def __init__(self, *args, **kwargs) -> None: self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "hunt_id", + "hunt_comment_id", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def get( self, resource_group_name: str, workspace_name: str, hunt_id: str, hunt_comment_id: str, **kwargs: Any ) -> _models.HuntComment: @@ -16179,7 +16627,7 @@ def create_or_update( workspace_name: str, hunt_id: str, hunt_comment_id: str, - hunt_comment: JSON, + hunt_comment: _types.HuntComment, *, content_type: str = "application/json", **kwargs: Any @@ -16196,7 +16644,7 @@ def create_or_update( :param hunt_comment_id: The hunt comment id (GUID). Required. :type hunt_comment_id: str :param hunt_comment: The hunt comment. Required. - :type hunt_comment: JSON + :type hunt_comment: ~azure.mgmt.securityinsight.types.HuntComment :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -16239,13 +16687,29 @@ def create_or_update( """ @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "hunt_id", + "hunt_comment_id", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def create_or_update( self, resource_group_name: str, workspace_name: str, hunt_id: str, hunt_comment_id: str, - hunt_comment: Union[_models.HuntComment, JSON, IO[bytes]], + hunt_comment: Union[_models.HuntComment, _types.HuntComment, IO[bytes]], **kwargs: Any ) -> _models.HuntComment: """Creates or updates a hunt relation. @@ -16259,9 +16723,10 @@ def create_or_update( :type hunt_id: str :param hunt_comment_id: The hunt comment id (GUID). Required. :type hunt_comment_id: str - :param hunt_comment: The hunt comment. Is one of the following types: HuntComment, JSON, - IO[bytes] Required. - :type hunt_comment: ~azure.mgmt.securityinsight.models.HuntComment or JSON or IO[bytes] + :param hunt_comment: The hunt comment. Is either a HuntComment type or a IO[bytes] type. + Required. + :type hunt_comment: ~azure.mgmt.securityinsight.models.HuntComment or + ~azure.mgmt.securityinsight.types.HuntComment or IO[bytes] :return: HuntComment. The HuntComment is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.HuntComment :raises ~azure.core.exceptions.HttpResponseError: @@ -16336,6 +16801,20 @@ def create_or_update( return deserialized # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "hunt_id", + "hunt_comment_id", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def delete( # pylint: disable=inconsistent-return-statements self, resource_group_name: str, workspace_name: str, hunt_id: str, hunt_comment_id: str, **kwargs: Any ) -> None: @@ -16401,6 +16880,24 @@ def delete( # pylint: disable=inconsistent-return-statements return cls(pipeline_response, None, {}) # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "hunt_id", + "filter", + "orderby", + "top", + "skip_token", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def list( self, resource_group_name: str, @@ -16531,7 +17028,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class HuntRelationsOperations: +class HuntRelationsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -16551,6 +17048,21 @@ def __init__(self, *args, **kwargs) -> None: self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "hunt_id", + "hunt_relation_id", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def get( self, resource_group_name: str, workspace_name: str, hunt_id: str, hunt_relation_id: str, **kwargs: Any ) -> _models.HuntRelation: @@ -16668,7 +17180,7 @@ def create_or_update( workspace_name: str, hunt_id: str, hunt_relation_id: str, - hunt_relation: JSON, + hunt_relation: _types.HuntRelation, *, content_type: str = "application/json", **kwargs: Any @@ -16685,7 +17197,7 @@ def create_or_update( :param hunt_relation_id: The hunt relation id (GUID). Required. :type hunt_relation_id: str :param hunt_relation: The hunt relation. Required. - :type hunt_relation: JSON + :type hunt_relation: ~azure.mgmt.securityinsight.types.HuntRelation :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -16728,13 +17240,29 @@ def create_or_update( """ @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "hunt_id", + "hunt_relation_id", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def create_or_update( self, resource_group_name: str, workspace_name: str, hunt_id: str, hunt_relation_id: str, - hunt_relation: Union[_models.HuntRelation, JSON, IO[bytes]], + hunt_relation: Union[_models.HuntRelation, _types.HuntRelation, IO[bytes]], **kwargs: Any ) -> _models.HuntRelation: """Creates or updates a hunt relation. @@ -16748,9 +17276,10 @@ def create_or_update( :type hunt_id: str :param hunt_relation_id: The hunt relation id (GUID). Required. :type hunt_relation_id: str - :param hunt_relation: The hunt relation. Is one of the following types: HuntRelation, JSON, - IO[bytes] Required. - :type hunt_relation: ~azure.mgmt.securityinsight.models.HuntRelation or JSON or IO[bytes] + :param hunt_relation: The hunt relation. Is either a HuntRelation type or a IO[bytes] type. + Required. + :type hunt_relation: ~azure.mgmt.securityinsight.models.HuntRelation or + ~azure.mgmt.securityinsight.types.HuntRelation or IO[bytes] :return: HuntRelation. The HuntRelation is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.HuntRelation :raises ~azure.core.exceptions.HttpResponseError: @@ -16825,6 +17354,20 @@ def create_or_update( return deserialized # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "hunt_id", + "hunt_relation_id", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def delete( # pylint: disable=inconsistent-return-statements self, resource_group_name: str, workspace_name: str, hunt_id: str, hunt_relation_id: str, **kwargs: Any ) -> None: @@ -16890,6 +17433,24 @@ def delete( # pylint: disable=inconsistent-return-statements return cls(pipeline_response, None, {}) # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "hunt_id", + "filter", + "orderby", + "top", + "skip_token", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def list( self, resource_group_name: str, @@ -17020,7 +17581,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class OfficeConsentsOperations: +class OfficeConsentsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -17040,6 +17601,20 @@ def __init__(self, *args, **kwargs) -> None: self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "consent_id", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def get( self, resource_group_name: str, workspace_name: str, consent_id: str, **kwargs: Any ) -> _models.OfficeConsent: @@ -17115,6 +17690,19 @@ def get( return deserialized # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "consent_id", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def delete( # pylint: disable=inconsistent-return-statements self, resource_group_name: str, workspace_name: str, consent_id: str, **kwargs: Any ) -> None: @@ -17177,6 +17765,13 @@ def delete( # pylint: disable=inconsistent-return-statements return cls(pipeline_response, None, {}) # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": ["api_version", "subscription_id", "resource_group_name", "workspace_name", "accept"] + }, + api_versions_list=["2025-10-01-preview"], + ) def list(self, resource_group_name: str, workspace_name: str, **kwargs: Any) -> ItemPaged["_models.OfficeConsent"]: """Gets all office365 consents. @@ -17277,7 +17872,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class ProductSettingsOperations: +class ProductSettingsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -17297,6 +17892,20 @@ def __init__(self, *args, **kwargs) -> None: self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "settings_name", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def get(self, resource_group_name: str, workspace_name: str, settings_name: str, **kwargs: Any) -> _models.Settings: """Gets a setting. @@ -17407,7 +18016,7 @@ def update( resource_group_name: str, workspace_name: str, settings_name: str, - settings: JSON, + settings: _types.Settings, *, content_type: str = "application/json", **kwargs: Any @@ -17423,7 +18032,7 @@ def update( Required. :type settings_name: str :param settings: The setting. Required. - :type settings: JSON + :type settings: ~azure.mgmt.securityinsight.types.Settings :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -17464,12 +18073,27 @@ def update( """ @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "settings_name", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def update( self, resource_group_name: str, workspace_name: str, settings_name: str, - settings: Union[_models.Settings, JSON, IO[bytes]], + settings: Union[_models.Settings, _types.Settings, IO[bytes]], **kwargs: Any ) -> _models.Settings: """Updates setting. @@ -17482,9 +18106,9 @@ def update( :param settings_name: The setting name. Supports - Anomalies, EyesOn, EntityAnalytics, Ueba. Required. :type settings_name: str - :param settings: The setting. Is one of the following types: Settings, JSON, IO[bytes] - Required. - :type settings: ~azure.mgmt.securityinsight.models.Settings or JSON or IO[bytes] + :param settings: The setting. Is either a Settings type or a IO[bytes] type. Required. + :type settings: ~azure.mgmt.securityinsight.models.Settings or + ~azure.mgmt.securityinsight.types.Settings or IO[bytes] :return: Settings. The Settings is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.Settings :raises ~azure.core.exceptions.HttpResponseError: @@ -17558,6 +18182,19 @@ def update( return deserialized # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "settings_name", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def delete( # pylint: disable=inconsistent-return-statements self, resource_group_name: str, workspace_name: str, settings_name: str, **kwargs: Any ) -> None: @@ -17621,6 +18258,13 @@ def delete( # pylint: disable=inconsistent-return-statements return cls(pipeline_response, None, {}) # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": ["api_version", "subscription_id", "resource_group_name", "workspace_name", "accept"] + }, + api_versions_list=["2025-10-01-preview"], + ) def list(self, resource_group_name: str, workspace_name: str, **kwargs: Any) -> ItemPaged["_models.Settings"]: """List of all the settings. @@ -17721,7 +18365,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class WorkspaceManagerAssignmentsOperations: +class WorkspaceManagerAssignmentsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -17741,6 +18385,20 @@ def __init__(self, *args, **kwargs) -> None: self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "workspace_manager_assignment_name", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def get( self, resource_group_name: str, workspace_name: str, workspace_manager_assignment_name: str, **kwargs: Any ) -> _models.WorkspaceManagerAssignment: @@ -17856,7 +18514,7 @@ def create_or_update( resource_group_name: str, workspace_name: str, workspace_manager_assignment_name: str, - workspace_manager_assignment: JSON, + workspace_manager_assignment: _types.WorkspaceManagerAssignment, *, content_type: str = "application/json", **kwargs: Any @@ -17872,7 +18530,8 @@ def create_or_update( Required. :type workspace_manager_assignment_name: str :param workspace_manager_assignment: The workspace manager assignment. Required. - :type workspace_manager_assignment: JSON + :type workspace_manager_assignment: + ~azure.mgmt.securityinsight.types.WorkspaceManagerAssignment :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -17915,12 +18574,29 @@ def create_or_update( """ @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "workspace_manager_assignment_name", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def create_or_update( self, resource_group_name: str, workspace_name: str, workspace_manager_assignment_name: str, - workspace_manager_assignment: Union[_models.WorkspaceManagerAssignment, JSON, IO[bytes]], + workspace_manager_assignment: Union[ + _models.WorkspaceManagerAssignment, _types.WorkspaceManagerAssignment, IO[bytes] + ], **kwargs: Any ) -> _models.WorkspaceManagerAssignment: """Creates or updates a workspace manager assignment. @@ -17933,10 +18609,11 @@ def create_or_update( :param workspace_manager_assignment_name: The name of the workspace manager assignment. Required. :type workspace_manager_assignment_name: str - :param workspace_manager_assignment: The workspace manager assignment. Is one of the following - types: WorkspaceManagerAssignment, JSON, IO[bytes] Required. + :param workspace_manager_assignment: The workspace manager assignment. Is either a + WorkspaceManagerAssignment type or a IO[bytes] type. Required. :type workspace_manager_assignment: - ~azure.mgmt.securityinsight.models.WorkspaceManagerAssignment or JSON or IO[bytes] + ~azure.mgmt.securityinsight.models.WorkspaceManagerAssignment or + ~azure.mgmt.securityinsight.types.WorkspaceManagerAssignment or IO[bytes] :return: WorkspaceManagerAssignment. The WorkspaceManagerAssignment is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.WorkspaceManagerAssignment @@ -18011,6 +18688,19 @@ def create_or_update( return deserialized # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "workspace_manager_assignment_name", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def delete( # pylint: disable=inconsistent-return-statements self, resource_group_name: str, workspace_name: str, workspace_manager_assignment_name: str, **kwargs: Any ) -> None: @@ -18074,6 +18764,22 @@ def delete( # pylint: disable=inconsistent-return-statements return cls(pipeline_response, None, {}) # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "orderby", + "top", + "skip_token", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def list( self, resource_group_name: str, @@ -18196,7 +18902,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class WorkspaceManagerConfigurationsOperations: +class WorkspaceManagerConfigurationsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -18216,6 +18922,20 @@ def __init__(self, *args, **kwargs) -> None: self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "workspace_manager_configuration_name", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def get( self, resource_group_name: str, workspace_name: str, workspace_manager_configuration_name: str, **kwargs: Any ) -> _models.WorkspaceManagerConfiguration: @@ -18331,7 +19051,7 @@ def create_or_update( resource_group_name: str, workspace_name: str, workspace_manager_configuration_name: str, - workspace_manager_configuration: JSON, + workspace_manager_configuration: _types.WorkspaceManagerConfiguration, *, content_type: str = "application/json", **kwargs: Any @@ -18347,7 +19067,8 @@ def create_or_update( Required. :type workspace_manager_configuration_name: str :param workspace_manager_configuration: The workspace manager configuration. Required. - :type workspace_manager_configuration: JSON + :type workspace_manager_configuration: + ~azure.mgmt.securityinsight.types.WorkspaceManagerConfiguration :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -18390,12 +19111,29 @@ def create_or_update( """ @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "workspace_manager_configuration_name", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def create_or_update( self, resource_group_name: str, workspace_name: str, workspace_manager_configuration_name: str, - workspace_manager_configuration: Union[_models.WorkspaceManagerConfiguration, JSON, IO[bytes]], + workspace_manager_configuration: Union[ + _models.WorkspaceManagerConfiguration, _types.WorkspaceManagerConfiguration, IO[bytes] + ], **kwargs: Any ) -> _models.WorkspaceManagerConfiguration: """Creates or updates a workspace manager configuration. @@ -18408,10 +19146,11 @@ def create_or_update( :param workspace_manager_configuration_name: The name of the workspace manager configuration. Required. :type workspace_manager_configuration_name: str - :param workspace_manager_configuration: The workspace manager configuration. Is one of the - following types: WorkspaceManagerConfiguration, JSON, IO[bytes] Required. + :param workspace_manager_configuration: The workspace manager configuration. Is either a + WorkspaceManagerConfiguration type or a IO[bytes] type. Required. :type workspace_manager_configuration: - ~azure.mgmt.securityinsight.models.WorkspaceManagerConfiguration or JSON or IO[bytes] + ~azure.mgmt.securityinsight.models.WorkspaceManagerConfiguration or + ~azure.mgmt.securityinsight.types.WorkspaceManagerConfiguration or IO[bytes] :return: WorkspaceManagerConfiguration. The WorkspaceManagerConfiguration is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.WorkspaceManagerConfiguration @@ -18486,6 +19225,19 @@ def create_or_update( return deserialized # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "workspace_manager_configuration_name", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def delete( # pylint: disable=inconsistent-return-statements self, resource_group_name: str, workspace_name: str, workspace_manager_configuration_name: str, **kwargs: Any ) -> None: @@ -18549,6 +19301,22 @@ def delete( # pylint: disable=inconsistent-return-statements return cls(pipeline_response, None, {}) # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "orderby", + "top", + "skip_token", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def list( self, resource_group_name: str, @@ -18671,7 +19439,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class WorkspaceManagerGroupsOperations: +class WorkspaceManagerGroupsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -18691,6 +19459,20 @@ def __init__(self, *args, **kwargs) -> None: self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "workspace_manager_group_name", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def get( self, resource_group_name: str, workspace_name: str, workspace_manager_group_name: str, **kwargs: Any ) -> _models.WorkspaceManagerGroup: @@ -18801,7 +19583,7 @@ def create_or_update( resource_group_name: str, workspace_name: str, workspace_manager_group_name: str, - workspace_manager_group: JSON, + workspace_manager_group: _types.WorkspaceManagerGroup, *, content_type: str = "application/json", **kwargs: Any @@ -18816,7 +19598,7 @@ def create_or_update( :param workspace_manager_group_name: The name of the workspace manager group. Required. :type workspace_manager_group_name: str :param workspace_manager_group: The workspace manager group object. Required. - :type workspace_manager_group: JSON + :type workspace_manager_group: ~azure.mgmt.securityinsight.types.WorkspaceManagerGroup :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -18856,12 +19638,27 @@ def create_or_update( """ @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "workspace_manager_group_name", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def create_or_update( self, resource_group_name: str, workspace_name: str, workspace_manager_group_name: str, - workspace_manager_group: Union[_models.WorkspaceManagerGroup, JSON, IO[bytes]], + workspace_manager_group: Union[_models.WorkspaceManagerGroup, _types.WorkspaceManagerGroup, IO[bytes]], **kwargs: Any ) -> _models.WorkspaceManagerGroup: """Creates or updates a workspace manager group. @@ -18873,10 +19670,10 @@ def create_or_update( :type workspace_name: str :param workspace_manager_group_name: The name of the workspace manager group. Required. :type workspace_manager_group_name: str - :param workspace_manager_group: The workspace manager group object. Is one of the following - types: WorkspaceManagerGroup, JSON, IO[bytes] Required. - :type workspace_manager_group: ~azure.mgmt.securityinsight.models.WorkspaceManagerGroup or JSON - or IO[bytes] + :param workspace_manager_group: The workspace manager group object. Is either a + WorkspaceManagerGroup type or a IO[bytes] type. Required. + :type workspace_manager_group: ~azure.mgmt.securityinsight.models.WorkspaceManagerGroup or + ~azure.mgmt.securityinsight.types.WorkspaceManagerGroup or IO[bytes] :return: WorkspaceManagerGroup. The WorkspaceManagerGroup is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.WorkspaceManagerGroup :raises ~azure.core.exceptions.HttpResponseError: @@ -18950,6 +19747,19 @@ def create_or_update( return deserialized # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "workspace_manager_group_name", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def delete( # pylint: disable=inconsistent-return-statements self, resource_group_name: str, workspace_name: str, workspace_manager_group_name: str, **kwargs: Any ) -> None: @@ -19012,6 +19822,22 @@ def delete( # pylint: disable=inconsistent-return-statements return cls(pipeline_response, None, {}) # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "orderby", + "top", + "skip_token", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def list( self, resource_group_name: str, @@ -19133,7 +19959,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class WorkspaceManagerMembersOperations: +class WorkspaceManagerMembersOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -19153,6 +19979,20 @@ def __init__(self, *args, **kwargs) -> None: self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "workspace_manager_member_name", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def get( self, resource_group_name: str, workspace_name: str, workspace_manager_member_name: str, **kwargs: Any ) -> _models.WorkspaceManagerMember: @@ -19263,7 +20103,7 @@ def create_or_update( resource_group_name: str, workspace_name: str, workspace_manager_member_name: str, - workspace_manager_member: JSON, + workspace_manager_member: _types.WorkspaceManagerMember, *, content_type: str = "application/json", **kwargs: Any @@ -19278,7 +20118,7 @@ def create_or_update( :param workspace_manager_member_name: The name of the workspace manager member. Required. :type workspace_manager_member_name: str :param workspace_manager_member: The workspace manager member object. Required. - :type workspace_manager_member: JSON + :type workspace_manager_member: ~azure.mgmt.securityinsight.types.WorkspaceManagerMember :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -19318,12 +20158,27 @@ def create_or_update( """ @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "workspace_manager_member_name", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def create_or_update( self, resource_group_name: str, workspace_name: str, workspace_manager_member_name: str, - workspace_manager_member: Union[_models.WorkspaceManagerMember, JSON, IO[bytes]], + workspace_manager_member: Union[_models.WorkspaceManagerMember, _types.WorkspaceManagerMember, IO[bytes]], **kwargs: Any ) -> _models.WorkspaceManagerMember: """Creates or updates a workspace manager member. @@ -19335,10 +20190,10 @@ def create_or_update( :type workspace_name: str :param workspace_manager_member_name: The name of the workspace manager member. Required. :type workspace_manager_member_name: str - :param workspace_manager_member: The workspace manager member object. Is one of the following - types: WorkspaceManagerMember, JSON, IO[bytes] Required. + :param workspace_manager_member: The workspace manager member object. Is either a + WorkspaceManagerMember type or a IO[bytes] type. Required. :type workspace_manager_member: ~azure.mgmt.securityinsight.models.WorkspaceManagerMember or - JSON or IO[bytes] + ~azure.mgmt.securityinsight.types.WorkspaceManagerMember or IO[bytes] :return: WorkspaceManagerMember. The WorkspaceManagerMember is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.WorkspaceManagerMember :raises ~azure.core.exceptions.HttpResponseError: @@ -19412,6 +20267,19 @@ def create_or_update( return deserialized # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "workspace_manager_member_name", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def delete( # pylint: disable=inconsistent-return-statements self, resource_group_name: str, workspace_name: str, workspace_manager_member_name: str, **kwargs: Any ) -> None: @@ -19474,6 +20342,22 @@ def delete( # pylint: disable=inconsistent-return-statements return cls(pipeline_response, None, {}) # type: ignore @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "orderby", + "top", + "skip_token", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def list( self, resource_group_name: str, @@ -19595,7 +20479,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class AlertRuleOperations: +class AlertRuleOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -19614,12 +20498,28 @@ def __init__(self, *args, **kwargs) -> None: self._serialize: Serializer = input_args.pop(0) if input_args else kwargs.pop("serializer") self._deserialize: Deserializer = input_args.pop(0) if input_args else kwargs.pop("deserializer") + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "rule_id", + "content_type", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def _trigger_rule_run_initial( self, resource_group_name: str, workspace_name: str, rule_id: str, - analytics_rule_run_trigger_parameter: Union[_models.AnalyticsRuleRunTrigger, JSON, IO[bytes]], + analytics_rule_run_trigger_parameter: Union[ + _models.AnalyticsRuleRunTrigger, _types.AnalyticsRuleRunTrigger, IO[bytes] + ], **kwargs: Any ) -> Iterator[bytes]: error_map: MutableMapping = { @@ -19699,7 +20599,7 @@ def begin_trigger_rule_run( *, content_type: str = "application/json", **kwargs: Any - ) -> LROPoller[_models.AlertRule]: + ) -> LROPoller[None]: """triggers analytics rule run. :param resource_group_name: The name of the resource group. The name is case insensitive. @@ -19715,9 +20615,8 @@ def begin_trigger_rule_run( :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str - :return: An instance of LROPoller that returns AlertRule. The AlertRule is compatible with - MutableMapping - :rtype: ~azure.core.polling.LROPoller[~azure.mgmt.securityinsight.models.AlertRule] + :return: An instance of LROPoller that returns None + :rtype: ~azure.core.polling.LROPoller[None] :raises ~azure.core.exceptions.HttpResponseError: """ @@ -19727,11 +20626,11 @@ def begin_trigger_rule_run( resource_group_name: str, workspace_name: str, rule_id: str, - analytics_rule_run_trigger_parameter: JSON, + analytics_rule_run_trigger_parameter: _types.AnalyticsRuleRunTrigger, *, content_type: str = "application/json", **kwargs: Any - ) -> LROPoller[_models.AlertRule]: + ) -> LROPoller[None]: """triggers analytics rule run. :param resource_group_name: The name of the resource group. The name is case insensitive. @@ -19742,13 +20641,13 @@ def begin_trigger_rule_run( :param rule_id: Alert rule ID. Required. :type rule_id: str :param analytics_rule_run_trigger_parameter: The content of the action request. Required. - :type analytics_rule_run_trigger_parameter: JSON + :type analytics_rule_run_trigger_parameter: + ~azure.mgmt.securityinsight.types.AnalyticsRuleRunTrigger :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str - :return: An instance of LROPoller that returns AlertRule. The AlertRule is compatible with - MutableMapping - :rtype: ~azure.core.polling.LROPoller[~azure.mgmt.securityinsight.models.AlertRule] + :return: An instance of LROPoller that returns None + :rtype: ~azure.core.polling.LROPoller[None] :raises ~azure.core.exceptions.HttpResponseError: """ @@ -19762,7 +20661,7 @@ def begin_trigger_rule_run( *, content_type: str = "application/json", **kwargs: Any - ) -> LROPoller[_models.AlertRule]: + ) -> LROPoller[None]: """triggers analytics rule run. :param resource_group_name: The name of the resource group. The name is case insensitive. @@ -19777,21 +20676,36 @@ def begin_trigger_rule_run( :keyword content_type: Body Parameter content-type. Content type parameter for binary body. Default value is "application/json". :paramtype content_type: str - :return: An instance of LROPoller that returns AlertRule. The AlertRule is compatible with - MutableMapping - :rtype: ~azure.core.polling.LROPoller[~azure.mgmt.securityinsight.models.AlertRule] + :return: An instance of LROPoller that returns None + :rtype: ~azure.core.polling.LROPoller[None] :raises ~azure.core.exceptions.HttpResponseError: """ @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "rule_id", + "content_type", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def begin_trigger_rule_run( self, resource_group_name: str, workspace_name: str, rule_id: str, - analytics_rule_run_trigger_parameter: Union[_models.AnalyticsRuleRunTrigger, JSON, IO[bytes]], + analytics_rule_run_trigger_parameter: Union[ + _models.AnalyticsRuleRunTrigger, _types.AnalyticsRuleRunTrigger, IO[bytes] + ], **kwargs: Any - ) -> LROPoller[_models.AlertRule]: + ) -> LROPoller[None]: """triggers analytics rule run. :param resource_group_name: The name of the resource group. The name is case insensitive. @@ -19801,20 +20715,20 @@ def begin_trigger_rule_run( :type workspace_name: str :param rule_id: Alert rule ID. Required. :type rule_id: str - :param analytics_rule_run_trigger_parameter: The content of the action request. Is one of the - following types: AnalyticsRuleRunTrigger, JSON, IO[bytes] Required. + :param analytics_rule_run_trigger_parameter: The content of the action request. Is either a + AnalyticsRuleRunTrigger type or a IO[bytes] type. Required. :type analytics_rule_run_trigger_parameter: - ~azure.mgmt.securityinsight.models.AnalyticsRuleRunTrigger or JSON or IO[bytes] - :return: An instance of LROPoller that returns AlertRule. The AlertRule is compatible with - MutableMapping - :rtype: ~azure.core.polling.LROPoller[~azure.mgmt.securityinsight.models.AlertRule] + ~azure.mgmt.securityinsight.models.AnalyticsRuleRunTrigger or + ~azure.mgmt.securityinsight.types.AnalyticsRuleRunTrigger or IO[bytes] + :return: An instance of LROPoller that returns None + :rtype: ~azure.core.polling.LROPoller[None] :raises ~azure.core.exceptions.HttpResponseError: """ _headers = case_insensitive_dict(kwargs.pop("headers", {}) or {}) _params = kwargs.pop("params", {}) or {} content_type: Optional[str] = kwargs.pop("content_type", _headers.pop("Content-Type", None)) - cls: ClsType[_models.AlertRule] = kwargs.pop("cls", None) + cls: ClsType[None] = kwargs.pop("cls", None) polling: Union[bool, PollingMethod] = kwargs.pop("polling", True) lro_delay = kwargs.pop("polling_interval", self._config.polling_interval) cont_token: Optional[str] = kwargs.pop("continuation_token", None) @@ -19833,15 +20747,9 @@ def begin_trigger_rule_run( raw_result.http_response.read() # type: ignore kwargs.pop("error_map", None) - def get_long_running_output(pipeline_response): - response_headers = {} - response = pipeline_response.http_response - response_headers["Location"] = self._deserialize("str", response.headers.get("Location")) - - deserialized = _deserialize(_models.AlertRule, response.json()) + def get_long_running_output(pipeline_response): # pylint: disable=inconsistent-return-statements if cls: - return cls(pipeline_response, deserialized, response_headers) # type: ignore - return deserialized + return cls(pipeline_response, None, {}) # type: ignore path_format_arguments = { "endpoint": self._serialize.url("self._config.base_url", self._config.base_url, "str", skip_quote=True), @@ -19856,18 +20764,16 @@ def get_long_running_output(pipeline_response): else: polling_method = polling if cont_token: - return LROPoller[_models.AlertRule].from_continuation_token( + return LROPoller[None].from_continuation_token( polling_method=polling_method, continuation_token=cont_token, client=self._client, deserialization_callback=get_long_running_output, ) - return LROPoller[_models.AlertRule]( - self._client, raw_result, get_long_running_output, polling_method # type: ignore - ) + return LROPoller[None](self._client, raw_result, get_long_running_output, polling_method) # type: ignore -class ActionsOperations: +class ActionsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -20004,7 +20910,7 @@ def create_or_update( workspace_name: str, rule_id: str, action_id: str, - action: JSON, + action: _types.ActionRequest, *, content_type: str = "application/json", **kwargs: Any @@ -20021,7 +20927,7 @@ def create_or_update( :param action_id: Action ID. Required. :type action_id: str :param action: The action. Required. - :type action: JSON + :type action: ~azure.mgmt.securityinsight.types.ActionRequest :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -20070,7 +20976,7 @@ def create_or_update( workspace_name: str, rule_id: str, action_id: str, - action: Union[_models.ActionRequest, JSON, IO[bytes]], + action: Union[_models.ActionRequest, _types.ActionRequest, IO[bytes]], **kwargs: Any ) -> _models.ActionResponse: """Creates or updates the action of alert rule. @@ -20084,9 +20990,9 @@ def create_or_update( :type rule_id: str :param action_id: Action ID. Required. :type action_id: str - :param action: The action. Is one of the following types: ActionRequest, JSON, IO[bytes] - Required. - :type action: ~azure.mgmt.securityinsight.models.ActionRequest or JSON or IO[bytes] + :param action: The action. Is either a ActionRequest type or a IO[bytes] type. Required. + :type action: ~azure.mgmt.securityinsight.models.ActionRequest or + ~azure.mgmt.securityinsight.types.ActionRequest or IO[bytes] :return: ActionResponse. The ActionResponse is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.ActionResponse :raises ~azure.core.exceptions.HttpResponseError: @@ -20331,7 +21237,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class BookmarkOperations: +class BookmarkOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -20386,7 +21292,7 @@ def expand( resource_group_name: str, workspace_name: str, bookmark_id: str, - parameters: JSON, + parameters: _types.BookmarkExpandParameters, *, content_type: str = "application/json", **kwargs: Any @@ -20401,7 +21307,7 @@ def expand( :param bookmark_id: Bookmark ID. Required. :type bookmark_id: str :param parameters: The content of the action request. Required. - :type parameters: JSON + :type parameters: ~azure.mgmt.securityinsight.types.BookmarkExpandParameters :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -20441,12 +21347,27 @@ def expand( """ @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "bookmark_id", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def expand( self, resource_group_name: str, workspace_name: str, bookmark_id: str, - parameters: Union[_models.BookmarkExpandParameters, JSON, IO[bytes]], + parameters: Union[_models.BookmarkExpandParameters, _types.BookmarkExpandParameters, IO[bytes]], **kwargs: Any ) -> _models.BookmarkExpandResponse: """Expand an bookmark. @@ -20458,10 +21379,10 @@ def expand( :type workspace_name: str :param bookmark_id: Bookmark ID. Required. :type bookmark_id: str - :param parameters: The content of the action request. Is one of the following types: - BookmarkExpandParameters, JSON, IO[bytes] Required. - :type parameters: ~azure.mgmt.securityinsight.models.BookmarkExpandParameters or JSON or - IO[bytes] + :param parameters: The content of the action request. Is either a BookmarkExpandParameters type + or a IO[bytes] type. Required. + :type parameters: ~azure.mgmt.securityinsight.models.BookmarkExpandParameters or + ~azure.mgmt.securityinsight.types.BookmarkExpandParameters or IO[bytes] :return: BookmarkExpandResponse. The BookmarkExpandResponse is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.BookmarkExpandResponse :raises ~azure.core.exceptions.HttpResponseError: @@ -20535,7 +21456,7 @@ def expand( return deserialized # type: ignore -class ContentPackagesOperations: +class ContentPackagesOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -20770,7 +21691,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class ContentPackageOperations: +class ContentPackageOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -20825,7 +21746,7 @@ def install( resource_group_name: str, workspace_name: str, package_id: str, - package_installation_properties: JSON, + package_installation_properties: _types.PackageModel, *, content_type: str = "application/json", **kwargs: Any @@ -20840,7 +21761,7 @@ def install( :param package_id: package Id. Required. :type package_id: str :param package_installation_properties: Package installation properties. Required. - :type package_installation_properties: JSON + :type package_installation_properties: ~azure.mgmt.securityinsight.types.PackageModel :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -20885,7 +21806,7 @@ def install( resource_group_name: str, workspace_name: str, package_id: str, - package_installation_properties: Union[_models.PackageModel, JSON, IO[bytes]], + package_installation_properties: Union[_models.PackageModel, _types.PackageModel, IO[bytes]], **kwargs: Any ) -> _models.PackageModel: """Install a package to the workspace. @@ -20897,10 +21818,10 @@ def install( :type workspace_name: str :param package_id: package Id. Required. :type package_id: str - :param package_installation_properties: Package installation properties. Is one of the - following types: PackageModel, JSON, IO[bytes] Required. - :type package_installation_properties: ~azure.mgmt.securityinsight.models.PackageModel or JSON - or IO[bytes] + :param package_installation_properties: Package installation properties. Is either a + PackageModel type or a IO[bytes] type. Required. + :type package_installation_properties: ~azure.mgmt.securityinsight.models.PackageModel or + ~azure.mgmt.securityinsight.types.PackageModel or IO[bytes] :return: PackageModel. The PackageModel is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.PackageModel :raises ~azure.core.exceptions.HttpResponseError: @@ -21036,7 +21957,7 @@ def uninstall( # pylint: disable=inconsistent-return-statements return cls(pipeline_response, None, {}) # type: ignore -class ProductPackageOperations: +class ProductPackageOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -21131,7 +22052,7 @@ def get( return deserialized # type: ignore -class ProductPackagesOperations: +class ProductPackagesOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -21285,7 +22206,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class ProductTemplateOperations: +class ProductTemplateOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -21380,7 +22301,7 @@ def get( return deserialized # type: ignore -class ProductTemplatesOperations: +class ProductTemplatesOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -21540,7 +22461,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class ContentTemplateOperations: +class ContentTemplateOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -21674,7 +22595,7 @@ def install( resource_group_name: str, workspace_name: str, template_id: str, - template_installation_properties: JSON, + template_installation_properties: _types.TemplateModel, *, content_type: str = "application/json", **kwargs: Any @@ -21689,7 +22610,7 @@ def install( :param template_id: template Id. Required. :type template_id: str :param template_installation_properties: Template installation properties. Required. - :type template_installation_properties: JSON + :type template_installation_properties: ~azure.mgmt.securityinsight.types.TemplateModel :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -21734,7 +22655,7 @@ def install( resource_group_name: str, workspace_name: str, template_id: str, - template_installation_properties: Union[_models.TemplateModel, JSON, IO[bytes]], + template_installation_properties: Union[_models.TemplateModel, _types.TemplateModel, IO[bytes]], **kwargs: Any ) -> _models.TemplateModel: """Install a template. @@ -21746,10 +22667,10 @@ def install( :type workspace_name: str :param template_id: template Id. Required. :type template_id: str - :param template_installation_properties: Template installation properties. Is one of the - following types: TemplateModel, JSON, IO[bytes] Required. + :param template_installation_properties: Template installation properties. Is either a + TemplateModel type or a IO[bytes] type. Required. :type template_installation_properties: ~azure.mgmt.securityinsight.models.TemplateModel or - JSON or IO[bytes] + ~azure.mgmt.securityinsight.types.TemplateModel or IO[bytes] :return: TemplateModel. The TemplateModel is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.TemplateModel :raises ~azure.core.exceptions.HttpResponseError: @@ -21885,7 +22806,7 @@ def delete( # pylint: disable=inconsistent-return-statements return cls(pipeline_response, None, {}) # type: ignore -class ContentTemplatesOperations: +class ContentTemplatesOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -22054,7 +22975,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class IncidentRelationsOperations: +class IncidentRelationsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -22191,7 +23112,7 @@ def create_or_update( workspace_name: str, incident_id: str, relation_name: str, - relation: JSON, + relation: _types.Relation, *, content_type: str = "application/json", **kwargs: Any @@ -22208,7 +23129,7 @@ def create_or_update( :param relation_name: Relation Name. Required. :type relation_name: str :param relation: The relation model. Required. - :type relation: JSON + :type relation: ~azure.mgmt.securityinsight.types.Relation :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -22257,7 +23178,7 @@ def create_or_update( workspace_name: str, incident_id: str, relation_name: str, - relation: Union[_models.Relation, JSON, IO[bytes]], + relation: Union[_models.Relation, _types.Relation, IO[bytes]], **kwargs: Any ) -> _models.Relation: """Creates or updates the incident relation. @@ -22271,9 +23192,9 @@ def create_or_update( :type incident_id: str :param relation_name: Relation Name. Required. :type relation_name: str - :param relation: The relation model. Is one of the following types: Relation, JSON, IO[bytes] - Required. - :type relation: ~azure.mgmt.securityinsight.models.Relation or JSON or IO[bytes] + :param relation: The relation model. Is either a Relation type or a IO[bytes] type. Required. + :type relation: ~azure.mgmt.securityinsight.models.Relation or + ~azure.mgmt.securityinsight.types.Relation or IO[bytes] :return: Relation. The Relation is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.Relation :raises ~azure.core.exceptions.HttpResponseError: @@ -22543,7 +23464,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class EntitiesRelationsOperations: +class EntitiesRelationsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -22693,7 +23614,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class MetadataOperations: +class MetadataOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -22823,7 +23744,7 @@ def create( resource_group_name: str, workspace_name: str, metadata_name: str, - metadata: JSON, + metadata: _types.MetadataModel, *, content_type: str = "application/json", **kwargs: Any @@ -22838,7 +23759,7 @@ def create( :param metadata_name: The Metadata name. Required. :type metadata_name: str :param metadata: Metadata resource. Required. - :type metadata: JSON + :type metadata: ~azure.mgmt.securityinsight.types.MetadataModel :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -22883,7 +23804,7 @@ def create( resource_group_name: str, workspace_name: str, metadata_name: str, - metadata: Union[_models.MetadataModel, JSON, IO[bytes]], + metadata: Union[_models.MetadataModel, _types.MetadataModel, IO[bytes]], **kwargs: Any ) -> _models.MetadataModel: """Create a Metadata. @@ -22895,9 +23816,10 @@ def create( :type workspace_name: str :param metadata_name: The Metadata name. Required. :type metadata_name: str - :param metadata: Metadata resource. Is one of the following types: MetadataModel, JSON, - IO[bytes] Required. - :type metadata: ~azure.mgmt.securityinsight.models.MetadataModel or JSON or IO[bytes] + :param metadata: Metadata resource. Is either a MetadataModel type or a IO[bytes] type. + Required. + :type metadata: ~azure.mgmt.securityinsight.models.MetadataModel or + ~azure.mgmt.securityinsight.types.MetadataModel or IO[bytes] :return: MetadataModel. The MetadataModel is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.MetadataModel :raises ~azure.core.exceptions.HttpResponseError: @@ -23006,7 +23928,7 @@ def update( resource_group_name: str, workspace_name: str, metadata_name: str, - metadata_patch: JSON, + metadata_patch: _types.MetadataPatch, *, content_type: str = "application/json", **kwargs: Any @@ -23021,7 +23943,7 @@ def update( :param metadata_name: The Metadata name. Required. :type metadata_name: str :param metadata_patch: Partial metadata request. Required. - :type metadata_patch: JSON + :type metadata_patch: ~azure.mgmt.securityinsight.types.MetadataPatch :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -23066,7 +23988,7 @@ def update( resource_group_name: str, workspace_name: str, metadata_name: str, - metadata_patch: Union[_models.MetadataPatch, JSON, IO[bytes]], + metadata_patch: Union[_models.MetadataPatch, _types.MetadataPatch, IO[bytes]], **kwargs: Any ) -> _models.MetadataModel: """Update an existing Metadata. @@ -23078,9 +24000,10 @@ def update( :type workspace_name: str :param metadata_name: The Metadata name. Required. :type metadata_name: str - :param metadata_patch: Partial metadata request. Is one of the following types: MetadataPatch, - JSON, IO[bytes] Required. - :type metadata_patch: ~azure.mgmt.securityinsight.models.MetadataPatch or JSON or IO[bytes] + :param metadata_patch: Partial metadata request. Is either a MetadataPatch type or a IO[bytes] + type. Required. + :type metadata_patch: ~azure.mgmt.securityinsight.models.MetadataPatch or + ~azure.mgmt.securityinsight.types.MetadataPatch or IO[bytes] :return: MetadataModel. The MetadataModel is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.MetadataModel :raises ~azure.core.exceptions.HttpResponseError: @@ -23340,7 +24263,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class ThreatIntelligenceIndicatorOperations: +class ThreatIntelligenceIndicatorOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -23474,7 +24397,7 @@ def create( resource_group_name: str, workspace_name: str, name: str, - threat_intelligence_properties: JSON, + threat_intelligence_properties: _types.ThreatIntelligenceIndicatorModel, *, content_type: str = "application/json", **kwargs: Any @@ -23490,7 +24413,8 @@ def create( :type name: str :param threat_intelligence_properties: Properties of threat intelligence indicators to create and update. Required. - :type threat_intelligence_properties: JSON + :type threat_intelligence_properties: + ~azure.mgmt.securityinsight.types.ThreatIntelligenceIndicatorModel :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -23538,7 +24462,9 @@ def create( resource_group_name: str, workspace_name: str, name: str, - threat_intelligence_properties: Union[_models.ThreatIntelligenceIndicatorModel, JSON, IO[bytes]], + threat_intelligence_properties: Union[ + _models.ThreatIntelligenceIndicatorModel, _types.ThreatIntelligenceIndicatorModel, IO[bytes] + ], **kwargs: Any ) -> _models.ThreatIntelligenceInformation: """Update a threat Intelligence indicator. @@ -23551,10 +24477,10 @@ def create( :param name: Threat intelligence indicator name field. Required. :type name: str :param threat_intelligence_properties: Properties of threat intelligence indicators to create - and update. Is one of the following types: ThreatIntelligenceIndicatorModel, JSON, IO[bytes] - Required. + and update. Is either a ThreatIntelligenceIndicatorModel type or a IO[bytes] type. Required. :type threat_intelligence_properties: - ~azure.mgmt.securityinsight.models.ThreatIntelligenceIndicatorModel or JSON or IO[bytes] + ~azure.mgmt.securityinsight.models.ThreatIntelligenceIndicatorModel or + ~azure.mgmt.securityinsight.types.ThreatIntelligenceIndicatorModel or IO[bytes] :return: ThreatIntelligenceInformation. The ThreatIntelligenceInformation is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.ThreatIntelligenceInformation @@ -23728,7 +24654,7 @@ def append_tags( resource_group_name: str, workspace_name: str, name: str, - threat_intelligence_append_tags: JSON, + threat_intelligence_append_tags: _types.ThreatIntelligenceAppendTags, *, content_type: str = "application/json", **kwargs: Any @@ -23744,7 +24670,8 @@ def append_tags( :type name: str :param threat_intelligence_append_tags: The threat intelligence append tags request body. Required. - :type threat_intelligence_append_tags: JSON + :type threat_intelligence_append_tags: + ~azure.mgmt.securityinsight.types.ThreatIntelligenceAppendTags :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -23790,7 +24717,9 @@ def append_tags( # pylint: disable=inconsistent-return-statements resource_group_name: str, workspace_name: str, name: str, - threat_intelligence_append_tags: Union[_models.ThreatIntelligenceAppendTags, JSON, IO[bytes]], + threat_intelligence_append_tags: Union[ + _models.ThreatIntelligenceAppendTags, _types.ThreatIntelligenceAppendTags, IO[bytes] + ], **kwargs: Any ) -> None: """Append tags to a threat intelligence indicator. @@ -23803,9 +24732,10 @@ def append_tags( # pylint: disable=inconsistent-return-statements :param name: Threat intelligence indicator name field. Required. :type name: str :param threat_intelligence_append_tags: The threat intelligence append tags request body. Is - one of the following types: ThreatIntelligenceAppendTags, JSON, IO[bytes] Required. + either a ThreatIntelligenceAppendTags type or a IO[bytes] type. Required. :type threat_intelligence_append_tags: - ~azure.mgmt.securityinsight.models.ThreatIntelligenceAppendTags or JSON or IO[bytes] + ~azure.mgmt.securityinsight.models.ThreatIntelligenceAppendTags or + ~azure.mgmt.securityinsight.types.ThreatIntelligenceAppendTags or IO[bytes] :return: None :rtype: None :raises ~azure.core.exceptions.HttpResponseError: @@ -23904,7 +24834,7 @@ def replace_tags( resource_group_name: str, workspace_name: str, name: str, - threat_intelligence_replace_tags: JSON, + threat_intelligence_replace_tags: _types.ThreatIntelligenceIndicatorModel, *, content_type: str = "application/json", **kwargs: Any @@ -23920,7 +24850,8 @@ def replace_tags( :type name: str :param threat_intelligence_replace_tags: Tags in the threat intelligence indicator to be replaced. Required. - :type threat_intelligence_replace_tags: JSON + :type threat_intelligence_replace_tags: + ~azure.mgmt.securityinsight.types.ThreatIntelligenceIndicatorModel :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -23968,7 +24899,9 @@ def replace_tags( resource_group_name: str, workspace_name: str, name: str, - threat_intelligence_replace_tags: Union[_models.ThreatIntelligenceIndicatorModel, JSON, IO[bytes]], + threat_intelligence_replace_tags: Union[ + _models.ThreatIntelligenceIndicatorModel, _types.ThreatIntelligenceIndicatorModel, IO[bytes] + ], **kwargs: Any ) -> _models.ThreatIntelligenceInformation: """Replace tags added to a threat intelligence indicator. @@ -23981,10 +24914,10 @@ def replace_tags( :param name: Threat intelligence indicator name field. Required. :type name: str :param threat_intelligence_replace_tags: Tags in the threat intelligence indicator to be - replaced. Is one of the following types: ThreatIntelligenceIndicatorModel, JSON, IO[bytes] - Required. + replaced. Is either a ThreatIntelligenceIndicatorModel type or a IO[bytes] type. Required. :type threat_intelligence_replace_tags: - ~azure.mgmt.securityinsight.models.ThreatIntelligenceIndicatorModel or JSON or IO[bytes] + ~azure.mgmt.securityinsight.models.ThreatIntelligenceIndicatorModel or + ~azure.mgmt.securityinsight.types.ThreatIntelligenceIndicatorModel or IO[bytes] :return: ThreatIntelligenceInformation. The ThreatIntelligenceInformation is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.ThreatIntelligenceInformation @@ -24092,7 +25025,7 @@ def create_indicator( self, resource_group_name: str, workspace_name: str, - threat_intelligence_properties: JSON, + threat_intelligence_properties: _types.ThreatIntelligenceIndicatorModel, *, content_type: str = "application/json", **kwargs: Any @@ -24105,7 +25038,8 @@ def create_indicator( :param workspace_name: The name of the monitor workspace. Required. :type workspace_name: str :param threat_intelligence_properties: The content of the action request. Required. - :type threat_intelligence_properties: JSON + :type threat_intelligence_properties: + ~azure.mgmt.securityinsight.types.ThreatIntelligenceIndicatorModel :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -24148,7 +25082,9 @@ def create_indicator( self, resource_group_name: str, workspace_name: str, - threat_intelligence_properties: Union[_models.ThreatIntelligenceIndicatorModel, JSON, IO[bytes]], + threat_intelligence_properties: Union[ + _models.ThreatIntelligenceIndicatorModel, _types.ThreatIntelligenceIndicatorModel, IO[bytes] + ], **kwargs: Any ) -> _models.ThreatIntelligenceInformation: """Create a new threat intelligence indicator. @@ -24158,10 +25094,11 @@ def create_indicator( :type resource_group_name: str :param workspace_name: The name of the monitor workspace. Required. :type workspace_name: str - :param threat_intelligence_properties: The content of the action request. Is one of the - following types: ThreatIntelligenceIndicatorModel, JSON, IO[bytes] Required. + :param threat_intelligence_properties: The content of the action request. Is either a + ThreatIntelligenceIndicatorModel type or a IO[bytes] type. Required. :type threat_intelligence_properties: - ~azure.mgmt.securityinsight.models.ThreatIntelligenceIndicatorModel or JSON or IO[bytes] + ~azure.mgmt.securityinsight.models.ThreatIntelligenceIndicatorModel or + ~azure.mgmt.securityinsight.types.ThreatIntelligenceIndicatorModel or IO[bytes] :return: ThreatIntelligenceInformation. The ThreatIntelligenceInformation is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.ThreatIntelligenceInformation @@ -24268,7 +25205,7 @@ def query_indicators( self, resource_group_name: str, workspace_name: str, - threat_intelligence_filtering_criteria: JSON, + threat_intelligence_filtering_criteria: _types.ThreatIntelligenceFilteringCriteria, *, content_type: str = "application/json", **kwargs: Any @@ -24281,7 +25218,8 @@ def query_indicators( :param workspace_name: The name of the monitor workspace. Required. :type workspace_name: str :param threat_intelligence_filtering_criteria: The content of the action request. Required. - :type threat_intelligence_filtering_criteria: JSON + :type threat_intelligence_filtering_criteria: + ~azure.mgmt.securityinsight.types.ThreatIntelligenceFilteringCriteria :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -24324,7 +25262,9 @@ def query_indicators( self, resource_group_name: str, workspace_name: str, - threat_intelligence_filtering_criteria: Union[_models.ThreatIntelligenceFilteringCriteria, JSON, IO[bytes]], + threat_intelligence_filtering_criteria: Union[ + _models.ThreatIntelligenceFilteringCriteria, _types.ThreatIntelligenceFilteringCriteria, IO[bytes] + ], **kwargs: Any ) -> ItemPaged["_models.ThreatIntelligenceInformation"]: """Query threat intelligence indicators as per filtering criteria. @@ -24334,10 +25274,11 @@ def query_indicators( :type resource_group_name: str :param workspace_name: The name of the monitor workspace. Required. :type workspace_name: str - :param threat_intelligence_filtering_criteria: The content of the action request. Is one of the - following types: ThreatIntelligenceFilteringCriteria, JSON, IO[bytes] Required. + :param threat_intelligence_filtering_criteria: The content of the action request. Is either a + ThreatIntelligenceFilteringCriteria type or a IO[bytes] type. Required. :type threat_intelligence_filtering_criteria: - ~azure.mgmt.securityinsight.models.ThreatIntelligenceFilteringCriteria or JSON or IO[bytes] + ~azure.mgmt.securityinsight.models.ThreatIntelligenceFilteringCriteria or + ~azure.mgmt.securityinsight.types.ThreatIntelligenceFilteringCriteria or IO[bytes] :return: An iterator like instance of ThreatIntelligenceInformation :rtype: ~azure.core.paging.ItemPaged[~azure.mgmt.securityinsight.models.ThreatIntelligenceInformation] @@ -24440,7 +25381,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class ThreatIntelligenceIndicatorsOperations: +class ThreatIntelligenceIndicatorsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -24587,7 +25528,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class DataConnectorsCheckRequirementsOperations: # pylint: disable=name-too-long +class DataConnectorsCheckRequirementsOperations: # pylint: disable=docstring-missing-param,name-too-long """ .. warning:: **DO NOT** instantiate this class directly. @@ -24641,7 +25582,7 @@ def post( self, resource_group_name: str, workspace_name: str, - data_connectors_check_requirements: JSON, + data_connectors_check_requirements: _types.DataConnectorsCheckRequirements, *, content_type: str = "application/json", **kwargs: Any @@ -24655,7 +25596,8 @@ def post( :type workspace_name: str :param data_connectors_check_requirements: The parameters for requirements check message. Required. - :type data_connectors_check_requirements: JSON + :type data_connectors_check_requirements: + ~azure.mgmt.securityinsight.types.DataConnectorsCheckRequirements :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -24699,7 +25641,9 @@ def post( self, resource_group_name: str, workspace_name: str, - data_connectors_check_requirements: Union[_models.DataConnectorsCheckRequirements, JSON, IO[bytes]], + data_connectors_check_requirements: Union[ + _models.DataConnectorsCheckRequirements, _types.DataConnectorsCheckRequirements, IO[bytes] + ], **kwargs: Any ) -> _models.DataConnectorRequirementsState: """Get requirements state for a data connector type. @@ -24710,9 +25654,10 @@ def post( :param workspace_name: The name of the workspace. Required. :type workspace_name: str :param data_connectors_check_requirements: The parameters for requirements check message. Is - one of the following types: DataConnectorsCheckRequirements, JSON, IO[bytes] Required. + either a DataConnectorsCheckRequirements type or a IO[bytes] type. Required. :type data_connectors_check_requirements: - ~azure.mgmt.securityinsight.models.DataConnectorsCheckRequirements or JSON or IO[bytes] + ~azure.mgmt.securityinsight.models.DataConnectorsCheckRequirements or + ~azure.mgmt.securityinsight.types.DataConnectorsCheckRequirements or IO[bytes] :return: DataConnectorRequirementsState. The DataConnectorRequirementsState is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.DataConnectorRequirementsState @@ -24786,7 +25731,7 @@ def post( return deserialized # type: ignore -class SourceControlOperations: +class SourceControlOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -24837,7 +25782,7 @@ def list_repositories( self, resource_group_name: str, workspace_name: str, - repository_access: JSON, + repository_access: _types.RepositoryAccessProperties, *, content_type: str = "application/json", **kwargs: Any @@ -24850,7 +25795,7 @@ def list_repositories( :param workspace_name: The name of the workspace. Required. :type workspace_name: str :param repository_access: The content of the action request. Required. - :type repository_access: JSON + :type repository_access: ~azure.mgmt.securityinsight.types.RepositoryAccessProperties :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -24891,7 +25836,7 @@ def list_repositories( self, resource_group_name: str, workspace_name: str, - repository_access: Union[_models.RepositoryAccessProperties, JSON, IO[bytes]], + repository_access: Union[_models.RepositoryAccessProperties, _types.RepositoryAccessProperties, IO[bytes]], **kwargs: Any ) -> ItemPaged["_models.Repo"]: """Gets a list of repositories metadata. @@ -24901,10 +25846,10 @@ def list_repositories( :type resource_group_name: str :param workspace_name: The name of the workspace. Required. :type workspace_name: str - :param repository_access: The content of the action request. Is one of the following types: - RepositoryAccessProperties, JSON, IO[bytes] Required. - :type repository_access: ~azure.mgmt.securityinsight.models.RepositoryAccessProperties or JSON - or IO[bytes] + :param repository_access: The content of the action request. Is either a + RepositoryAccessProperties type or a IO[bytes] type. Required. + :type repository_access: ~azure.mgmt.securityinsight.models.RepositoryAccessProperties or + ~azure.mgmt.securityinsight.types.RepositoryAccessProperties or IO[bytes] :return: An iterator like instance of Repo :rtype: ~azure.core.paging.ItemPaged[~azure.mgmt.securityinsight.models.Repo] :raises ~azure.core.exceptions.HttpResponseError: @@ -25006,7 +25951,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class ThreatIntelligenceIndicatorMetricsOperations: # pylint: disable=name-too-long +class ThreatIntelligenceIndicatorMetricsOperations: # pylint: disable=docstring-missing-param,name-too-long """ .. warning:: **DO NOT** instantiate this class directly. @@ -25099,7 +26044,7 @@ def list( return deserialized # type: ignore -class ThreatIntelligenceOperations: +class ThreatIntelligenceOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -25154,7 +26099,7 @@ def count( resource_group_name: str, workspace_name: str, ti_type: Union[str, _models.TiType], - query: Optional[JSON] = None, + query: Optional[_types.CountQuery] = None, *, content_type: str = "application/json", **kwargs: Any @@ -25169,7 +26114,7 @@ def count( :param ti_type: TI type. "main" Required. :type ti_type: str or ~azure.mgmt.securityinsight.models.TiType :param query: The query to run on the TI objects in the workspace. Default value is None. - :type query: JSON + :type query: ~azure.mgmt.securityinsight.types.CountQuery :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -25214,7 +26159,7 @@ def count( resource_group_name: str, workspace_name: str, ti_type: Union[str, _models.TiType], - query: Optional[Union[_models.CountQuery, JSON, IO[bytes]]] = None, + query: Optional[Union[_models.CountQuery, _types.CountQuery, IO[bytes]]] = None, **kwargs: Any ) -> _models.ThreatIntelligenceCount: """Gets the count of all TI objects for the workspace. @@ -25226,9 +26171,10 @@ def count( :type workspace_name: str :param ti_type: TI type. "main" Required. :type ti_type: str or ~azure.mgmt.securityinsight.models.TiType - :param query: The query to run on the TI objects in the workspace. Is one of the following - types: CountQuery, JSON, IO[bytes] Default value is None. - :type query: ~azure.mgmt.securityinsight.models.CountQuery or JSON or IO[bytes] + :param query: The query to run on the TI objects in the workspace. Is either a CountQuery type + or a IO[bytes] type. Default value is None. + :type query: ~azure.mgmt.securityinsight.models.CountQuery or + ~azure.mgmt.securityinsight.types.CountQuery or IO[bytes] :return: ThreatIntelligenceCount. The ThreatIntelligenceCount is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.ThreatIntelligenceCount :raises ~azure.core.exceptions.HttpResponseError: @@ -25341,7 +26287,7 @@ def query( resource_group_name: str, workspace_name: str, ti_type: Union[str, _models.TiType], - query: Optional[JSON] = None, + query: Optional[_types.Query] = None, *, content_type: str = "application/json", **kwargs: Any @@ -25356,7 +26302,7 @@ def query( :param ti_type: TI type. "main" Required. :type ti_type: str or ~azure.mgmt.securityinsight.models.TiType :param query: The query to run on the TI objects in the workspace. Default value is None. - :type query: JSON + :type query: ~azure.mgmt.securityinsight.types.Query :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -25401,7 +26347,7 @@ def query( resource_group_name: str, workspace_name: str, ti_type: Union[str, _models.TiType], - query: Optional[Union[_models.Query, JSON, IO[bytes]]] = None, + query: Optional[Union[_models.Query, _types.Query, IO[bytes]]] = None, **kwargs: Any ) -> ItemPaged["_models.TIObject"]: """Gets all TI objects for the workspace. @@ -25413,9 +26359,10 @@ def query( :type workspace_name: str :param ti_type: TI type. "main" Required. :type ti_type: str or ~azure.mgmt.securityinsight.models.TiType - :param query: The query to run on the TI objects in the workspace. Is one of the following - types: Query, JSON, IO[bytes] Default value is None. - :type query: ~azure.mgmt.securityinsight.models.Query or JSON or IO[bytes] + :param query: The query to run on the TI objects in the workspace. Is either a Query type or a + IO[bytes] type. Default value is None. + :type query: ~azure.mgmt.securityinsight.models.Query or + ~azure.mgmt.securityinsight.types.Query or IO[bytes] :return: An iterator like instance of TIObject :rtype: ~azure.core.paging.ItemPaged[~azure.mgmt.securityinsight.models.TIObject] :raises ~azure.core.exceptions.HttpResponseError: @@ -25522,7 +26469,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class EntitiesGetTimelineOperations: +class EntitiesGetTimelineOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -25578,7 +26525,7 @@ def list( resource_group_name: str, workspace_name: str, entity_id: str, - parameters: JSON, + parameters: _types.EntityTimelineParameters, *, content_type: str = "application/json", **kwargs: Any @@ -25594,7 +26541,7 @@ def list( :type entity_id: str :param parameters: The parameters required to execute an timeline operation on the given entity. Required. - :type parameters: JSON + :type parameters: ~azure.mgmt.securityinsight.types.EntityTimelineParameters :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -25635,12 +26582,27 @@ def list( """ @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "entity_id", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def list( self, resource_group_name: str, workspace_name: str, entity_id: str, - parameters: Union[_models.EntityTimelineParameters, JSON, IO[bytes]], + parameters: Union[_models.EntityTimelineParameters, _types.EntityTimelineParameters, IO[bytes]], **kwargs: Any ) -> _models.EntityTimelineResponse: """Timeline for an entity. @@ -25653,9 +26615,9 @@ def list( :param entity_id: entity ID. Required. :type entity_id: str :param parameters: The parameters required to execute an timeline operation on the given - entity. Is one of the following types: EntityTimelineParameters, JSON, IO[bytes] Required. - :type parameters: ~azure.mgmt.securityinsight.models.EntityTimelineParameters or JSON or - IO[bytes] + entity. Is either a EntityTimelineParameters type or a IO[bytes] type. Required. + :type parameters: ~azure.mgmt.securityinsight.models.EntityTimelineParameters or + ~azure.mgmt.securityinsight.types.EntityTimelineParameters or IO[bytes] :return: EntityTimelineResponse. The EntityTimelineResponse is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.EntityTimelineResponse :raises ~azure.core.exceptions.HttpResponseError: @@ -25729,7 +26691,7 @@ def list( return deserialized # type: ignore -class GetOperations: +class GetOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -25824,7 +26786,7 @@ def single_recommendation( return deserialized # type: ignore -class UpdateOperations: +class UpdateOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -25879,7 +26841,7 @@ def recommendation( resource_group_name: str, workspace_name: str, recommendation_id: str, - recommendation_patch: JSON, + recommendation_patch: _types.RecommendationPatch, *, content_type: str = "application/json", **kwargs: Any @@ -25894,7 +26856,7 @@ def recommendation( :param recommendation_id: Recommendation Id. Required. :type recommendation_id: str :param recommendation_patch: Recommendation Fields to Update. Required. - :type recommendation_patch: JSON + :type recommendation_patch: ~azure.mgmt.securityinsight.types.RecommendationPatch :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -25939,7 +26901,7 @@ def recommendation( resource_group_name: str, workspace_name: str, recommendation_id: str, - recommendation_patch: Union[_models.RecommendationPatch, JSON, IO[bytes]], + recommendation_patch: Union[_models.RecommendationPatch, _types.RecommendationPatch, IO[bytes]], **kwargs: Any ) -> _models.Recommendation: """Patch a recommendation. @@ -25951,10 +26913,10 @@ def recommendation( :type workspace_name: str :param recommendation_id: Recommendation Id. Required. :type recommendation_id: str - :param recommendation_patch: Recommendation Fields to Update. Is one of the following types: - RecommendationPatch, JSON, IO[bytes] Required. - :type recommendation_patch: ~azure.mgmt.securityinsight.models.RecommendationPatch or JSON or - IO[bytes] + :param recommendation_patch: Recommendation Fields to Update. Is either a RecommendationPatch + type or a IO[bytes] type. Required. + :type recommendation_patch: ~azure.mgmt.securityinsight.models.RecommendationPatch or + ~azure.mgmt.securityinsight.types.RecommendationPatch or IO[bytes] :return: Recommendation. The Recommendation is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.Recommendation :raises ~azure.core.exceptions.HttpResponseError: @@ -26028,7 +26990,7 @@ def recommendation( return deserialized # type: ignore -class GetRecommendationsOperations: +class GetRecommendationsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -26148,7 +27110,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class ReevaluateOperations: +class ReevaluateOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -26243,7 +27205,7 @@ def recommendation( return deserialized # type: ignore -class TriggeredAnalyticsRuleRunOperations: +class TriggeredAnalyticsRuleRunOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -26339,7 +27301,7 @@ def get( return deserialized # type: ignore -class GetTriggeredAnalyticsRuleRunsOperations: +class GetTriggeredAnalyticsRuleRunsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -26462,7 +27424,7 @@ def get_next(next_link=None): return ItemPaged(get_next, extract_data) -class WorkspaceManagerAssignmentJobsOperations: +class WorkspaceManagerAssignmentJobsOperations: # pylint: disable=docstring-missing-param """ .. warning:: **DO NOT** instantiate this class directly. @@ -26879,7 +27841,7 @@ def list_geodata_by_ip( resource_group_name: str, workspace_name: str, enrichment_type: Union[str, _models.EnrichmentType], - ip_address_body: JSON, + ip_address_body: _types.EnrichmentIpAddressBody, *, content_type: str = "application/json", **kwargs: Any @@ -26894,7 +27856,7 @@ def list_geodata_by_ip( :param enrichment_type: Enrichment type. "main" Required. :type enrichment_type: str or ~azure.mgmt.securityinsight.models.EnrichmentType :param ip_address_body: IP address (v4 or v6) to be enriched. Required. - :type ip_address_body: JSON + :type ip_address_body: ~azure.mgmt.securityinsight.types.EnrichmentIpAddressBody :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -26934,12 +27896,27 @@ def list_geodata_by_ip( """ @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "enrichment_type", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def list_geodata_by_ip( self, resource_group_name: str, workspace_name: str, enrichment_type: Union[str, _models.EnrichmentType], - ip_address_body: Union[_models.EnrichmentIpAddressBody, JSON, IO[bytes]], + ip_address_body: Union[_models.EnrichmentIpAddressBody, _types.EnrichmentIpAddressBody, IO[bytes]], **kwargs: Any ) -> _models.EnrichmentIpGeodata: """Get geodata for a single IP address. @@ -26951,10 +27928,10 @@ def list_geodata_by_ip( :type workspace_name: str :param enrichment_type: Enrichment type. "main" Required. :type enrichment_type: str or ~azure.mgmt.securityinsight.models.EnrichmentType - :param ip_address_body: IP address (v4 or v6) to be enriched. Is one of the following types: - EnrichmentIpAddressBody, JSON, IO[bytes] Required. - :type ip_address_body: ~azure.mgmt.securityinsight.models.EnrichmentIpAddressBody or JSON or - IO[bytes] + :param ip_address_body: IP address (v4 or v6) to be enriched. Is either a + EnrichmentIpAddressBody type or a IO[bytes] type. Required. + :type ip_address_body: ~azure.mgmt.securityinsight.models.EnrichmentIpAddressBody or + ~azure.mgmt.securityinsight.types.EnrichmentIpAddressBody or IO[bytes] :return: EnrichmentIpGeodata. The EnrichmentIpGeodata is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.EnrichmentIpGeodata :raises ~azure.core.exceptions.HttpResponseError: @@ -27063,7 +28040,7 @@ def list_whois_by_domain( resource_group_name: str, workspace_name: str, enrichment_type: Union[str, _models.EnrichmentType], - domain_body: JSON, + domain_body: _types.EnrichmentDomainBody, *, content_type: str = "application/json", **kwargs: Any @@ -27078,7 +28055,7 @@ def list_whois_by_domain( :param enrichment_type: Enrichment type. "main" Required. :type enrichment_type: str or ~azure.mgmt.securityinsight.models.EnrichmentType :param domain_body: Domain name to be enriched. Only domain name is accepted. Required. - :type domain_body: JSON + :type domain_body: ~azure.mgmt.securityinsight.types.EnrichmentDomainBody :keyword content_type: Body Parameter content-type. Content type parameter for JSON body. Default value is "application/json". :paramtype content_type: str @@ -27118,12 +28095,27 @@ def list_whois_by_domain( """ @distributed_trace + @api_version_validation( + method_added_on="2025-10-01-preview", + params_added_on={ + "2025-10-01-preview": [ + "api_version", + "subscription_id", + "resource_group_name", + "workspace_name", + "enrichment_type", + "content_type", + "accept", + ] + }, + api_versions_list=["2025-10-01-preview"], + ) def list_whois_by_domain( self, resource_group_name: str, workspace_name: str, enrichment_type: Union[str, _models.EnrichmentType], - domain_body: Union[_models.EnrichmentDomainBody, JSON, IO[bytes]], + domain_body: Union[_models.EnrichmentDomainBody, _types.EnrichmentDomainBody, IO[bytes]], **kwargs: Any ) -> _models.EnrichmentDomainWhois: """Get whois information for a single domain name. @@ -27135,9 +28127,10 @@ def list_whois_by_domain( :type workspace_name: str :param enrichment_type: Enrichment type. "main" Required. :type enrichment_type: str or ~azure.mgmt.securityinsight.models.EnrichmentType - :param domain_body: Domain name to be enriched. Only domain name is accepted. Is one of the - following types: EnrichmentDomainBody, JSON, IO[bytes] Required. - :type domain_body: ~azure.mgmt.securityinsight.models.EnrichmentDomainBody or JSON or IO[bytes] + :param domain_body: Domain name to be enriched. Only domain name is accepted. Is either a + EnrichmentDomainBody type or a IO[bytes] type. Required. + :type domain_body: ~azure.mgmt.securityinsight.models.EnrichmentDomainBody or + ~azure.mgmt.securityinsight.types.EnrichmentDomainBody or IO[bytes] :return: EnrichmentDomainWhois. The EnrichmentDomainWhois is compatible with MutableMapping :rtype: ~azure.mgmt.securityinsight.models.EnrichmentDomainWhois :raises ~azure.core.exceptions.HttpResponseError: diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/types.py b/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/types.py new file mode 100644 index 000000000000..cfd7773a8da4 --- /dev/null +++ b/sdk/securityinsight/azure-mgmt-securityinsight/azure/mgmt/securityinsight/types.py @@ -0,0 +1,9190 @@ +# pylint: disable=line-too-long,useless-suppression,too-many-lines +# coding=utf-8 +# -------------------------------------------------------------------------- +# Copyright (c) Microsoft Corporation. All rights reserved. +# Licensed under the MIT License. See License.txt in the project root for license information. +# Code generated by Microsoft (R) Python Code Generator. +# Changes may cause incorrect behavior and will be lost if the code is regenerated. +# -------------------------------------------------------------------------- + +from typing import Any, Literal, Optional, TYPE_CHECKING, Union +from typing_extensions import Required, TypedDict + +from .models._enums import ( + ActionType, + AlertRuleKind, + CcpAuthType, + ConditionType, + CustomEntityQueryKind, + DataConnectorDefinitionKind, + DataConnectorKind, + SecurityMLAnalyticsSettingsKind, + SettingKind, + ThreatIntelligenceResourceKindEnum, +) + +if TYPE_CHECKING: + from .models import ( + AlertDetail, + AlertProperty, + AlertSeverity, + AttackTactic, + AutomationRuleBooleanConditionSupportedOperator, + AutomationRulePropertyArrayChangedConditionSupportedArrayType, + AutomationRulePropertyArrayChangedConditionSupportedChangeType, + AutomationRulePropertyArrayConditionSupportedArrayConditionType, + AutomationRulePropertyArrayConditionSupportedArrayType, + AutomationRulePropertyChangedConditionSupportedChangedType, + AutomationRulePropertyChangedConditionSupportedPropertyType, + AutomationRulePropertyConditionSupportedOperator, + AutomationRulePropertyConditionSupportedProperty, + ConnectAuthKind, + Connective, + ConnectivityType, + ContentType, + CreatedByType, + DataTypeState, + DeleteStatus, + DeploymentFetchStatus, + DeploymentResult, + DeploymentState, + EntityMappingType, + EntityProviders, + EntityTimelineKind, + EntityType, + EventGroupingAggregationKind, + FileFormat, + FileImportContentType, + FileImportState, + Flag, + HttpMethodVerb, + HypothesisStatus, + IncidentClassification, + IncidentClassificationReason, + IncidentLabelType, + IncidentSeverity, + IncidentStatus, + IncidentTaskStatus, + IngestionMode, + JobProvisioningState, + Kind, + MatchingMethod, + MetadataDependencyOperator, + MicrosoftSecurityProductName, + Mode, + MtpProvider, + Operator, + OwnerType, + PackageKind, + PermissionProviderScope, + PollingFrequency, + ProviderName, + ProviderPermissionsScope, + PullRequestState, + RepoType, + RepositoryAccessKind, + RestApiPollerRequestPagingKind, + SettingType, + SettingsStatus, + SortingDirection, + SourceKind, + SourceType, + State, + Status, + SupportTier, + ThreatIntelligenceSortingCriteriaEnum, + TriggerOperator, + TriggersOn, + TriggersWhen, + UebaDataSources, + Version, + WatchlistProvisioningState, + ) + + +class AADCheckRequirements(TypedDict, total=False): + """Represents AADIP (Azure Active Directory Identity Protection) requirements check request. + + :ivar properties: AADIP (Azure Active Directory Identity Protection) requirements check + properties. + :vartype properties: "AADCheckRequirementsProperties" + :ivar kind: Describes the kind of connector to be checked. Required. AzureActiveDirectory. + :vartype kind: Literal[DataConnectorKind.AZURE_ACTIVE_DIRECTORY] + """ + + properties: "AADCheckRequirementsProperties" + """AADIP (Azure Active Directory Identity Protection) requirements check properties.""" + kind: Required[Literal[DataConnectorKind.AZURE_ACTIVE_DIRECTORY]] + """Describes the kind of connector to be checked. Required. AzureActiveDirectory.""" + + +class DataConnectorTenantId(TypedDict, total=False): + """Properties data connector on tenant level. + + :ivar tenantId: The tenant id to connect to, and get the data from. Required. + :vartype tenantId: str + """ + + tenantId: Required[str] + """The tenant id to connect to, and get the data from. Required.""" + + +class AADCheckRequirementsProperties(DataConnectorTenantId): + """AADIP (Azure Active Directory Identity Protection) requirements check properties. + + :ivar tenantId: The tenant id to connect to, and get the data from. Required. + :vartype tenantId: str + """ + + +class Resource(TypedDict, total=False): + """Resource. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + + +class ProxyResource(Resource): + """Proxy Resource. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + """ + + +class AADDataConnector(TypedDict, total=False): + """Represents AADIP (Azure Active Directory Identity Protection) data connector. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: AADIP (Azure Active Directory Identity Protection) data connector properties. + :vartype properties: "AADDataConnectorProperties" + :ivar kind: The data connector kind. Required. AzureActiveDirectory. + :vartype kind: Literal[DataConnectorKind.AZURE_ACTIVE_DIRECTORY] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "AADDataConnectorProperties" + """AADIP (Azure Active Directory Identity Protection) data connector properties.""" + kind: Required[Literal[DataConnectorKind.AZURE_ACTIVE_DIRECTORY]] + """The data connector kind. Required. AzureActiveDirectory.""" + + +class AADDataConnectorProperties(TypedDict, total=False): + """AADIP (Azure Active Directory Identity Protection) data connector properties. + + :ivar tenantId: The tenant id to connect to, and get the data from. Required. + :vartype tenantId: str + :ivar dataTypes: The available data types for the connector. + :vartype dataTypes: "AlertsDataTypeOfDataConnector" + """ + + tenantId: Required[str] + """The tenant id to connect to, and get the data from. Required.""" + dataTypes: "AlertsDataTypeOfDataConnector" + """The available data types for the connector.""" + + +class AATPCheckRequirements(TypedDict, total=False): + """Represents AATP (Azure Advanced Threat Protection) requirements check request. + + :ivar properties: AATP (Azure Advanced Threat Protection) requirements check properties. + :vartype properties: "AATPCheckRequirementsProperties" + :ivar kind: Describes the kind of connector to be checked. Required. + AzureAdvancedThreatProtection. + :vartype kind: Literal[DataConnectorKind.AZURE_ADVANCED_THREAT_PROTECTION] + """ + + properties: "AATPCheckRequirementsProperties" + """AATP (Azure Advanced Threat Protection) requirements check properties.""" + kind: Required[Literal[DataConnectorKind.AZURE_ADVANCED_THREAT_PROTECTION]] + """Describes the kind of connector to be checked. Required. AzureAdvancedThreatProtection.""" + + +class AATPCheckRequirementsProperties(DataConnectorTenantId): + """AATP (Azure Advanced Threat Protection) requirements check properties. + + :ivar tenantId: The tenant id to connect to, and get the data from. Required. + :vartype tenantId: str + """ + + +class AATPDataConnector(TypedDict, total=False): + """Represents AATP (Azure Advanced Threat Protection) data connector. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: AATP (Azure Advanced Threat Protection) data connector properties. + :vartype properties: "AATPDataConnectorProperties" + :ivar kind: The data connector kind. Required. AzureAdvancedThreatProtection. + :vartype kind: Literal[DataConnectorKind.AZURE_ADVANCED_THREAT_PROTECTION] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "AATPDataConnectorProperties" + """AATP (Azure Advanced Threat Protection) data connector properties.""" + kind: Required[Literal[DataConnectorKind.AZURE_ADVANCED_THREAT_PROTECTION]] + """The data connector kind. Required. AzureAdvancedThreatProtection.""" + + +class AATPDataConnectorProperties(TypedDict, total=False): + """AATP (Azure Advanced Threat Protection) data connector properties. + + :ivar tenantId: The tenant id to connect to, and get the data from. Required. + :vartype tenantId: str + :ivar dataTypes: The available data types for the connector. + :vartype dataTypes: "AlertsDataTypeOfDataConnector" + """ + + tenantId: Required[str] + """The tenant id to connect to, and get the data from. Required.""" + dataTypes: "AlertsDataTypeOfDataConnector" + """The available data types for the connector.""" + + +class EntityCommonProperties(TypedDict, total=False): + """Entity common property bag. + + :ivar additionalData: A bag of custom fields that should be part of the entity and will be + presented to the user. + :vartype additionalData: dict[str, Any] + :ivar friendlyName: The graph item display name which is a short humanly readable description + of the graph item instance. This property is optional and might be system generated. + :vartype friendlyName: str + """ + + additionalData: dict[str, Any] + """A bag of custom fields that should be part of the entity and will be presented to the user.""" + friendlyName: str + """The graph item display name which is a short humanly readable description of the graph item + instance. This property is optional and might be system generated.""" + + +class ActionPropertiesBase(TypedDict, total=False): + """Action property bag base. + + :ivar logicAppResourceId: Logic App Resource Id, + /subscriptions/{my-subscription}/resourceGroups/{my-resource-group}/providers/Microsoft.Logic/workflows/{my-workflow-id}. + Required. + :vartype logicAppResourceId: str + """ + + logicAppResourceId: Required[str] + """Logic App Resource Id, + /subscriptions/{my-subscription}/resourceGroups/{my-resource-group}/providers/Microsoft.Logic/workflows/{my-workflow-id}. + Required.""" + + +class ResourceWithEtag(Resource): + """An azure resource object with an Etag property. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + """ + + etag: str + """Etag of the azure resource.""" + + +class ActionRequest(ResourceWithEtag): + """Action for alert rule. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: Action properties for put request. + :vartype properties: "ActionRequestProperties" + """ + + properties: "ActionRequestProperties" + """Action properties for put request.""" + + +class ActionRequestProperties(ActionPropertiesBase): + """Action property bag. + + :ivar logicAppResourceId: Logic App Resource Id, + /subscriptions/{my-subscription}/resourceGroups/{my-resource-group}/providers/Microsoft.Logic/workflows/{my-workflow-id}. + Required. + :vartype logicAppResourceId: str + :ivar triggerUri: Logic App Callback URL for this specific workflow. Required. + :vartype triggerUri: str + """ + + triggerUri: Required[str] + """Logic App Callback URL for this specific workflow. Required.""" + + +class ActivityCustomEntityQuery(TypedDict, total=False): + """Represents Activity entity query. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: Activity entity query properties. + :vartype properties: "ActivityEntityQueriesProperties" + :ivar kind: the entity query kind. Required. Activity. + :vartype kind: Literal[CustomEntityQueryKind.ACTIVITY] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "ActivityEntityQueriesProperties" + """Activity entity query properties.""" + kind: Required[Literal[CustomEntityQueryKind.ACTIVITY]] + """the entity query kind. Required. Activity.""" + + +class ActivityEntityQueriesProperties(TypedDict, total=False): + """Describes activity entity query properties. + + :ivar title: The entity query title. + :vartype title: str + :ivar content: The entity query content to display in timeline. + :vartype content: str + :ivar description: The entity query description. + :vartype description: str + :ivar queryDefinitions: The Activity query definitions. + :vartype queryDefinitions: "ActivityEntityQueriesPropertiesQueryDefinitions" + :ivar inputEntityType: The type of the query's source entity. Known values are: "Account", + "Host", "File", "AzureResource", "CloudApplication", "DNS", "FileHash", "IP", "Malware", + "Process", "RegistryKey", "RegistryValue", "SecurityGroup", "URL", "IoTDevice", + "SecurityAlert", "HuntingBookmark", "MailCluster", "MailMessage", "Mailbox", "SubmissionMail", + and "Nic". + :vartype inputEntityType: Union[str, "EntityType"] + :ivar requiredInputFieldsSets: List of the fields of the source entity that are required to run + the query. + :vartype requiredInputFieldsSets: list[list[str]] + :ivar entitiesFilter: The query applied only to entities matching to all filters. + :vartype entitiesFilter: dict[str, list[str]] + :ivar templateName: The template id this activity was created from. + :vartype templateName: str + :ivar enabled: Determines whether this activity is enabled or disabled. + :vartype enabled: bool + :ivar createdTimeUtc: The time the activity was created. + :vartype createdTimeUtc: str + :ivar lastModifiedTimeUtc: The last time the activity was updated. + :vartype lastModifiedTimeUtc: str + """ + + title: str + """The entity query title.""" + content: str + """The entity query content to display in timeline.""" + description: str + """The entity query description.""" + queryDefinitions: "ActivityEntityQueriesPropertiesQueryDefinitions" + """The Activity query definitions.""" + inputEntityType: Union[str, "EntityType"] + """The type of the query's source entity. Known values are: \"Account\", \"Host\", \"File\", + \"AzureResource\", \"CloudApplication\", \"DNS\", \"FileHash\", \"IP\", \"Malware\", + \"Process\", \"RegistryKey\", \"RegistryValue\", \"SecurityGroup\", \"URL\", \"IoTDevice\", + \"SecurityAlert\", \"HuntingBookmark\", \"MailCluster\", \"MailMessage\", \"Mailbox\", + \"SubmissionMail\", and \"Nic\".""" + requiredInputFieldsSets: list[list[str]] + """List of the fields of the source entity that are required to run the query.""" + entitiesFilter: dict[str, list[str]] + """The query applied only to entities matching to all filters.""" + templateName: str + """The template id this activity was created from.""" + enabled: bool + """Determines whether this activity is enabled or disabled.""" + createdTimeUtc: str + """The time the activity was created.""" + lastModifiedTimeUtc: str + """The last time the activity was updated.""" + + +class ActivityEntityQueriesPropertiesQueryDefinitions(TypedDict, total=False): # pylint: disable=name-too-long + """The Activity query definitions. + + :ivar query: The Activity query to run on a given entity. + :vartype query: str + """ + + query: str + """The Activity query to run on a given entity.""" + + +class AddIncidentTaskActionProperties(TypedDict, total=False): + """AddIncidentTaskActionProperties. + + :ivar title: The title of the task. Required. + :vartype title: str + :ivar description: The description of the task. + :vartype description: str + """ + + title: Required[str] + """The title of the task. Required.""" + description: str + """The description of the task.""" + + +class AlertDetailsOverride(TypedDict, total=False): + """Settings for how to dynamically override alert static details. + + :ivar alertDisplayNameFormat: the format containing columns name(s) to override the alert name. + :vartype alertDisplayNameFormat: str + :ivar alertDescriptionFormat: the format containing columns name(s) to override the alert + description. + :vartype alertDescriptionFormat: str + :ivar alertTacticsColumnName: the column name to take the alert tactics from. + :vartype alertTacticsColumnName: str + :ivar alertSeverityColumnName: the column name to take the alert severity from. + :vartype alertSeverityColumnName: str + :ivar alertDynamicProperties: List of additional dynamic properties to override. + :vartype alertDynamicProperties: list["AlertPropertyMapping"] + """ + + alertDisplayNameFormat: str + """the format containing columns name(s) to override the alert name.""" + alertDescriptionFormat: str + """the format containing columns name(s) to override the alert description.""" + alertTacticsColumnName: str + """the column name to take the alert tactics from.""" + alertSeverityColumnName: str + """the column name to take the alert severity from.""" + alertDynamicProperties: list["AlertPropertyMapping"] + """List of additional dynamic properties to override.""" + + +class AlertPropertyMapping(TypedDict, total=False): + """A single alert property mapping to override. + + :ivar alertProperty: The V3 alert property. Known values are: "AlertLink", "ConfidenceLevel", + "ConfidenceScore", "ExtendedLinks", "ProductName", "ProviderName", "ProductComponentName", + "RemediationSteps", "Techniques", and "SubTechniques". + :vartype alertProperty: Union[str, "AlertProperty"] + :ivar value: the column name to use to override this property. + :vartype value: str + """ + + alertProperty: Union[str, "AlertProperty"] + """The V3 alert property. Known values are: \"AlertLink\", \"ConfidenceLevel\", + \"ConfidenceScore\", \"ExtendedLinks\", \"ProductName\", \"ProviderName\", + \"ProductComponentName\", \"RemediationSteps\", \"Techniques\", and \"SubTechniques\".""" + value: str + """the column name to use to override this property.""" + + +class AlertsDataTypeOfDataConnector(TypedDict, total=False): + """Alerts data type for data connectors. + + :ivar alerts: Alerts data type connection. Required. + :vartype alerts: "DataConnectorDataTypeCommon" + """ + + alerts: Required["DataConnectorDataTypeCommon"] + """Alerts data type connection. Required.""" + + +class AnalyticsRuleRunTrigger(TypedDict, total=False): + """Analytics Rule Run Trigger request. + + :ivar properties: The analytics Rule Run Trigger request. Required. + :vartype properties: "AnalyticsRuleRunTriggerProperties" + """ + + properties: Required["AnalyticsRuleRunTriggerProperties"] + """The analytics Rule Run Trigger request. Required.""" + + +class AnalyticsRuleRunTriggerProperties(TypedDict, total=False): + """The Analytics Rule Run Trigger properties. + + :ivar executionTimeUtc: Required. + :vartype executionTimeUtc: str + """ + + executionTimeUtc: Required[str] + """Required.""" + + +class Anomalies(TypedDict, total=False): + """Settings with single toggle. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: Anomalies properties. + :vartype properties: "AnomaliesSettingsProperties" + :ivar kind: The kind of the setting. Required. Anomalies. + :vartype kind: Literal[SettingKind.ANOMALIES] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "AnomaliesSettingsProperties" + """Anomalies properties.""" + kind: Required[Literal[SettingKind.ANOMALIES]] + """The kind of the setting. Required. Anomalies.""" + + +class AnomaliesSettingsProperties(TypedDict, total=False): + """Anomalies property bag. + + :ivar isEnabled: Determines whether the setting is enable or disabled. + :vartype isEnabled: bool + """ + + isEnabled: bool + """Determines whether the setting is enable or disabled.""" + + +class AnomalySecurityMLAnalyticsSettings(TypedDict, total=False): + """Represents Anomaly Security ML Analytics Settings. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: Anomaly Security ML Analytics Settings properties. + :vartype properties: "AnomalySecurityMLAnalyticsSettingsProperties" + :ivar kind: The kind of security ML Analytics Settings. Required. Anomaly. + :vartype kind: Literal[SecurityMLAnalyticsSettingsKind.ANOMALY] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "AnomalySecurityMLAnalyticsSettingsProperties" + """Anomaly Security ML Analytics Settings properties.""" + kind: Required[Literal[SecurityMLAnalyticsSettingsKind.ANOMALY]] + """The kind of security ML Analytics Settings. Required. Anomaly.""" + + +class AnomalySecurityMLAnalyticsSettingsProperties(TypedDict, total=False): # pylint: disable=name-too-long + """AnomalySecurityMLAnalytics settings base property bag. + + :ivar description: The description of the SecurityMLAnalyticsSettings. + :vartype description: str + :ivar displayName: The display name for settings created by this SecurityMLAnalyticsSettings. + Required. + :vartype displayName: str + :ivar enabled: Determines whether this settings is enabled or disabled. Required. + :vartype enabled: bool + :ivar lastModifiedUtc: The last time that this SecurityMLAnalyticsSettings has been modified. + :vartype lastModifiedUtc: str + :ivar requiredDataConnectors: The required data sources for this SecurityMLAnalyticsSettings. + :vartype requiredDataConnectors: list["SecurityMLAnalyticsSettingsDataSource"] + :ivar tactics: The tactics of the SecurityMLAnalyticsSettings. + :vartype tactics: list[Union[str, "AttackTactic"]] + :ivar techniques: The techniques of the SecurityMLAnalyticsSettings. + :vartype techniques: list[str] + :ivar anomalyVersion: The anomaly version of the AnomalySecurityMLAnalyticsSettings. Required. + :vartype anomalyVersion: str + :ivar customizableObservations: The customizable observations of the + AnomalySecurityMLAnalyticsSettings. + :vartype customizableObservations: Any + :ivar frequency: The frequency that this SecurityMLAnalyticsSettings will be run. Required. + :vartype frequency: str + :ivar settingsStatus: The anomaly SecurityMLAnalyticsSettings status. Required. Known values + are: "Production" and "Flighting". + :vartype settingsStatus: Union[str, "SettingsStatus"] + :ivar isDefaultSettings: Determines whether this anomaly security ml analytics settings is a + default settings. Required. + :vartype isDefaultSettings: bool + :ivar anomalySettingsVersion: The anomaly settings version of the Anomaly security ml analytics + settings that dictates whether job version gets updated or not. + :vartype anomalySettingsVersion: int + :ivar settingsDefinitionId: The anomaly settings definition Id. + :vartype settingsDefinitionId: str + """ + + description: str + """The description of the SecurityMLAnalyticsSettings.""" + displayName: Required[str] + """The display name for settings created by this SecurityMLAnalyticsSettings. Required.""" + enabled: Required[bool] + """Determines whether this settings is enabled or disabled. Required.""" + lastModifiedUtc: str + """The last time that this SecurityMLAnalyticsSettings has been modified.""" + requiredDataConnectors: list["SecurityMLAnalyticsSettingsDataSource"] + """The required data sources for this SecurityMLAnalyticsSettings.""" + tactics: list[Union[str, "AttackTactic"]] + """The tactics of the SecurityMLAnalyticsSettings.""" + techniques: list[str] + """The techniques of the SecurityMLAnalyticsSettings.""" + anomalyVersion: Required[str] + """The anomaly version of the AnomalySecurityMLAnalyticsSettings. Required.""" + customizableObservations: Any + """The customizable observations of the AnomalySecurityMLAnalyticsSettings.""" + frequency: Required[str] + """The frequency that this SecurityMLAnalyticsSettings will be run. Required.""" + settingsStatus: Required[Union[str, "SettingsStatus"]] + """The anomaly SecurityMLAnalyticsSettings status. Required. Known values are: \"Production\" and + \"Flighting\".""" + isDefaultSettings: Required[bool] + """Determines whether this anomaly security ml analytics settings is a default settings. Required.""" + anomalySettingsVersion: int + """The anomaly settings version of the Anomaly security ml analytics settings that dictates + whether job version gets updated or not.""" + settingsDefinitionId: str + """The anomaly settings definition Id.""" + + +class ApiKeyAuthModel(TypedDict, total=False): + """Model for authentication with the API Key. Will result in additional header on the request + (default behavior) to the remote server: 'ApiKeyName: ApiKeyIdentifier ApiKey'. If + 'IsApiKeyInPostPayload' is true it will send it in the body of the request and not the header. + + :ivar apiKey: API Key for the user secret key credential. Required. + :vartype apiKey: str + :ivar apiKeyName: API Key name. Required. + :vartype apiKeyName: str + :ivar apiKeyIdentifier: API Key Identifier. + :vartype apiKeyIdentifier: str + :ivar isApiKeyInPostPayload: Flag to indicate if API key is set in HTTP POST payload. + :vartype isApiKeyInPostPayload: bool + :ivar type: The auth type. Required. APIKey. + :vartype type: Literal[CcpAuthType.API_KEY] + """ + + apiKey: Required[str] + """API Key for the user secret key credential. Required.""" + apiKeyName: Required[str] + """API Key name. Required.""" + apiKeyIdentifier: str + """API Key Identifier.""" + isApiKeyInPostPayload: bool + """Flag to indicate if API key is set in HTTP POST payload.""" + type: Required[Literal[CcpAuthType.API_KEY]] + """The auth type. Required. APIKey.""" + + +class ApiPollingParameters(TypedDict, total=False): + """Represents Codeless API Polling data connector. + + :ivar connectorUiConfig: Config to describe the instructions blade. + :vartype connectorUiConfig: "CodelessUiConnectorConfigProperties" + :ivar pollingConfig: Config to describe the polling instructions. + :vartype pollingConfig: "CodelessConnectorPollingConfigProperties" + """ + + connectorUiConfig: "CodelessUiConnectorConfigProperties" + """Config to describe the instructions blade.""" + pollingConfig: "CodelessConnectorPollingConfigProperties" + """Config to describe the polling instructions.""" + + +class ASCCheckRequirements(TypedDict, total=False): + """Represents ASC (Azure Security Center) requirements check request. + + :ivar properties: ASC (Azure Security Center) requirements check properties. + :vartype properties: "ASCCheckRequirementsProperties" + :ivar kind: Describes the kind of connector to be checked. Required. AzureSecurityCenter. + :vartype kind: Literal[DataConnectorKind.AZURE_SECURITY_CENTER] + """ + + properties: "ASCCheckRequirementsProperties" + """ASC (Azure Security Center) requirements check properties.""" + kind: Required[Literal[DataConnectorKind.AZURE_SECURITY_CENTER]] + """Describes the kind of connector to be checked. Required. AzureSecurityCenter.""" + + +class ASCCheckRequirementsProperties(TypedDict, total=False): + """ASC (Azure Security Center) requirements check properties. + + :ivar subscriptionId: The subscription id to connect to, and get the data from. + :vartype subscriptionId: str + """ + + subscriptionId: str + """The subscription id to connect to, and get the data from.""" + + +class ASCDataConnector(TypedDict, total=False): + """Represents ASC (Azure Security Center) data connector. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: ASC (Azure Security Center) data connector properties. + :vartype properties: "ASCDataConnectorProperties" + :ivar kind: The data connector kind. Required. AzureSecurityCenter. + :vartype kind: Literal[DataConnectorKind.AZURE_SECURITY_CENTER] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "ASCDataConnectorProperties" + """ASC (Azure Security Center) data connector properties.""" + kind: Required[Literal[DataConnectorKind.AZURE_SECURITY_CENTER]] + """The data connector kind. Required. AzureSecurityCenter.""" + + +class DataConnectorWithAlertsProperties(TypedDict, total=False): + """Data connector properties. + + :ivar dataTypes: The available data types for the connector. + :vartype dataTypes: "AlertsDataTypeOfDataConnector" + """ + + dataTypes: "AlertsDataTypeOfDataConnector" + """The available data types for the connector.""" + + +class ASCDataConnectorProperties(DataConnectorWithAlertsProperties): + """ASC (Azure Security Center) data connector properties. + + :ivar dataTypes: The available data types for the connector. + :vartype dataTypes: "AlertsDataTypeOfDataConnector" + :ivar subscriptionId: The subscription id to connect to, and get the data from. + :vartype subscriptionId: str + """ + + subscriptionId: str + """The subscription id to connect to, and get the data from.""" + + +class AssignmentItem(TypedDict, total=False): + """An entity describing a content item. + + :ivar resourceId: The resource id of the content item. + :vartype resourceId: str + """ + + resourceId: str + """The resource id of the content item.""" + + +class AutomationRule(ProxyResource): + """Concrete proxy resource types can be created by aliasing this type using a specific property + type. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar properties: Automation rule properties. Required. + :vartype properties: "AutomationRuleProperties" + :ivar etag: Etag of the azure resource. + :vartype etag: str + """ + + properties: Required["AutomationRuleProperties"] + """Automation rule properties. Required.""" + etag: str + """Etag of the azure resource.""" + + +class AutomationRuleAddIncidentTaskAction(TypedDict, total=False): + """Describes an automation rule action to add a task to an incident. + + :ivar order: Required. + :vartype order: int + :ivar actionConfiguration: + :vartype actionConfiguration: "AddIncidentTaskActionProperties" + :ivar actionType: The type of the automation rule action. Required. Add a task to an incident + object. + :vartype actionType: Literal[ActionType.ADD_INCIDENT_TASK] + """ + + order: Required[int] + """Required.""" + actionConfiguration: "AddIncidentTaskActionProperties" + actionType: Required[Literal[ActionType.ADD_INCIDENT_TASK]] + """The type of the automation rule action. Required. Add a task to an incident object.""" + + +class AutomationRuleBooleanCondition(TypedDict, total=False): + """AutomationRuleBooleanCondition. + + :ivar operator: Known values are: "And" and "Or". + :vartype operator: Union[str, "AutomationRuleBooleanConditionSupportedOperator"] + :ivar innerConditions: + :vartype innerConditions: list["AutomationRuleCondition"] + """ + + operator: Union[str, "AutomationRuleBooleanConditionSupportedOperator"] + """Known values are: \"And\" and \"Or\".""" + innerConditions: list["AutomationRuleCondition"] + + +class AutomationRuleModifyPropertiesAction(TypedDict, total=False): + """Describes an automation rule action to modify an object's properties. + + :ivar order: Required. + :vartype order: int + :ivar actionConfiguration: + :vartype actionConfiguration: "IncidentPropertiesAction" + :ivar actionType: The type of the automation rule action. Required. Modify an object's + properties. + :vartype actionType: Literal[ActionType.MODIFY_PROPERTIES] + """ + + order: Required[int] + """Required.""" + actionConfiguration: "IncidentPropertiesAction" + actionType: Required[Literal[ActionType.MODIFY_PROPERTIES]] + """The type of the automation rule action. Required. Modify an object's properties.""" + + +class AutomationRuleProperties(TypedDict, total=False): + """Automation rule properties. + + :ivar displayName: The display name of the automation rule. Required. + :vartype displayName: str + :ivar order: The order of execution of the automation rule. Required. + :vartype order: int + :ivar triggeringLogic: Describes automation rule triggering logic. Required. + :vartype triggeringLogic: "AutomationRuleTriggeringLogic" + :ivar actions: The actions to execute when the automation rule is triggered. Required. + :vartype actions: list["AutomationRuleAction"] + :ivar lastModifiedTimeUtc: The last time the automation rule was updated. + :vartype lastModifiedTimeUtc: str + :ivar createdTimeUtc: The time the automation rule was created. + :vartype createdTimeUtc: str + :ivar lastModifiedBy: Information on the client (user or application) that made some action. + :vartype lastModifiedBy: "ClientInfo" + :ivar createdBy: Information on the client (user or application) that made some action. + :vartype createdBy: "ClientInfo" + """ + + displayName: Required[str] + """The display name of the automation rule. Required.""" + order: Required[int] + """The order of execution of the automation rule. Required.""" + triggeringLogic: Required["AutomationRuleTriggeringLogic"] + """Describes automation rule triggering logic. Required.""" + actions: Required[list["AutomationRuleAction"]] + """The actions to execute when the automation rule is triggered. Required.""" + lastModifiedTimeUtc: str + """The last time the automation rule was updated.""" + createdTimeUtc: str + """The time the automation rule was created.""" + lastModifiedBy: "ClientInfo" + """Information on the client (user or application) that made some action.""" + createdBy: "ClientInfo" + """Information on the client (user or application) that made some action.""" + + +class AutomationRulePropertyArrayChangedValuesCondition(TypedDict, total=False): # pylint: disable=name-too-long + """AutomationRulePropertyArrayChangedValuesCondition. + + :ivar arrayType: Known values are: "Alerts", "Labels", "Tactics", and "Comments". + :vartype arrayType: Union[str, "AutomationRulePropertyArrayChangedConditionSupportedArrayType"] + :ivar changeType: "Added" + :vartype changeType: Union[str, + "AutomationRulePropertyArrayChangedConditionSupportedChangeType"] + """ + + arrayType: Union[str, "AutomationRulePropertyArrayChangedConditionSupportedArrayType"] + """Known values are: \"Alerts\", \"Labels\", \"Tactics\", and \"Comments\".""" + changeType: Union[str, "AutomationRulePropertyArrayChangedConditionSupportedChangeType"] + """\"Added\"""" + + +class AutomationRulePropertyArrayValuesCondition(TypedDict, total=False): # pylint: disable=name-too-long + """AutomationRulePropertyArrayValuesCondition. + + :ivar arrayType: Known values are: "CustomDetails", "CustomDetailValues", and "IncidentLabels". + :vartype arrayType: Union[str, "AutomationRulePropertyArrayConditionSupportedArrayType"] + :ivar arrayConditionType: Known values are: "AnyItem" and "AllItems". + :vartype arrayConditionType: Union[str, + "AutomationRulePropertyArrayConditionSupportedArrayConditionType"] + :ivar itemConditions: + :vartype itemConditions: list["AutomationRuleCondition"] + """ + + arrayType: Union[str, "AutomationRulePropertyArrayConditionSupportedArrayType"] + """Known values are: \"CustomDetails\", \"CustomDetailValues\", and \"IncidentLabels\".""" + arrayConditionType: Union[str, "AutomationRulePropertyArrayConditionSupportedArrayConditionType"] + """Known values are: \"AnyItem\" and \"AllItems\".""" + itemConditions: list["AutomationRuleCondition"] + + +class AutomationRulePropertyValuesChangedCondition(TypedDict, total=False): # pylint: disable=name-too-long + """AutomationRulePropertyValuesChangedCondition. + + :ivar propertyName: Known values are: "IncidentSeverity", "IncidentStatus", and + "IncidentOwner". + :vartype propertyName: Union[str, + "AutomationRulePropertyChangedConditionSupportedPropertyType"] + :ivar changeType: Known values are: "ChangedFrom" and "ChangedTo". + :vartype changeType: Union[str, "AutomationRulePropertyChangedConditionSupportedChangedType"] + :ivar operator: Known values are: "Equals", "NotEquals", "Contains", "NotContains", + "StartsWith", "NotStartsWith", "EndsWith", and "NotEndsWith". + :vartype operator: Union[str, "AutomationRulePropertyConditionSupportedOperator"] + :ivar propertyValues: + :vartype propertyValues: list[str] + """ + + propertyName: Union[str, "AutomationRulePropertyChangedConditionSupportedPropertyType"] + """Known values are: \"IncidentSeverity\", \"IncidentStatus\", and \"IncidentOwner\".""" + changeType: Union[str, "AutomationRulePropertyChangedConditionSupportedChangedType"] + """Known values are: \"ChangedFrom\" and \"ChangedTo\".""" + operator: Union[str, "AutomationRulePropertyConditionSupportedOperator"] + """Known values are: \"Equals\", \"NotEquals\", \"Contains\", \"NotContains\", \"StartsWith\", + \"NotStartsWith\", \"EndsWith\", and \"NotEndsWith\".""" + propertyValues: list[str] + + +class AutomationRulePropertyValuesCondition(TypedDict, total=False): + """AutomationRulePropertyValuesCondition. + + :ivar propertyName: The property to evaluate in an automation rule property condition. Known + values are: "IncidentTitle", "IncidentDescription", "IncidentSeverity", "IncidentStatus", + "IncidentRelatedAnalyticRuleIds", "IncidentTactics", "IncidentLabel", "IncidentProviderName", + "IncidentUpdatedBySource", "IncidentCustomDetailsKey", "IncidentCustomDetailsValue", + "IncidentCustomDetectionRuleIds", "IncidentAlertTitle", "AccountAadTenantId", + "AccountAadUserId", "AccountName", "AccountNTDomain", "AccountPUID", "AccountSid", + "AccountObjectGuid", "AccountUPNSuffix", "AlertProductNames", "AlertAnalyticRuleIds", + "AzureResourceResourceId", "AzureResourceSubscriptionId", "CloudApplicationAppId", + "CloudApplicationAppName", "DNSDomainName", "FileDirectory", "FileName", "FileHashValue", + "HostAzureID", "HostName", "HostNetBiosName", "HostNTDomain", "HostOSVersion", "IoTDeviceId", + "IoTDeviceName", "IoTDeviceType", "IoTDeviceVendor", "IoTDeviceModel", + "IoTDeviceOperatingSystem", "IPAddress", "MailboxDisplayName", "MailboxPrimaryAddress", + "MailboxUPN", "MailMessageDeliveryAction", "MailMessageDeliveryLocation", + "MailMessageRecipient", "MailMessageSenderIP", "MailMessageSubject", "MailMessageP1Sender", + "MailMessageP2Sender", "MalwareCategory", "MalwareName", "ProcessCommandLine", "ProcessId", + "RegistryKey", "RegistryValueData", and "Url". + :vartype propertyName: Union[str, "AutomationRulePropertyConditionSupportedProperty"] + :ivar operator: Known values are: "Equals", "NotEquals", "Contains", "NotContains", + "StartsWith", "NotStartsWith", "EndsWith", and "NotEndsWith". + :vartype operator: Union[str, "AutomationRulePropertyConditionSupportedOperator"] + :ivar propertyValues: + :vartype propertyValues: list[str] + """ + + propertyName: Union[str, "AutomationRulePropertyConditionSupportedProperty"] + """The property to evaluate in an automation rule property condition. Known values are: + \"IncidentTitle\", \"IncidentDescription\", \"IncidentSeverity\", \"IncidentStatus\", + \"IncidentRelatedAnalyticRuleIds\", \"IncidentTactics\", \"IncidentLabel\", + \"IncidentProviderName\", \"IncidentUpdatedBySource\", \"IncidentCustomDetailsKey\", + \"IncidentCustomDetailsValue\", \"IncidentCustomDetectionRuleIds\", \"IncidentAlertTitle\", + \"AccountAadTenantId\", \"AccountAadUserId\", \"AccountName\", \"AccountNTDomain\", + \"AccountPUID\", \"AccountSid\", \"AccountObjectGuid\", \"AccountUPNSuffix\", + \"AlertProductNames\", \"AlertAnalyticRuleIds\", \"AzureResourceResourceId\", + \"AzureResourceSubscriptionId\", \"CloudApplicationAppId\", \"CloudApplicationAppName\", + \"DNSDomainName\", \"FileDirectory\", \"FileName\", \"FileHashValue\", \"HostAzureID\", + \"HostName\", \"HostNetBiosName\", \"HostNTDomain\", \"HostOSVersion\", \"IoTDeviceId\", + \"IoTDeviceName\", \"IoTDeviceType\", \"IoTDeviceVendor\", \"IoTDeviceModel\", + \"IoTDeviceOperatingSystem\", \"IPAddress\", \"MailboxDisplayName\", \"MailboxPrimaryAddress\", + \"MailboxUPN\", \"MailMessageDeliveryAction\", \"MailMessageDeliveryLocation\", + \"MailMessageRecipient\", \"MailMessageSenderIP\", \"MailMessageSubject\", + \"MailMessageP1Sender\", \"MailMessageP2Sender\", \"MalwareCategory\", \"MalwareName\", + \"ProcessCommandLine\", \"ProcessId\", \"RegistryKey\", \"RegistryValueData\", and \"Url\".""" + operator: Union[str, "AutomationRulePropertyConditionSupportedOperator"] + """Known values are: \"Equals\", \"NotEquals\", \"Contains\", \"NotContains\", \"StartsWith\", + \"NotStartsWith\", \"EndsWith\", and \"NotEndsWith\".""" + propertyValues: list[str] + + +class AutomationRuleRunPlaybookAction(TypedDict, total=False): + """Describes an automation rule action to run a playbook. + + :ivar order: Required. + :vartype order: int + :ivar actionConfiguration: + :vartype actionConfiguration: "PlaybookActionProperties" + :ivar actionType: The type of the automation rule action. Required. Run a playbook on an + object. + :vartype actionType: Literal[ActionType.RUN_PLAYBOOK] + """ + + order: Required[int] + """Required.""" + actionConfiguration: "PlaybookActionProperties" + actionType: Required[Literal[ActionType.RUN_PLAYBOOK]] + """The type of the automation rule action. Required. Run a playbook on an object.""" + + +class AutomationRuleTriggeringLogic(TypedDict, total=False): + """Describes automation rule triggering logic. + + :ivar isEnabled: Determines whether the automation rule is enabled or disabled. Required. + :vartype isEnabled: bool + :ivar expirationTimeUtc: Determines when the automation rule should automatically expire and be + disabled. + :vartype expirationTimeUtc: str + :ivar triggersOn: Required. Known values are: "Incidents" and "Alerts". + :vartype triggersOn: Union[str, "TriggersOn"] + :ivar triggersWhen: Required. Known values are: "Created" and "Updated". + :vartype triggersWhen: Union[str, "TriggersWhen"] + :ivar conditions: The conditions to evaluate to determine if the automation rule should be + triggered on a given object. + :vartype conditions: list["AutomationRuleCondition"] + """ + + isEnabled: Required[bool] + """Determines whether the automation rule is enabled or disabled. Required.""" + expirationTimeUtc: str + """Determines when the automation rule should automatically expire and be disabled.""" + triggersOn: Required[Union[str, "TriggersOn"]] + """Required. Known values are: \"Incidents\" and \"Alerts\".""" + triggersWhen: Required[Union[str, "TriggersWhen"]] + """Required. Known values are: \"Created\" and \"Updated\".""" + conditions: list["AutomationRuleCondition"] + """The conditions to evaluate to determine if the automation rule should be triggered on a given + object.""" + + +class Availability(TypedDict, total=False): + """Connector Availability Status. + + :ivar status: The connector Availability Status. Default value is 1. + :vartype status: Literal[1] + :ivar isPreview: Set connector as preview. + :vartype isPreview: bool + """ + + status: Literal[1] + """The connector Availability Status. Default value is 1.""" + isPreview: bool + """Set connector as preview.""" + + +class AWSAuthModel(TypedDict, total=False): + """Model for API authentication with AWS. + + :ivar roleArn: AWS STS assume role ARN. Required. + :vartype roleArn: str + :ivar externalId: AWS STS assume role external ID. This is used to prevent the confused deputy + problem: '`https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html + `_'. + :vartype externalId: str + :ivar type: The auth type. Required. AWS. + :vartype type: Literal[CcpAuthType.AWS] + """ + + roleArn: Required[str] + """AWS STS assume role ARN. Required.""" + externalId: str + """AWS STS assume role external ID. This is used to prevent the confused deputy problem: + '`https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html + `_'.""" + type: Required[Literal[CcpAuthType.AWS]] + """The auth type. Required. AWS.""" + + +class AwsCloudTrailCheckRequirements(TypedDict, total=False): + """Amazon Web Services CloudTrail requirements check request. + + :ivar kind: Describes the kind of connector to be checked. Required. + AmazonWebServicesCloudTrail. + :vartype kind: Literal[DataConnectorKind.AMAZON_WEB_SERVICES_CLOUD_TRAIL] + """ + + kind: Required[Literal[DataConnectorKind.AMAZON_WEB_SERVICES_CLOUD_TRAIL]] + """Describes the kind of connector to be checked. Required. AmazonWebServicesCloudTrail.""" + + +class AwsCloudTrailDataConnector(TypedDict, total=False): + """Represents Amazon Web Services CloudTrail data connector. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: Amazon Web Services CloudTrail data connector properties. + :vartype properties: "AwsCloudTrailDataConnectorProperties" + :ivar kind: The data connector kind. Required. AmazonWebServicesCloudTrail. + :vartype kind: Literal[DataConnectorKind.AMAZON_WEB_SERVICES_CLOUD_TRAIL] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "AwsCloudTrailDataConnectorProperties" + """Amazon Web Services CloudTrail data connector properties.""" + kind: Required[Literal[DataConnectorKind.AMAZON_WEB_SERVICES_CLOUD_TRAIL]] + """The data connector kind. Required. AmazonWebServicesCloudTrail.""" + + +class AwsCloudTrailDataConnectorDataTypes(TypedDict, total=False): + """The available data types for Amazon Web Services CloudTrail data connector. + + :ivar logs: Logs data type. Required. + :vartype logs: "AwsCloudTrailDataConnectorDataTypesLogs" + """ + + logs: Required["AwsCloudTrailDataConnectorDataTypesLogs"] + """Logs data type. Required.""" + + +class DataConnectorDataTypeCommon(TypedDict, total=False): + """Common field for data type in data connectors. + + :ivar state: Describe whether this data type connection is enabled or not. Required. Known + values are: "Enabled" and "Disabled". + :vartype state: Union[str, "DataTypeState"] + """ + + state: Required[Union[str, "DataTypeState"]] + """Describe whether this data type connection is enabled or not. Required. Known values are: + \"Enabled\" and \"Disabled\".""" + + +class AwsCloudTrailDataConnectorDataTypesLogs(DataConnectorDataTypeCommon): + """Logs data type. + + :ivar state: Describe whether this data type connection is enabled or not. Required. Known + values are: "Enabled" and "Disabled". + :vartype state: Union[str, "DataTypeState"] + """ + + +class AwsCloudTrailDataConnectorProperties(TypedDict, total=False): + """Amazon Web Services CloudTrail data connector properties. + + :ivar awsRoleArn: The Aws Role Arn (with CloudTrailReadOnly policy) that is used to access the + Aws account. + :vartype awsRoleArn: str + :ivar dataTypes: The available data types for the connector. Required. + :vartype dataTypes: "AwsCloudTrailDataConnectorDataTypes" + """ + + awsRoleArn: str + """The Aws Role Arn (with CloudTrailReadOnly policy) that is used to access the Aws account.""" + dataTypes: Required["AwsCloudTrailDataConnectorDataTypes"] + """The available data types for the connector. Required.""" + + +class AwsS3CheckRequirements(TypedDict, total=False): + """Amazon Web Services S3 requirements check request. + + :ivar kind: Describes the kind of connector to be checked. Required. AmazonWebServicesS3. + :vartype kind: Literal[DataConnectorKind.AMAZON_WEB_SERVICES_S3] + """ + + kind: Required[Literal[DataConnectorKind.AMAZON_WEB_SERVICES_S3]] + """Describes the kind of connector to be checked. Required. AmazonWebServicesS3.""" + + +class AwsS3DataConnector(TypedDict, total=False): + """Represents Amazon Web Services S3 data connector. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: Amazon Web Services S3 data connector properties. + :vartype properties: "AwsS3DataConnectorProperties" + :ivar kind: The data connector kind. Required. AmazonWebServicesS3. + :vartype kind: Literal[DataConnectorKind.AMAZON_WEB_SERVICES_S3] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "AwsS3DataConnectorProperties" + """Amazon Web Services S3 data connector properties.""" + kind: Required[Literal[DataConnectorKind.AMAZON_WEB_SERVICES_S3]] + """The data connector kind. Required. AmazonWebServicesS3.""" + + +class AwsS3DataConnectorDataTypes(TypedDict, total=False): + """The available data types for Amazon Web Services S3 data connector. + + :ivar logs: Logs data type. Required. + :vartype logs: "AwsS3DataConnectorDataTypesLogs" + """ + + logs: Required["AwsS3DataConnectorDataTypesLogs"] + """Logs data type. Required.""" + + +class AwsS3DataConnectorDataTypesLogs(DataConnectorDataTypeCommon): + """Logs data type. + + :ivar state: Describe whether this data type connection is enabled or not. Required. Known + values are: "Enabled" and "Disabled". + :vartype state: Union[str, "DataTypeState"] + """ + + +class AwsS3DataConnectorProperties(TypedDict, total=False): + """Amazon Web Services S3 data connector properties. + + :ivar destinationTable: The logs destination table name in LogAnalytics. Required. + :vartype destinationTable: str + :ivar sqsUrls: The AWS sqs urls for the connector. Required. + :vartype sqsUrls: list[str] + :ivar roleArn: The Aws Role Arn that is used to access the Aws account. Required. + :vartype roleArn: str + :ivar dataTypes: The available data types for the connector. Required. + :vartype dataTypes: "AwsS3DataConnectorDataTypes" + """ + + destinationTable: Required[str] + """The logs destination table name in LogAnalytics. Required.""" + sqsUrls: Required[list[str]] + """The AWS sqs urls for the connector. Required.""" + roleArn: Required[str] + """The Aws Role Arn that is used to access the Aws account. Required.""" + dataTypes: Required["AwsS3DataConnectorDataTypes"] + """The available data types for the connector. Required.""" + + +class AzureDevOpsResourceInfo(TypedDict, total=False): + """Resources created in Azure DevOps repository. + + :ivar pipelineId: Id of the pipeline created for the source-control. + :vartype pipelineId: str + :ivar serviceConnectionId: Id of the service-connection created for the source-control. + :vartype serviceConnectionId: str + """ + + pipelineId: str + """Id of the pipeline created for the source-control.""" + serviceConnectionId: str + """Id of the service-connection created for the source-control.""" + + +class BasicAuthModel(TypedDict, total=False): + """Model for API authentication with basic flow - user name + password. + + :ivar userName: The user name. Required. + :vartype userName: str + :ivar password: The password. Required. + :vartype password: str + :ivar type: The auth type. Required. Basic. + :vartype type: Literal[CcpAuthType.BASIC] + """ + + userName: Required[str] + """The user name. Required.""" + password: Required[str] + """The password. Required.""" + type: Required[Literal[CcpAuthType.BASIC]] + """The auth type. Required. Basic.""" + + +class Bookmark(ProxyResource): + """Represents a bookmark in Azure Security Insights. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar properties: Bookmark properties. + :vartype properties: "BookmarkProperties" + :ivar etag: Etag of the azure resource. + :vartype etag: str + """ + + properties: "BookmarkProperties" + """Bookmark properties.""" + etag: str + """Etag of the azure resource.""" + + +class BookmarkEntityMappings(TypedDict, total=False): + """Describes the entity mappings of a single entity. + + :ivar entityType: The entity type. + :vartype entityType: str + :ivar fieldMappings: Array of fields mapping for that entity type. + :vartype fieldMappings: list["EntityFieldMapping"] + """ + + entityType: str + """The entity type.""" + fieldMappings: list["EntityFieldMapping"] + """Array of fields mapping for that entity type.""" + + +class BookmarkExpandParameters(TypedDict, total=False): + """The parameters required to execute an expand operation on the given bookmark. + + :ivar endTime: The end date filter, so the only expansion results returned are before this + date. + :vartype endTime: str + :ivar expansionId: The Id of the expansion to perform. + :vartype expansionId: str + :ivar startTime: The start date filter, so the only expansion results returned are after this + date. + :vartype startTime: str + """ + + endTime: str + """The end date filter, so the only expansion results returned are before this date.""" + expansionId: str + """The Id of the expansion to perform.""" + startTime: str + """The start date filter, so the only expansion results returned are after this date.""" + + +class BookmarkProperties(TypedDict, total=False): + """Describes bookmark properties. + + :ivar created: The time the bookmark was created. + :vartype created: str + :ivar createdBy: Describes a user that created the bookmark. + :vartype createdBy: "UserInfo" + :ivar displayName: The display name of the bookmark. Required. + :vartype displayName: str + :ivar labels: List of labels relevant to this bookmark. + :vartype labels: list[str] + :ivar notes: The notes of the bookmark. + :vartype notes: str + :ivar query: The query of the bookmark. Required. + :vartype query: str + :ivar queryResult: The query result of the bookmark. + :vartype queryResult: str + :ivar updated: The last time the bookmark was updated. + :vartype updated: str + :ivar updatedBy: Describes a user that updated the bookmark. + :vartype updatedBy: "UserInfo" + :ivar eventTime: The bookmark event time. + :vartype eventTime: str + :ivar queryStartTime: The start time for the query. + :vartype queryStartTime: str + :ivar queryEndTime: The end time for the query. + :vartype queryEndTime: str + :ivar incidentInfo: Describes an incident that relates to bookmark. + :vartype incidentInfo: "IncidentInfo" + :ivar entityMappings: Describes the entity mappings of the bookmark. + :vartype entityMappings: list["BookmarkEntityMappings"] + :ivar tactics: A list of relevant mitre attacks. + :vartype tactics: list[Union[str, "AttackTactic"]] + :ivar techniques: A list of relevant mitre techniques. + :vartype techniques: list[str] + """ + + created: str + """The time the bookmark was created.""" + createdBy: "UserInfo" + """Describes a user that created the bookmark.""" + displayName: Required[str] + """The display name of the bookmark. Required.""" + labels: list[str] + """List of labels relevant to this bookmark.""" + notes: str + """The notes of the bookmark.""" + query: Required[str] + """The query of the bookmark. Required.""" + queryResult: str + """The query result of the bookmark.""" + updated: str + """The last time the bookmark was updated.""" + updatedBy: "UserInfo" + """Describes a user that updated the bookmark.""" + eventTime: str + """The bookmark event time.""" + queryStartTime: str + """The start time for the query.""" + queryEndTime: str + """The end time for the query.""" + incidentInfo: "IncidentInfo" + """Describes an incident that relates to bookmark.""" + entityMappings: list["BookmarkEntityMappings"] + """Describes the entity mappings of the bookmark.""" + tactics: list[Union[str, "AttackTactic"]] + """A list of relevant mitre attacks.""" + techniques: list[str] + """A list of relevant mitre techniques.""" + + +class BooleanConditionProperties(TypedDict, total=False): + """Describes an automation rule condition that applies a boolean operator (e.g AND, OR) to + conditions. + + :ivar conditionProperties: + :vartype conditionProperties: "AutomationRuleBooleanCondition" + :ivar conditionType: Required. Apply a boolean operator (e.g AND, OR) to conditions. + :vartype conditionType: Literal[ConditionType.BOOLEAN] + """ + + conditionProperties: "AutomationRuleBooleanCondition" + conditionType: Required[Literal[ConditionType.BOOLEAN]] + """Required. Apply a boolean operator (e.g AND, OR) to conditions.""" + + +class CcpResponseConfig(TypedDict, total=False): + """A custom response configuration for a rule. + + :ivar eventsJsonPaths: The json paths, '$' char is the json root. Required. + :vartype eventsJsonPaths: list[str] + :ivar successStatusJsonPath: The value where the status message/code should appear in the + response. + :vartype successStatusJsonPath: str + :ivar successStatusValue: The status value. + :vartype successStatusValue: str + :ivar isGzipCompressed: The value indicating whether the remote server support Gzip and we + should expect Gzip response. + :vartype isGzipCompressed: bool + :ivar compressionAlgo: The compression algorithm. For Example: 'gzip', 'multi-gzip', 'deflate'. + :vartype compressionAlgo: str + :ivar format: The response format. possible values are json,csv,xml. + :vartype format: str + :ivar csvDelimiter: The csv delimiter, in case the response format is CSV. + :vartype csvDelimiter: str + :ivar hasCsvBoundary: The value indicating whether the response has CSV boundary in case the + response in CSV format. + :vartype hasCsvBoundary: bool + :ivar hasCsvHeader: The value indicating whether the response has headers in case the response + in CSV format. + :vartype hasCsvHeader: bool + :ivar convertChildPropertiesToArray: The value indicating whether the response isn't an array + of events / logs. By setting this flag to true it means the remote server will response with + an object which each property has as a value an array of events / logs. + :vartype convertChildPropertiesToArray: bool + :ivar csvEscape: The character used to escape characters in CSV. + :vartype csvEscape: str + """ + + eventsJsonPaths: Required[list[str]] + """The json paths, '$' char is the json root. Required.""" + successStatusJsonPath: str + """The value where the status message/code should appear in the response.""" + successStatusValue: Optional[str] + """The status value.""" + isGzipCompressed: bool + """The value indicating whether the remote server support Gzip and we should expect Gzip response.""" + compressionAlgo: str + """The compression algorithm. For Example: 'gzip', 'multi-gzip', 'deflate'.""" + format: str + """The response format. possible values are json,csv,xml.""" + csvDelimiter: str + """The csv delimiter, in case the response format is CSV.""" + hasCsvBoundary: Optional[bool] + """The value indicating whether the response has CSV boundary in case the response in CSV format.""" + hasCsvHeader: Optional[bool] + """The value indicating whether the response has headers in case the response in CSV format.""" + convertChildPropertiesToArray: Optional[bool] + """The value indicating whether the response isn't an array of events / logs. By setting this + flag to true it means the remote server will response with an object which each property has as + a value an array of events / logs.""" + csvEscape: Optional[str] + """The character used to escape characters in CSV.""" + + +class ClientInfo(TypedDict, total=False): + """Information on the client (user or application) that made some action. + + :ivar email: The email of the client. + :vartype email: str + :ivar name: The name of the client. + :vartype name: str + :ivar objectId: The object id of the client. + :vartype objectId: str + :ivar userPrincipalName: The user principal name of the client. + :vartype userPrincipalName: str + """ + + email: str + """The email of the client.""" + name: str + """The name of the client.""" + objectId: str + """The object id of the client.""" + userPrincipalName: str + """The user principal name of the client.""" + + +class CodelessApiPollingDataConnector(TypedDict, total=False): + """Represents Codeless API Polling data connector. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: Codeless poling data connector properties. + :vartype properties: "ApiPollingParameters" + :ivar kind: The data connector kind. Required. APIPolling. + :vartype kind: Literal[DataConnectorKind.API_POLLING] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "ApiPollingParameters" + """Codeless poling data connector properties.""" + kind: Required[Literal[DataConnectorKind.API_POLLING]] + """The data connector kind. Required. APIPolling.""" + + +class CodelessConnectorPollingAuthProperties(TypedDict, total=False): + """Describe the authentication properties needed to successfully authenticate with the server. + + :ivar authType: The authentication type. Required. + :vartype authType: str + :ivar apiKeyName: The header name which the token is sent with. + :vartype apiKeyName: str + :ivar apiKeyIdentifier: A prefix send in the header before the actual token. + :vartype apiKeyIdentifier: str + :ivar isApiKeyInPostPayload: Marks if the key should sent in header. + :vartype isApiKeyInPostPayload: str + :ivar flowName: Describes the flow name, for example 'AuthCode' for Oauth 2.0. + :vartype flowName: str + :ivar tokenEndpoint: The endpoint used to issue a token, used in Oauth 2.0 flow. + :vartype tokenEndpoint: str + :ivar authorizationEndpoint: The endpoint used to authorize the user, used in Oauth 2.0 flow. + :vartype authorizationEndpoint: str + :ivar authorizationEndpointQueryParameters: The query parameters used in authorization request, + used in Oauth 2.0 flow. + :vartype authorizationEndpointQueryParameters: Any + :ivar redirectionEndpoint: The redirect endpoint where we will get the authorization code, used + in Oauth 2.0 flow. + :vartype redirectionEndpoint: str + :ivar tokenEndpointHeaders: The query headers used in token request, used in Oauth 2.0 flow. + :vartype tokenEndpointHeaders: Any + :ivar tokenEndpointQueryParameters: The query parameters used in token request, used in Oauth + 2.0 flow. + :vartype tokenEndpointQueryParameters: Any + :ivar isClientSecretInHeader: Marks if we should send the client secret in header or payload, + used in Oauth 2.0 flow. + :vartype isClientSecretInHeader: bool + :ivar scope: The OAuth token scope. + :vartype scope: str + """ + + authType: Required[str] + """The authentication type. Required.""" + apiKeyName: str + """The header name which the token is sent with.""" + apiKeyIdentifier: str + """A prefix send in the header before the actual token.""" + isApiKeyInPostPayload: str + """Marks if the key should sent in header.""" + flowName: str + """Describes the flow name, for example 'AuthCode' for Oauth 2.0.""" + tokenEndpoint: str + """The endpoint used to issue a token, used in Oauth 2.0 flow.""" + authorizationEndpoint: str + """The endpoint used to authorize the user, used in Oauth 2.0 flow.""" + authorizationEndpointQueryParameters: Any + """The query parameters used in authorization request, used in Oauth 2.0 flow.""" + redirectionEndpoint: str + """The redirect endpoint where we will get the authorization code, used in Oauth 2.0 flow.""" + tokenEndpointHeaders: Any + """The query headers used in token request, used in Oauth 2.0 flow.""" + tokenEndpointQueryParameters: Any + """The query parameters used in token request, used in Oauth 2.0 flow.""" + isClientSecretInHeader: bool + """Marks if we should send the client secret in header or payload, used in Oauth 2.0 flow.""" + scope: str + """The OAuth token scope.""" + + +class CodelessConnectorPollingConfigProperties(TypedDict, total=False): + """Config to describe the polling config for API poller connector. + + :ivar isActive: The poller active status. + :vartype isActive: bool + :ivar auth: Describe the authentication type of the poller. Required. + :vartype auth: "CodelessConnectorPollingAuthProperties" + :ivar request: Describe the poll request config parameters of the poller. Required. + :vartype request: "CodelessConnectorPollingRequestProperties" + :ivar paging: Describe the poll request paging config of the poller. + :vartype paging: "CodelessConnectorPollingPagingProperties" + :ivar response: Describe the response config parameters of the poller. + :vartype response: "CodelessConnectorPollingResponseProperties" + """ + + isActive: bool + """The poller active status.""" + auth: Required["CodelessConnectorPollingAuthProperties"] + """Describe the authentication type of the poller. Required.""" + request: Required["CodelessConnectorPollingRequestProperties"] + """Describe the poll request config parameters of the poller. Required.""" + paging: "CodelessConnectorPollingPagingProperties" + """Describe the poll request paging config of the poller.""" + response: "CodelessConnectorPollingResponseProperties" + """Describe the response config parameters of the poller.""" + + +class CodelessConnectorPollingPagingProperties(TypedDict, total=False): + """Describe the properties needed to make a pagination call. + + :ivar pagingType: Describes the type. could be 'None', 'PageToken', 'PageCount', 'TimeStamp'. + Required. + :vartype pagingType: str + :ivar nextPageParaName: Defines the name of a next page attribute. + :vartype nextPageParaName: str + :ivar nextPageTokenJsonPath: Defines the path to a next page token JSON. + :vartype nextPageTokenJsonPath: str + :ivar pageCountAttributePath: Defines the path to a page count attribute. + :vartype pageCountAttributePath: str + :ivar pageTotalCountAttributePath: Defines the path to a page total count attribute. + :vartype pageTotalCountAttributePath: str + :ivar pageTimeStampAttributePath: Defines the path to a paging time stamp attribute. + :vartype pageTimeStampAttributePath: str + :ivar searchTheLatestTimeStampFromEventsList: Determines whether to search for the latest time + stamp in the events list. + :vartype searchTheLatestTimeStampFromEventsList: str + :ivar pageSizeParaName: Defines the name of the page size parameter. + :vartype pageSizeParaName: str + :ivar pageSize: Defines the paging size. + :vartype pageSize: int + """ + + pagingType: Required[str] + """Describes the type. could be 'None', 'PageToken', 'PageCount', 'TimeStamp'. Required.""" + nextPageParaName: str + """Defines the name of a next page attribute.""" + nextPageTokenJsonPath: str + """Defines the path to a next page token JSON.""" + pageCountAttributePath: str + """Defines the path to a page count attribute.""" + pageTotalCountAttributePath: str + """Defines the path to a page total count attribute.""" + pageTimeStampAttributePath: str + """Defines the path to a paging time stamp attribute.""" + searchTheLatestTimeStampFromEventsList: str + """Determines whether to search for the latest time stamp in the events list.""" + pageSizeParaName: str + """Defines the name of the page size parameter.""" + pageSize: int + """Defines the paging size.""" + + +class CodelessConnectorPollingRequestProperties(TypedDict, total=False): # pylint: disable=name-too-long + """Describe the request properties needed to successfully pull from the server. + + :ivar apiEndpoint: Describe the endpoint we should pull the data from. Required. + :vartype apiEndpoint: str + :ivar rateLimitQps: Defines the rate limit QPS. + :vartype rateLimitQps: int + :ivar queryWindowInMin: The window interval we will use the pull the data. Required. + :vartype queryWindowInMin: int + :ivar httpMethod: The http method type we will use in the poll request, GET or POST. Required. + :vartype httpMethod: str + :ivar queryTimeFormat: The time format will be used the query events in a specific window. + Required. + :vartype queryTimeFormat: str + :ivar retryCount: Describe the amount of time we should try and poll the data in case of + failure. + :vartype retryCount: int + :ivar timeoutInSeconds: The number of seconds we will consider as a request timeout. + :vartype timeoutInSeconds: int + :ivar headers: Describe the headers sent in the poll request. + :vartype headers: Any + :ivar queryParameters: Describe the query parameters sent in the poll request. + :vartype queryParameters: Any + :ivar queryParametersTemplate: For advanced scenarios for example user name/password embedded + in nested JSON payload. + :vartype queryParametersTemplate: str + :ivar startTimeAttributeName: This will be used the query events from a start of the time + window. + :vartype startTimeAttributeName: str + :ivar endTimeAttributeName: This will be used the query events from the end of the time window. + :vartype endTimeAttributeName: str + """ + + apiEndpoint: Required[str] + """Describe the endpoint we should pull the data from. Required.""" + rateLimitQps: int + """Defines the rate limit QPS.""" + queryWindowInMin: Required[int] + """The window interval we will use the pull the data. Required.""" + httpMethod: Required[str] + """The http method type we will use in the poll request, GET or POST. Required.""" + queryTimeFormat: Required[str] + """The time format will be used the query events in a specific window. Required.""" + retryCount: int + """Describe the amount of time we should try and poll the data in case of failure.""" + timeoutInSeconds: int + """The number of seconds we will consider as a request timeout.""" + headers: Any + """Describe the headers sent in the poll request.""" + queryParameters: Any + """Describe the query parameters sent in the poll request.""" + queryParametersTemplate: str + """For advanced scenarios for example user name/password embedded in nested JSON payload.""" + startTimeAttributeName: str + """This will be used the query events from a start of the time window.""" + endTimeAttributeName: str + """This will be used the query events from the end of the time window.""" + + +class CodelessConnectorPollingResponseProperties(TypedDict, total=False): # pylint: disable=name-too-long + """Describes the response from the external server. + + :ivar eventsJsonPaths: Describes the path we should extract the data in the response. Required. + :vartype eventsJsonPaths: list[str] + :ivar successStatusJsonPath: Describes the path we should extract the status code in the + response. + :vartype successStatusJsonPath: str + :ivar successStatusValue: Describes the path we should extract the status value in the + response. + :vartype successStatusValue: str + :ivar isGzipCompressed: Describes if the data in the response is Gzip. + :vartype isGzipCompressed: bool + """ + + eventsJsonPaths: Required[list[str]] + """Describes the path we should extract the data in the response. Required.""" + successStatusJsonPath: str + """Describes the path we should extract the status code in the response.""" + successStatusValue: str + """Describes the path we should extract the status value in the response.""" + isGzipCompressed: bool + """Describes if the data in the response is Gzip.""" + + +class CodelessParameters(TypedDict, total=False): + """Represents Codeless UI data connector. + + :ivar connectorUiConfig: Config to describe the instructions blade. + :vartype connectorUiConfig: "CodelessUiConnectorConfigProperties" + """ + + connectorUiConfig: "CodelessUiConnectorConfigProperties" + """Config to describe the instructions blade.""" + + +class CodelessUiConnectorConfigProperties(TypedDict, total=False): + """Config to describe the instructions blade. + + :ivar title: Connector blade title. Required. + :vartype title: str + :ivar publisher: Connector publisher name. Required. + :vartype publisher: str + :ivar descriptionMarkdown: Connector description. Required. + :vartype descriptionMarkdown: str + :ivar customImage: An optional custom image to be used when displaying the connector within + Azure Sentinel's connector's gallery. + :vartype customImage: str + :ivar graphQueriesTableName: Name of the table the connector will insert the data to. Required. + :vartype graphQueriesTableName: str + :ivar graphQueries: The graph query to show the current data status. Required. + :vartype graphQueries: list["CodelessUiConnectorConfigPropertiesGraphQueriesItem"] + :ivar sampleQueries: The sample queries for the connector. Required. + :vartype sampleQueries: list["CodelessUiConnectorConfigPropertiesSampleQueriesItem"] + :ivar dataTypes: Data types to check for last data received. Required. + :vartype dataTypes: list["CodelessUiConnectorConfigPropertiesDataTypesItem"] + :ivar connectivityCriteria: Define the way the connector check connectivity. Required. + :vartype connectivityCriteria: + list["CodelessUiConnectorConfigPropertiesConnectivityCriteriaItem"] + :ivar availability: Connector Availability Status. Required. + :vartype availability: "Availability" + :ivar permissions: Permissions required for the connector. Required. + :vartype permissions: "Permissions" + :ivar instructionSteps: Instruction steps to enable the connector. Required. + :vartype instructionSteps: list["CodelessUiConnectorConfigPropertiesInstructionStepsItem"] + """ + + title: Required[str] + """Connector blade title. Required.""" + publisher: Required[str] + """Connector publisher name. Required.""" + descriptionMarkdown: Required[str] + """Connector description. Required.""" + customImage: str + """An optional custom image to be used when displaying the connector within Azure Sentinel's + connector's gallery.""" + graphQueriesTableName: Required[str] + """Name of the table the connector will insert the data to. Required.""" + graphQueries: Required[list["CodelessUiConnectorConfigPropertiesGraphQueriesItem"]] + """The graph query to show the current data status. Required.""" + sampleQueries: Required[list["CodelessUiConnectorConfigPropertiesSampleQueriesItem"]] + """The sample queries for the connector. Required.""" + dataTypes: Required[list["CodelessUiConnectorConfigPropertiesDataTypesItem"]] + """Data types to check for last data received. Required.""" + connectivityCriteria: Required[list["CodelessUiConnectorConfigPropertiesConnectivityCriteriaItem"]] + """Define the way the connector check connectivity. Required.""" + availability: Required["Availability"] + """Connector Availability Status. Required.""" + permissions: Required["Permissions"] + """Permissions required for the connector. Required.""" + instructionSteps: Required[list["CodelessUiConnectorConfigPropertiesInstructionStepsItem"]] + """Instruction steps to enable the connector. Required.""" + + +class ConnectivityCriteria(TypedDict, total=False): + """Setting for the connector check connectivity. + + :ivar type: type of connectivity. "IsConnectedQuery" + :vartype type: Union[str, "ConnectivityType"] + :ivar value: Queries for checking connectivity. + :vartype value: list[str] + """ + + type: Union[str, "ConnectivityType"] + """type of connectivity. \"IsConnectedQuery\"""" + value: list[str] + """Queries for checking connectivity.""" + + +class CodelessUiConnectorConfigPropertiesConnectivityCriteriaItem( + ConnectivityCriteria +): # pylint: disable=name-too-long + """CodelessUiConnectorConfigPropertiesConnectivityCriteriaItem. + + :ivar type: type of connectivity. "IsConnectedQuery" + :vartype type: Union[str, "ConnectivityType"] + :ivar value: Queries for checking connectivity. + :vartype value: list[str] + """ + + +class LastDataReceivedDataType(TypedDict, total=False): + """Data type for last data received. + + :ivar name: Name of the data type to show in the graph. can be use with + {{graphQueriesTableName}} placeholder. + :vartype name: str + :ivar lastDataReceivedQuery: Query for indicate last data received. + :vartype lastDataReceivedQuery: str + """ + + name: str + """Name of the data type to show in the graph. can be use with {{graphQueriesTableName}} + placeholder.""" + lastDataReceivedQuery: str + """Query for indicate last data received.""" + + +class CodelessUiConnectorConfigPropertiesDataTypesItem(LastDataReceivedDataType): # pylint: disable=name-too-long + """CodelessUiConnectorConfigPropertiesDataTypesItem. + + :ivar name: Name of the data type to show in the graph. can be use with + {{graphQueriesTableName}} placeholder. + :vartype name: str + :ivar lastDataReceivedQuery: Query for indicate last data received. + :vartype lastDataReceivedQuery: str + """ + + +class GraphQueries(TypedDict, total=False): + """The graph query to show the current data status. + + :ivar metricName: the metric that the query is checking. + :vartype metricName: str + :ivar legend: The legend for the graph. + :vartype legend: str + :ivar baseQuery: The base query for the graph. + :vartype baseQuery: str + """ + + metricName: str + """the metric that the query is checking.""" + legend: str + """The legend for the graph.""" + baseQuery: str + """The base query for the graph.""" + + +class CodelessUiConnectorConfigPropertiesGraphQueriesItem(GraphQueries): # pylint: disable=name-too-long + """CodelessUiConnectorConfigPropertiesGraphQueriesItem. + + :ivar metricName: the metric that the query is checking. + :vartype metricName: str + :ivar legend: The legend for the graph. + :vartype legend: str + :ivar baseQuery: The base query for the graph. + :vartype baseQuery: str + """ + + +class InstructionSteps(TypedDict, total=False): + """Instruction steps to enable the connector. + + :ivar title: Instruction step title. + :vartype title: str + :ivar description: Instruction step description. + :vartype description: str + :ivar instructions: Instruction step details. + :vartype instructions: list["InstructionStepsInstructionsItem"] + """ + + title: str + """Instruction step title.""" + description: str + """Instruction step description.""" + instructions: list["InstructionStepsInstructionsItem"] + """Instruction step details.""" + + +class CodelessUiConnectorConfigPropertiesInstructionStepsItem(InstructionSteps): # pylint: disable=name-too-long + """CodelessUiConnectorConfigPropertiesInstructionStepsItem. + + :ivar title: Instruction step title. + :vartype title: str + :ivar description: Instruction step description. + :vartype description: str + :ivar instructions: Instruction step details. + :vartype instructions: list["InstructionStepsInstructionsItem"] + """ + + +class SampleQueries(TypedDict, total=False): + """The sample queries for the connector. + + :ivar description: The sample query description. + :vartype description: str + :ivar query: the sample query. + :vartype query: str + """ + + description: str + """The sample query description.""" + query: str + """the sample query.""" + + +class CodelessUiConnectorConfigPropertiesSampleQueriesItem(SampleQueries): # pylint: disable=name-too-long + """CodelessUiConnectorConfigPropertiesSampleQueriesItem. + + :ivar description: The sample query description. + :vartype description: str + :ivar query: the sample query. + :vartype query: str + """ + + +class CodelessUiDataConnector(TypedDict, total=False): + """Represents Codeless UI data connector. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: Codeless UI data connector properties. + :vartype properties: "CodelessParameters" + :ivar kind: The data connector kind. Required. GenericUI. + :vartype kind: Literal[DataConnectorKind.GENERIC_UI] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "CodelessParameters" + """Codeless UI data connector properties.""" + kind: Required[Literal[DataConnectorKind.GENERIC_UI]] + """The data connector kind. Required. GenericUI.""" + + +class ConditionClause(TypedDict, total=False): + """Represents a single clause to be evaluated by a NormalizedCondition. + + :ivar clauseConnective: The connective used to join all values in this ConditionClause. Known + values are: "And" and "Or". + :vartype clauseConnective: Union[str, "Connective"] + :ivar field: The name of the field that is evaluated. Required. + :vartype field: str + :ivar operator: Represents an operator in a ConditionClause. Required. Known values are: + "Equals", "NotEquals", "LessThan", "LessThanEqual", "GreaterThan", "GreaterThanEqual", + "StringContains", "StringNotContains", "StringStartsWith", "StringNotStartsWith", + "StringEndsWith", "StringNotEndsWith", "StringIsEmpty", "IsNull", "IsTrue", "IsFalse", + "ArrayContains", "ArrayNotContains", "OnOrAfterRelative", "AfterRelative", + "OnOrBeforeRelative", "BeforeRelative", "OnOrAfterAbsolute", "AfterAbsolute", + "OnOrBeforeAbsolute", and "BeforeAbsolute". + :vartype operator: Union[str, "Operator"] + :ivar values: The top level connective operator for this condition. Required. + :vartype values: list[str] + """ + + clauseConnective: Union[str, "Connective"] + """The connective used to join all values in this ConditionClause. Known values are: \"And\" and + \"Or\".""" + field: Required[str] + """The name of the field that is evaluated. Required.""" + operator: Required[Union[str, "Operator"]] + """Represents an operator in a ConditionClause. Required. Known values are: \"Equals\", + \"NotEquals\", \"LessThan\", \"LessThanEqual\", \"GreaterThan\", \"GreaterThanEqual\", + \"StringContains\", \"StringNotContains\", \"StringStartsWith\", \"StringNotStartsWith\", + \"StringEndsWith\", \"StringNotEndsWith\", \"StringIsEmpty\", \"IsNull\", \"IsTrue\", + \"IsFalse\", \"ArrayContains\", \"ArrayNotContains\", \"OnOrAfterRelative\", \"AfterRelative\", + \"OnOrBeforeRelative\", \"BeforeRelative\", \"OnOrAfterAbsolute\", \"AfterAbsolute\", + \"OnOrBeforeAbsolute\", and \"BeforeAbsolute\".""" + values: Required[list[str]] + """The top level connective operator for this condition. Required.""" + + +class ConditionProperties(TypedDict, total=False): + """Represents a condition used to query for TI objects. + + :ivar stixObjectType: The STIX type for the objects returned by this query. + :vartype stixObjectType: str + :ivar clauses: The list of clauses to be evaluated in disjunction or conjunction base on the + specified top level connective operator. Required. + :vartype clauses: list["ConditionClause"] + :ivar conditionConnective: The top level connective operator for this condition. Known values + are: "And" and "Or". + :vartype conditionConnective: Union[str, "Connective"] + """ + + stixObjectType: str + """The STIX type for the objects returned by this query.""" + clauses: Required[list["ConditionClause"]] + """The list of clauses to be evaluated in disjunction or conjunction base on the specified top + level connective operator. Required.""" + conditionConnective: Union[str, "Connective"] + """The top level connective operator for this condition. Known values are: \"And\" and \"Or\".""" + + +class ConnectivityCriterion(TypedDict, total=False): + """The criteria by which we determine whether the connector is connected or not. For Example, use + a KQL query to check if the expected data type is flowing). + + :ivar type: Gets or sets the type of connectivity. Required. + :vartype type: str + :ivar value: Gets or sets the queries for checking connectivity. + :vartype value: list[str] + """ + + type: Required[str] + """Gets or sets the type of connectivity. Required.""" + value: list[str] + """Gets or sets the queries for checking connectivity.""" + + +class ConnectorDataType(TypedDict, total=False): + """The data type which is created by the connector, including a query indicated when was the last + time that data type was received in the workspace. + + :ivar name: Gets or sets the name of the data type to show in the graph. Required. + :vartype name: str + :ivar lastDataReceivedQuery: Gets or sets the query to indicate when relevant data was last + received in the workspace. Required. + :vartype lastDataReceivedQuery: str + """ + + name: Required[str] + """Gets or sets the name of the data type to show in the graph. Required.""" + lastDataReceivedQuery: Required[str] + """Gets or sets the query to indicate when relevant data was last received in the workspace. + Required.""" + + +class ConnectorDefinitionsAvailability(TypedDict, total=False): + """The exposure status of the connector to the customers. + + :ivar status: The exposure status of the connector to the customers. Available values are 0-4 + (0=None, 1=Available, 2=FeatureFlag, 3=Internal). + :vartype status: int + :ivar isPreview: Gets or sets a value indicating whether the connector is preview. + :vartype isPreview: bool + """ + + status: int + """The exposure status of the connector to the customers. Available values are 0-4 (0=None, + 1=Available, 2=FeatureFlag, 3=Internal).""" + isPreview: bool + """Gets or sets a value indicating whether the connector is preview.""" + + +class ConnectorDefinitionsPermissions(TypedDict, total=False): + """The required Permissions for the connector. + + :ivar tenant: Gets or sets the required tenant permissions for the connector. + :vartype tenant: list[str] + :ivar licenses: Gets or sets the required licenses for the user to create connections. + :vartype licenses: list[str] + :ivar resourceProvider: Gets or sets the resource provider permissions required for the user to + create connections. + :vartype resourceProvider: list["ConnectorDefinitionsResourceProvider"] + :ivar customs: Gets or sets the customs permissions required for the user to create + connections. + :vartype customs: list["CustomPermissionDetails"] + """ + + tenant: list[str] + """Gets or sets the required tenant permissions for the connector.""" + licenses: list[str] + """Gets or sets the required licenses for the user to create connections.""" + resourceProvider: list["ConnectorDefinitionsResourceProvider"] + """Gets or sets the resource provider permissions required for the user to create connections.""" + customs: list["CustomPermissionDetails"] + """Gets or sets the customs permissions required for the user to create connections.""" + + +class ConnectorDefinitionsResourceProvider(TypedDict, total=False): + """The resource provider details include the required permissions for the user to create + connections. The user should have the required permissions(Read\\Write, ..) in the specified + scope ProviderPermissionsScope against the specified resource provider. + + :ivar provider: Gets or sets the provider name. Required. + :vartype provider: str + :ivar permissionsDisplayText: Gets or sets the permissions description text. Required. + :vartype permissionsDisplayText: str + :ivar providerDisplayName: Gets or sets the permissions provider display name. Required. + :vartype providerDisplayName: str + :ivar scope: The scope on which the user should have permissions, in order to be able to create + connections. Required. Known values are: "Subscription", "ResourceGroup", and "Workspace". + :vartype scope: Union[str, "ProviderPermissionsScope"] + :ivar requiredPermissions: Required permissions for the connector resource provider that define + in ResourceProviders. For more information about the permissions see here. + Required. + :vartype requiredPermissions: "ResourceProviderRequiredPermissions" + """ + + provider: Required[str] + """Gets or sets the provider name. Required.""" + permissionsDisplayText: Required[str] + """Gets or sets the permissions description text. Required.""" + providerDisplayName: Required[str] + """Gets or sets the permissions provider display name. Required.""" + scope: Required[Union[str, "ProviderPermissionsScope"]] + """The scope on which the user should have permissions, in order to be able to create connections. + Required. Known values are: \"Subscription\", \"ResourceGroup\", and \"Workspace\".""" + requiredPermissions: Required["ResourceProviderRequiredPermissions"] + """Required permissions for the connector resource provider that define in ResourceProviders. For + more information about the permissions see here. + Required.""" + + +class ConnectorInstructionModelBase(TypedDict, total=False): + """Instruction step details. + + :ivar parameters: The parameters for the setting. + :vartype parameters: Any + :ivar type: The kind of the setting. Required. Known values are: "CopyableLabel", + "InstructionStepsGroup", and "InfoMessage". + :vartype type: Union[str, "SettingType"] + """ + + parameters: Any + """The parameters for the setting.""" + type: Required[Union[str, "SettingType"]] + """The kind of the setting. Required. Known values are: \"CopyableLabel\", + \"InstructionStepsGroup\", and \"InfoMessage\".""" + + +class CountQuery(TypedDict, total=False): + """Represents a query to run on the TI objects in the workspace. + + :ivar properties: Query properties. + :vartype properties: "QueryProperties" + """ + + properties: "QueryProperties" + """Query properties.""" + + +class CustomizableConnectionsConfig(TypedDict, total=False): + """The UiConfig for 'Customizable' connector definition kind. + + :ivar templateSpecName: Gets or sets the template name. The template includes ARM templates + that can be created by the connector, usually it will be the dataConnectors ARM templates. + Required. + :vartype templateSpecName: str + :ivar templateSpecVersion: Gets or sets the template version. Required. + :vartype templateSpecVersion: str + """ + + templateSpecName: Required[str] + """Gets or sets the template name. The template includes ARM templates that can be created by the + connector, usually it will be the dataConnectors ARM templates. Required.""" + templateSpecVersion: Required[str] + """Gets or sets the template version. Required.""" + + +class CustomizableConnectorDefinition(TypedDict, total=False): + """Connector definition for kind 'Customizable'. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: Customizable properties. + :vartype properties: "CustomizableConnectorDefinitionProperties" + :ivar kind: The data connector kind. Required. Customizable. + :vartype kind: Literal[DataConnectorDefinitionKind.CUSTOMIZABLE] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "CustomizableConnectorDefinitionProperties" + """Customizable properties.""" + kind: Required[Literal[DataConnectorDefinitionKind.CUSTOMIZABLE]] + """The data connector kind. Required. Customizable.""" + + +class CustomizableConnectorDefinitionProperties(TypedDict, total=False): # pylint: disable=name-too-long + """The UiConfig for 'Customizable' connector definition kind. + + :ivar createdTimeUtc: Gets or sets the connector definition created date in UTC format. + :vartype createdTimeUtc: str + :ivar lastModifiedUtc: Gets or sets the connector definition last modified date in UTC format. + :vartype lastModifiedUtc: str + :ivar connectorUiConfig: The UiConfig for 'Customizable' connector definition kind. Required. + :vartype connectorUiConfig: "CustomizableConnectorUiConfig" + :ivar connectionsConfig: The UiConfig for 'Customizable' connector definition kind. + :vartype connectionsConfig: "CustomizableConnectionsConfig" + """ + + createdTimeUtc: str + """Gets or sets the connector definition created date in UTC format.""" + lastModifiedUtc: str + """Gets or sets the connector definition last modified date in UTC format.""" + connectorUiConfig: Required["CustomizableConnectorUiConfig"] + """The UiConfig for 'Customizable' connector definition kind. Required.""" + connectionsConfig: "CustomizableConnectionsConfig" + """The UiConfig for 'Customizable' connector definition kind.""" + + +class CustomizableConnectorUiConfig(TypedDict, total=False): + """The UiConfig for 'Customizable' connector definition kind. + + :ivar id: Gets or sets custom connector id. optional field. + :vartype id: str + :ivar title: Gets or sets the connector blade title. Required. + :vartype title: str + :ivar publisher: Gets or sets the connector publisher name. Required. + :vartype publisher: str + :ivar descriptionMarkdown: Gets or sets the connector description in markdown format. Required. + :vartype descriptionMarkdown: str + :ivar graphQueries: Gets or sets the graph queries to show the current data volume over time. + Required. + :vartype graphQueries: list["GraphQuery"] + :ivar dataTypes: Gets or sets the data types to check for last data received. Required. + :vartype dataTypes: list["ConnectorDataType"] + :ivar connectivityCriteria: Gets or sets the way the connector checks whether the connector is + connected. Required. + :vartype connectivityCriteria: list["ConnectivityCriterion"] + :ivar availability: The exposure status of the connector to the customers. + :vartype availability: "ConnectorDefinitionsAvailability" + :ivar permissions: The required Permissions for the connector. Required. + :vartype permissions: "ConnectorDefinitionsPermissions" + :ivar instructionSteps: Gets or sets the instruction steps to enable the connector. Required. + :vartype instructionSteps: list["InstructionStep"] + :ivar logo: Gets or sets the connector logo to be used when displaying the connector within + Azure Sentinel's connector's gallery. The logo value should be in SVG format. + :vartype logo: str + :ivar isConnectivityCriteriasMatchSome: Gets or sets a value indicating whether to use + 'OR'(SOME) or 'AND' between ConnectivityCriteria items. + :vartype isConnectivityCriteriasMatchSome: bool + """ + + id: str + """Gets or sets custom connector id. optional field.""" + title: Required[str] + """Gets or sets the connector blade title. Required.""" + publisher: Required[str] + """Gets or sets the connector publisher name. Required.""" + descriptionMarkdown: Required[str] + """Gets or sets the connector description in markdown format. Required.""" + graphQueries: Required[list["GraphQuery"]] + """Gets or sets the graph queries to show the current data volume over time. Required.""" + dataTypes: Required[list["ConnectorDataType"]] + """Gets or sets the data types to check for last data received. Required.""" + connectivityCriteria: Required[list["ConnectivityCriterion"]] + """Gets or sets the way the connector checks whether the connector is connected. Required.""" + availability: "ConnectorDefinitionsAvailability" + """The exposure status of the connector to the customers.""" + permissions: Required["ConnectorDefinitionsPermissions"] + """The required Permissions for the connector. Required.""" + instructionSteps: Required[list["InstructionStep"]] + """Gets or sets the instruction steps to enable the connector. Required.""" + logo: str + """Gets or sets the connector logo to be used when displaying the connector within Azure + Sentinel's connector's gallery. The logo value should be in SVG format.""" + isConnectivityCriteriasMatchSome: bool + """Gets or sets a value indicating whether to use 'OR'(SOME) or 'AND' between ConnectivityCriteria + items.""" + + +class CustomPermissionDetails(TypedDict, total=False): + """The Custom permissions required for the connector. + + :ivar name: Gets or sets the custom permissions name. Required. + :vartype name: str + :ivar description: Gets or sets the custom permissions description. Required. + :vartype description: str + """ + + name: Required[str] + """Gets or sets the custom permissions name. Required.""" + description: Required[str] + """Gets or sets the custom permissions description. Required.""" + + +class CustomsPermission(TypedDict, total=False): + """Customs permissions required for the connector. + + :ivar name: Customs permissions name. + :vartype name: str + :ivar description: Customs permissions description. + :vartype description: str + """ + + name: str + """Customs permissions name.""" + description: str + """Customs permissions description.""" + + +class Customs(CustomsPermission): + """Customs permissions required for the connector. + + :ivar name: Customs permissions name. + :vartype name: str + :ivar description: Customs permissions description. + :vartype description: str + """ + + +class DataConnectorConnectBody(TypedDict, total=False): + """Represents Codeless API Polling data connector. + + :ivar kind: The authentication kind used to poll the data. Known values are: "Basic", "OAuth2", + and "APIKey". + :vartype kind: Union[str, "ConnectAuthKind"] + :ivar apiKey: The API key of the audit server. + :vartype apiKey: str + :ivar dataCollectionEndpoint: Used in v2 logs connector. Represents the data collection + ingestion endpoint in log analytics. + :vartype dataCollectionEndpoint: str + :ivar dataCollectionRuleImmutableId: Used in v2 logs connector. The data collection rule + immutable id, the rule defines the transformation and data destination. + :vartype dataCollectionRuleImmutableId: str + :ivar outputStream: Used in v2 logs connector. The stream we are sending the data to, this is + the name of the streamDeclarations defined in the DCR. + :vartype outputStream: str + :ivar clientSecret: The client secret of the OAuth 2.0 application. + :vartype clientSecret: str + :ivar clientId: The client id of the OAuth 2.0 application. + :vartype clientId: str + :ivar authorizationCode: The authorization code used in OAuth 2.0 code flow to issue a token. + :vartype authorizationCode: str + :ivar userName: The user name in the audit log server. + :vartype userName: str + :ivar password: The user password in the audit log server. + :vartype password: str + :ivar requestConfigUserInputValues: + :vartype requestConfigUserInputValues: list[Any] + """ + + kind: Union[str, "ConnectAuthKind"] + """The authentication kind used to poll the data. Known values are: \"Basic\", \"OAuth2\", and + \"APIKey\".""" + apiKey: str + """The API key of the audit server.""" + dataCollectionEndpoint: str + """Used in v2 logs connector. Represents the data collection ingestion endpoint in log analytics.""" + dataCollectionRuleImmutableId: str + """Used in v2 logs connector. The data collection rule immutable id, the rule defines the + transformation and data destination.""" + outputStream: str + """Used in v2 logs connector. The stream we are sending the data to, this is the name of the + streamDeclarations defined in the DCR.""" + clientSecret: str + """The client secret of the OAuth 2.0 application.""" + clientId: str + """The client id of the OAuth 2.0 application.""" + authorizationCode: str + """The authorization code used in OAuth 2.0 code flow to issue a token.""" + userName: str + """The user name in the audit log server.""" + password: str + """The user password in the audit log server.""" + requestConfigUserInputValues: list[Any] + + +class DCRConfiguration(TypedDict, total=False): + """The configuration of the destination of the data. + + :ivar dataCollectionEndpoint: Represents the data collection ingestion endpoint in log + analytics. Required. + :vartype dataCollectionEndpoint: str + :ivar dataCollectionRuleImmutableId: The data collection rule immutable id, the rule defines + the transformation and data destination. Required. + :vartype dataCollectionRuleImmutableId: str + :ivar streamName: The stream we are sending the data to. Required. + :vartype streamName: str + """ + + dataCollectionEndpoint: Required[str] + """Represents the data collection ingestion endpoint in log analytics. Required.""" + dataCollectionRuleImmutableId: Required[str] + """The data collection rule immutable id, the rule defines the transformation and data + destination. Required.""" + streamName: Required[str] + """The stream we are sending the data to. Required.""" + + +class Deployment(TypedDict, total=False): + """Description about a deployment. + + :ivar deploymentId: Deployment identifier. + :vartype deploymentId: str + :ivar deploymentState: Current status of the deployment. Known values are: "In_Progress", + "Completed", "Queued", and "Canceling". + :vartype deploymentState: Union[str, "DeploymentState"] + :ivar deploymentResult: The outcome of the deployment. Known values are: "Success", "Canceled", + and "Failed". + :vartype deploymentResult: Union[str, "DeploymentResult"] + :ivar deploymentTime: The time when the deployment finished. + :vartype deploymentTime: str + :ivar deploymentLogsUrl: Url to access repository action logs. + :vartype deploymentLogsUrl: str + """ + + deploymentId: str + """Deployment identifier.""" + deploymentState: Union[str, "DeploymentState"] + """Current status of the deployment. Known values are: \"In_Progress\", \"Completed\", \"Queued\", + and \"Canceling\".""" + deploymentResult: Union[str, "DeploymentResult"] + """The outcome of the deployment. Known values are: \"Success\", \"Canceled\", and \"Failed\".""" + deploymentTime: str + """The time when the deployment finished.""" + deploymentLogsUrl: str + """Url to access repository action logs.""" + + +class DeploymentInfo(TypedDict, total=False): + """Information regarding a deployment. + + :ivar deploymentFetchStatus: Status while fetching the last deployment. Known values are: + "Success", "Unauthorized", and "NotFound". + :vartype deploymentFetchStatus: Union[str, "DeploymentFetchStatus"] + :ivar deployment: Deployment information. + :vartype deployment: "Deployment" + :ivar message: Additional details about the deployment that can be shown to the user. + :vartype message: str + """ + + deploymentFetchStatus: Union[str, "DeploymentFetchStatus"] + """Status while fetching the last deployment. Known values are: \"Success\", \"Unauthorized\", and + \"NotFound\".""" + deployment: "Deployment" + """Deployment information.""" + message: str + """Additional details about the deployment that can be shown to the user.""" + + +class Dynamics365CheckRequirements(TypedDict, total=False): + """Represents Dynamics365 requirements check request. + + :ivar properties: Dynamics365 requirements check properties. + :vartype properties: "Dynamics365CheckRequirementsProperties" + :ivar kind: Describes the kind of connector to be checked. Required. Dynamics365. + :vartype kind: Literal[DataConnectorKind.DYNAMICS365] + """ + + properties: "Dynamics365CheckRequirementsProperties" + """Dynamics365 requirements check properties.""" + kind: Required[Literal[DataConnectorKind.DYNAMICS365]] + """Describes the kind of connector to be checked. Required. Dynamics365.""" + + +class Dynamics365CheckRequirementsProperties(DataConnectorTenantId): + """Dynamics365 requirements check properties. + + :ivar tenantId: The tenant id to connect to, and get the data from. Required. + :vartype tenantId: str + """ + + +class Dynamics365DataConnector(TypedDict, total=False): + """Represents Dynamics365 data connector. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: Dynamics365 data connector properties. + :vartype properties: "Dynamics365DataConnectorProperties" + :ivar kind: The data connector kind. Required. Dynamics365. + :vartype kind: Literal[DataConnectorKind.DYNAMICS365] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "Dynamics365DataConnectorProperties" + """Dynamics365 data connector properties.""" + kind: Required[Literal[DataConnectorKind.DYNAMICS365]] + """The data connector kind. Required. Dynamics365.""" + + +class Dynamics365DataConnectorDataTypes(TypedDict, total=False): + """The available data types for Dynamics365 data connector. + + :ivar dynamics365CdsActivities: Common Data Service data type connection. Required. + :vartype dynamics365CdsActivities: "Dynamics365DataConnectorDataTypesDynamics365CdsActivities" + """ + + dynamics365CdsActivities: Required["Dynamics365DataConnectorDataTypesDynamics365CdsActivities"] + """Common Data Service data type connection. Required.""" + + +class Dynamics365DataConnectorDataTypesDynamics365CdsActivities( + DataConnectorDataTypeCommon +): # pylint: disable=name-too-long + """Common Data Service data type connection. + + :ivar state: Describe whether this data type connection is enabled or not. Required. Known + values are: "Enabled" and "Disabled". + :vartype state: Union[str, "DataTypeState"] + """ + + +class Dynamics365DataConnectorProperties(DataConnectorTenantId): + """Dynamics365 data connector properties. + + :ivar tenantId: The tenant id to connect to, and get the data from. Required. + :vartype tenantId: str + :ivar dataTypes: The available data types for the connector. Required. + :vartype dataTypes: "Dynamics365DataConnectorDataTypes" + """ + + dataTypes: Required["Dynamics365DataConnectorDataTypes"] + """The available data types for the connector. Required.""" + + +class EnrichmentDomainBody(TypedDict, total=False): + """Domain name to be enriched. + + :ivar domain: The domain name. + :vartype domain: str + """ + + domain: str + """The domain name.""" + + +class EnrichmentIpAddressBody(TypedDict, total=False): + """IP address (v4 or v6) to be enriched. + + :ivar ipAddress: The dotted-decimal or colon-separated string representation of the IP address. + :vartype ipAddress: str + """ + + ipAddress: str + """The dotted-decimal or colon-separated string representation of the IP address.""" + + +class EntityAnalytics(TypedDict, total=False): + """Settings with single toggle. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: EntityAnalytics properties. + :vartype properties: "EntityAnalyticsProperties" + :ivar kind: The kind of the setting. Required. EntityAnalytics. + :vartype kind: Literal[SettingKind.ENTITY_ANALYTICS] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "EntityAnalyticsProperties" + """EntityAnalytics properties.""" + kind: Required[Literal[SettingKind.ENTITY_ANALYTICS]] + """The kind of the setting. Required. EntityAnalytics.""" + + +class EntityAnalyticsProperties(TypedDict, total=False): + """EntityAnalytics property bag. + + :ivar entityProviders: The relevant entity providers that are synced. + :vartype entityProviders: list[Union[str, "EntityProviders"]] + """ + + entityProviders: list[Union[str, "EntityProviders"]] + """The relevant entity providers that are synced.""" + + +class EntityExpandParameters(TypedDict, total=False): + """The parameters required to execute an expand operation on the given entity. + + :ivar endTime: The end date filter, so the only expansion results returned are before this + date. + :vartype endTime: str + :ivar expansionId: The Id of the expansion to perform. + :vartype expansionId: str + :ivar startTime: The start date filter, so the only expansion results returned are after this + date. + :vartype startTime: str + """ + + endTime: str + """The end date filter, so the only expansion results returned are before this date.""" + expansionId: str + """The Id of the expansion to perform.""" + startTime: str + """The start date filter, so the only expansion results returned are after this date.""" + + +class EntityFieldMapping(TypedDict, total=False): + """Map identifiers of a single entity. + + :ivar identifier: Alert V3 identifier. + :vartype identifier: str + :ivar value: The value of the identifier. + :vartype value: str + """ + + identifier: str + """Alert V3 identifier.""" + value: str + """The value of the identifier.""" + + +class EntityGetInsightsParameters(TypedDict, total=False): + """The parameters required to execute insights operation on the given entity. + + :ivar startTime: The start timeline date, so the results returned are after this date. + Required. + :vartype startTime: str + :ivar endTime: The end timeline date, so the results returned are before this date. Required. + :vartype endTime: str + :ivar addDefaultExtendedTimeRange: Indicates if query time range should be extended with + default time range of the query. Default value is false. + :vartype addDefaultExtendedTimeRange: bool + :ivar insightQueryIds: List of Insights Query Id. If empty, default value is all insights of + this entity. + :vartype insightQueryIds: list[str] + """ + + startTime: Required[str] + """The start timeline date, so the results returned are after this date. Required.""" + endTime: Required[str] + """The end timeline date, so the results returned are before this date. Required.""" + addDefaultExtendedTimeRange: bool + """Indicates if query time range should be extended with default time range of the query. Default + value is false.""" + insightQueryIds: list[str] + """List of Insights Query Id. If empty, default value is all insights of this entity.""" + + +class EntityManualTriggerRequestBody(TypedDict, total=False): + """Describes the request body for triggering a playbook on an entity. + + :ivar incidentArmId: Incident ARM id. + :vartype incidentArmId: str + :ivar tenantId: The tenant id of the playbook resource. + :vartype tenantId: str + :ivar logicAppsResourceId: The resource id of the playbook resource. Required. + :vartype logicAppsResourceId: str + """ + + incidentArmId: str + """Incident ARM id.""" + tenantId: str + """The tenant id of the playbook resource.""" + logicAppsResourceId: Required[str] + """The resource id of the playbook resource. Required.""" + + +class EntityMapping(TypedDict, total=False): + """Single entity mapping for the alert rule. + + :ivar entityType: The V3 type of the mapped entity. Known values are: "Account", "Host", "IP", + "Malware", "File", "Process", "CloudApplication", "DNS", "AzureResource", "FileHash", + "RegistryKey", "RegistryValue", "SecurityGroup", "URL", "Mailbox", "MailCluster", + "MailMessage", and "SubmissionMail". + :vartype entityType: Union[str, "EntityMappingType"] + :ivar fieldMappings: array of field mappings for the given entity mapping. + :vartype fieldMappings: list["FieldMapping"] + """ + + entityType: Union[str, "EntityMappingType"] + """The V3 type of the mapped entity. Known values are: \"Account\", \"Host\", \"IP\", \"Malware\", + \"File\", \"Process\", \"CloudApplication\", \"DNS\", \"AzureResource\", \"FileHash\", + \"RegistryKey\", \"RegistryValue\", \"SecurityGroup\", \"URL\", \"Mailbox\", \"MailCluster\", + \"MailMessage\", and \"SubmissionMail\".""" + fieldMappings: list["FieldMapping"] + """array of field mappings for the given entity mapping.""" + + +class EntityTimelineParameters(TypedDict, total=False): + """The parameters required to execute s timeline operation on the given entity. + + :ivar kinds: Array of timeline Item kinds. + :vartype kinds: list[Union[str, "EntityTimelineKind"]] + :ivar startTime: The start timeline date, so the results returned are after this date. + Required. + :vartype startTime: str + :ivar endTime: The end timeline date, so the results returned are before this date. Required. + :vartype endTime: str + :ivar numberOfBucket: The number of bucket for timeline queries aggregation. + :vartype numberOfBucket: int + """ + + kinds: list[Union[str, "EntityTimelineKind"]] + """Array of timeline Item kinds.""" + startTime: Required[str] + """The start timeline date, so the results returned are after this date. Required.""" + endTime: Required[str] + """The end timeline date, so the results returned are before this date. Required.""" + numberOfBucket: int + """The number of bucket for timeline queries aggregation.""" + + +class EventGroupingSettings(TypedDict, total=False): + """Event grouping settings property bag. + + :ivar aggregationKind: The event grouping aggregation kinds. Known values are: "SingleAlert" + and "AlertPerResult". + :vartype aggregationKind: Union[str, "EventGroupingAggregationKind"] + """ + + aggregationKind: Union[str, "EventGroupingAggregationKind"] + """The event grouping aggregation kinds. Known values are: \"SingleAlert\" and \"AlertPerResult\".""" + + +class EyesOn(TypedDict, total=False): + """Settings with single toggle. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: EyesOn properties. + :vartype properties: "EyesOnSettingsProperties" + :ivar kind: The kind of the setting. Required. EyesOn. + :vartype kind: Literal[SettingKind.EYES_ON] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "EyesOnSettingsProperties" + """EyesOn properties.""" + kind: Required[Literal[SettingKind.EYES_ON]] + """The kind of the setting. Required. EyesOn.""" + + +class EyesOnSettingsProperties(TypedDict, total=False): + """EyesOn property bag. + + :ivar isEnabled: Determines whether the setting is enable or disabled. + :vartype isEnabled: bool + """ + + isEnabled: bool + """Determines whether the setting is enable or disabled.""" + + +class FieldMapping(TypedDict, total=False): + """A single field mapping of the mapped entity. + + :ivar identifier: the V3 identifier of the entity. + :vartype identifier: str + :ivar columnName: the column name to be mapped to the identifier. + :vartype columnName: str + """ + + identifier: str + """the V3 identifier of the entity.""" + columnName: str + """the column name to be mapped to the identifier.""" + + +class FileImport(ProxyResource): + """Represents a file import in Azure Security Insights. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar properties: File import properties. + :vartype properties: "FileImportProperties" + """ + + properties: "FileImportProperties" + """File import properties.""" + + +class FileImportProperties(TypedDict, total=False): + """Describes the FileImport's properties. + + :ivar ingestionMode: Describes how to ingest the records in the file. Required. Known values + are: "IngestOnlyIfAllAreValid", "IngestAnyValidRecords", and "Unspecified". + :vartype ingestionMode: Union[str, "IngestionMode"] + :ivar contentType: The content type of this file. Required. Known values are: "BasicIndicator", + "StixIndicator", and "Unspecified". + :vartype contentType: Union[str, "FileImportContentType"] + :ivar createdTimeUTC: The time the file was imported. + :vartype createdTimeUTC: str + :ivar errorFile: Represents the error file (if the import was ingested with errors or failed + the validation). + :vartype errorFile: "FileMetadata" + :ivar errorsPreview: An ordered list of some of the errors that were encountered during + validation. + :vartype errorsPreview: list["ValidationError"] + :ivar importFile: Represents the imported file. Required. + :vartype importFile: "FileMetadata" + :ivar ingestedRecordCount: The number of records that have been successfully ingested. + :vartype ingestedRecordCount: int + :ivar source: The source for the data in the file. Required. + :vartype source: str + :ivar state: The state of the file import. Known values are: "FatalError", "Ingested", + "IngestedWithErrors", "InProgress", "Invalid", "WaitingForUpload", and "Unspecified". + :vartype state: Union[str, "FileImportState"] + :ivar totalRecordCount: The number of records in the file. + :vartype totalRecordCount: int + :ivar validRecordCount: The number of records that have passed validation. + :vartype validRecordCount: int + :ivar filesValidUntilTimeUTC: The time the files associated with this import are deleted from + the storage account. + :vartype filesValidUntilTimeUTC: str + :ivar importValidUntilTimeUTC: The time the file import record is soft deleted from the + database and history. + :vartype importValidUntilTimeUTC: str + """ + + ingestionMode: Required[Union[str, "IngestionMode"]] + """Describes how to ingest the records in the file. Required. Known values are: + \"IngestOnlyIfAllAreValid\", \"IngestAnyValidRecords\", and \"Unspecified\".""" + contentType: Required[Union[str, "FileImportContentType"]] + """The content type of this file. Required. Known values are: \"BasicIndicator\", + \"StixIndicator\", and \"Unspecified\".""" + createdTimeUTC: str + """The time the file was imported.""" + errorFile: "FileMetadata" + """Represents the error file (if the import was ingested with errors or failed the validation).""" + errorsPreview: list["ValidationError"] + """An ordered list of some of the errors that were encountered during validation.""" + importFile: Required["FileMetadata"] + """Represents the imported file. Required.""" + ingestedRecordCount: int + """The number of records that have been successfully ingested.""" + source: Required[str] + """The source for the data in the file. Required.""" + state: Union[str, "FileImportState"] + """The state of the file import. Known values are: \"FatalError\", \"Ingested\", + \"IngestedWithErrors\", \"InProgress\", \"Invalid\", \"WaitingForUpload\", and \"Unspecified\".""" + totalRecordCount: int + """The number of records in the file.""" + validRecordCount: int + """The number of records that have passed validation.""" + filesValidUntilTimeUTC: str + """The time the files associated with this import are deleted from the storage account.""" + importValidUntilTimeUTC: str + """The time the file import record is soft deleted from the database and history.""" + + +class FileMetadata(TypedDict, total=False): + """Represents a file. + + :ivar fileFormat: The format of the file. Known values are: "CSV", "JSON", and "Unspecified". + :vartype fileFormat: Union[str, "FileFormat"] + :ivar fileName: The name of the file. + :vartype fileName: str + :ivar fileSize: The size of the file. + :vartype fileSize: int + :ivar fileContentUri: A URI with a valid SAS token to allow uploading / downloading the file. + :vartype fileContentUri: str + :ivar deleteStatus: Indicates whether the file was deleted from the storage account. Known + values are: "Deleted", "NotDeleted", and "Unspecified". + :vartype deleteStatus: Union[str, "DeleteStatus"] + """ + + fileFormat: Union[str, "FileFormat"] + """The format of the file. Known values are: \"CSV\", \"JSON\", and \"Unspecified\".""" + fileName: str + """The name of the file.""" + fileSize: int + """The size of the file.""" + fileContentUri: str + """A URI with a valid SAS token to allow uploading / downloading the file.""" + deleteStatus: Union[str, "DeleteStatus"] + """Indicates whether the file was deleted from the storage account. Known values are: \"Deleted\", + \"NotDeleted\", and \"Unspecified\".""" + + +class FusionAlertRule(TypedDict, total=False): + """Represents Fusion alert rule. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: Fusion alert rule properties. + :vartype properties: "FusionAlertRuleProperties" + :ivar kind: The kind of the alert rule. Required. Fusion. + :vartype kind: Literal[AlertRuleKind.FUSION] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "FusionAlertRuleProperties" + """Fusion alert rule properties.""" + kind: Required[Literal[AlertRuleKind.FUSION]] + """The kind of the alert rule. Required. Fusion.""" + + +class FusionAlertRuleProperties(TypedDict, total=False): + """Fusion alert rule base property bag. + + :ivar alertRuleTemplateName: The Name of the alert rule template used to create this rule. + Required. + :vartype alertRuleTemplateName: str + :ivar description: The description of the alert rule. + :vartype description: str + :ivar displayName: The display name for alerts created by this alert rule. + :vartype displayName: str + :ivar enabled: Determines whether this alert rule is enabled or disabled. Required. + :vartype enabled: bool + :ivar sourceSettings: Configuration for all supported source signals in fusion detection. + :vartype sourceSettings: list["FusionSourceSettings"] + :ivar scenarioExclusionPatterns: Configuration to exclude scenarios in fusion detection. + :vartype scenarioExclusionPatterns: list["FusionScenarioExclusionPattern"] + :ivar lastModifiedUtc: The last time that this alert has been modified. + :vartype lastModifiedUtc: str + :ivar severity: The severity for alerts created by this alert rule. Known values are: "High", + "Medium", "Low", and "Informational". + :vartype severity: Union[str, "AlertSeverity"] + :ivar tactics: The tactics of the alert rule. + :vartype tactics: list[Union[str, "AttackTactic"]] + :ivar techniques: The techniques of the alert rule. + :vartype techniques: list[str] + :ivar subTechniques: The sub-techniques of the alert rule. + :vartype subTechniques: list[str] + """ + + alertRuleTemplateName: Required[str] + """The Name of the alert rule template used to create this rule. Required.""" + description: str + """The description of the alert rule.""" + displayName: str + """The display name for alerts created by this alert rule.""" + enabled: Required[bool] + """Determines whether this alert rule is enabled or disabled. Required.""" + sourceSettings: list["FusionSourceSettings"] + """Configuration for all supported source signals in fusion detection.""" + scenarioExclusionPatterns: list["FusionScenarioExclusionPattern"] + """Configuration to exclude scenarios in fusion detection.""" + lastModifiedUtc: str + """The last time that this alert has been modified.""" + severity: Union[str, "AlertSeverity"] + """The severity for alerts created by this alert rule. Known values are: \"High\", \"Medium\", + \"Low\", and \"Informational\".""" + tactics: list[Union[str, "AttackTactic"]] + """The tactics of the alert rule.""" + techniques: list[str] + """The techniques of the alert rule.""" + subTechniques: list[str] + """The sub-techniques of the alert rule.""" + + +class FusionScenarioExclusionPattern(TypedDict, total=False): + """Represents a Fusion scenario exclusion patterns in Fusion detection. + + :ivar exclusionPattern: Scenario exclusion pattern. Required. + :vartype exclusionPattern: str + :ivar dateAddedInUTC: DateTime when scenario exclusion pattern is added in UTC. Required. + :vartype dateAddedInUTC: str + """ + + exclusionPattern: Required[str] + """Scenario exclusion pattern. Required.""" + dateAddedInUTC: Required[str] + """DateTime when scenario exclusion pattern is added in UTC. Required.""" + + +class FusionSourceSettings(TypedDict, total=False): + """Represents a supported source signal configuration in Fusion detection. + + :ivar enabled: Determines whether this source signal is enabled or disabled in Fusion + detection. Required. + :vartype enabled: bool + :ivar sourceName: Name of the Fusion source signal. Refer to Fusion alert rule template for + supported values. Required. + :vartype sourceName: str + :ivar sourceSubTypes: Configuration for all source subtypes under this source signal consumed + in fusion detection. + :vartype sourceSubTypes: list["FusionSourceSubTypeSetting"] + """ + + enabled: Required[bool] + """Determines whether this source signal is enabled or disabled in Fusion detection. Required.""" + sourceName: Required[str] + """Name of the Fusion source signal. Refer to Fusion alert rule template for supported values. + Required.""" + sourceSubTypes: list["FusionSourceSubTypeSetting"] + """Configuration for all source subtypes under this source signal consumed in fusion detection.""" + + +class FusionSourceSubTypeSetting(TypedDict, total=False): + """Represents a supported source subtype configuration under a source signal in Fusion detection. + + :ivar enabled: Determines whether this source subtype under source signal is enabled or + disabled in Fusion detection. Required. + :vartype enabled: bool + :ivar sourceSubTypeName: The Name of the source subtype under a given source signal in Fusion + detection. Refer to Fusion alert rule template for supported values. Required. + :vartype sourceSubTypeName: str + :ivar sourceSubTypeDisplayName: The display name of source subtype under a source signal + consumed in Fusion detection. + :vartype sourceSubTypeDisplayName: str + :ivar severityFilters: Severity configuration for a source subtype consumed in fusion + detection. Required. + :vartype severityFilters: "FusionSubTypeSeverityFilter" + """ + + enabled: Required[bool] + """Determines whether this source subtype under source signal is enabled or disabled in Fusion + detection. Required.""" + sourceSubTypeName: Required[str] + """The Name of the source subtype under a given source signal in Fusion detection. Refer to Fusion + alert rule template for supported values. Required.""" + sourceSubTypeDisplayName: str + """The display name of source subtype under a source signal consumed in Fusion detection.""" + severityFilters: Required["FusionSubTypeSeverityFilter"] + """Severity configuration for a source subtype consumed in fusion detection. Required.""" + + +class FusionSubTypeSeverityFilter(TypedDict, total=False): + """Represents severity configuration for a source subtype consumed in Fusion detection. + + :ivar isSupported: Determines whether this source subtype supports severity configuration or + not. + :vartype isSupported: bool + :ivar filters: Individual Severity configuration settings for a given source subtype consumed + in Fusion detection. + :vartype filters: list["FusionSubTypeSeverityFiltersItem"] + """ + + isSupported: bool + """Determines whether this source subtype supports severity configuration or not.""" + filters: list["FusionSubTypeSeverityFiltersItem"] + """Individual Severity configuration settings for a given source subtype consumed in Fusion + detection.""" + + +class FusionSubTypeSeverityFiltersItem(TypedDict, total=False): + """Represents a Severity filter setting for a given source subtype consumed in Fusion detection. + + :ivar severity: The Severity for a given source subtype consumed in Fusion detection. Required. + Known values are: "High", "Medium", "Low", and "Informational". + :vartype severity: Union[str, "AlertSeverity"] + :ivar enabled: Determines whether this severity is enabled or disabled for this source subtype + consumed in Fusion detection. Required. + :vartype enabled: bool + """ + + severity: Required[Union[str, "AlertSeverity"]] + """The Severity for a given source subtype consumed in Fusion detection. Required. Known values + are: \"High\", \"Medium\", \"Low\", and \"Informational\".""" + enabled: Required[bool] + """Determines whether this severity is enabled or disabled for this source subtype consumed in + Fusion detection. Required.""" + + +class GCPAuthModel(TypedDict, total=False): + """Model for API authentication for all GCP kind connectors. + + :ivar serviceAccountEmail: GCP Service Account Email. Required. + :vartype serviceAccountEmail: str + :ivar projectNumber: GCP Project Number. Required. + :vartype projectNumber: str + :ivar workloadIdentityProviderId: GCP Workload Identity Provider ID. Required. + :vartype workloadIdentityProviderId: str + :ivar type: The auth type. Required. GCP. + :vartype type: Literal[CcpAuthType.GCP] + """ + + serviceAccountEmail: Required[str] + """GCP Service Account Email. Required.""" + projectNumber: Required[str] + """GCP Project Number. Required.""" + workloadIdentityProviderId: Required[str] + """GCP Workload Identity Provider ID. Required.""" + type: Required[Literal[CcpAuthType.GCP]] + """The auth type. Required. GCP.""" + + +class GCPAuthProperties(TypedDict, total=False): + """Google Cloud Platform auth section properties. + + :ivar serviceAccountEmail: The service account that is used to access the GCP project. + Required. + :vartype serviceAccountEmail: str + :ivar projectNumber: The GCP project number. Required. + :vartype projectNumber: str + :ivar workloadIdentityProviderId: The workload identity provider id that is used to gain access + to the GCP project. Required. + :vartype workloadIdentityProviderId: str + """ + + serviceAccountEmail: Required[str] + """The service account that is used to access the GCP project. Required.""" + projectNumber: Required[str] + """The GCP project number. Required.""" + workloadIdentityProviderId: Required[str] + """The workload identity provider id that is used to gain access to the GCP project. Required.""" + + +class GCPDataConnector(TypedDict, total=False): + """Represents Google Cloud Platform data connector. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: Google Cloud Platform data connector properties. + :vartype properties: "GCPDataConnectorProperties" + :ivar kind: The data connector kind. Required. GCP. + :vartype kind: Literal[DataConnectorKind.GCP] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "GCPDataConnectorProperties" + """Google Cloud Platform data connector properties.""" + kind: Required[Literal[DataConnectorKind.GCP]] + """The data connector kind. Required. GCP.""" + + +class GCPDataConnectorProperties(TypedDict, total=False): + """Google Cloud Platform data connector properties. + + :ivar connectorDefinitionName: The name of the connector definition that represents the UI + config. Required. + :vartype connectorDefinitionName: str + :ivar auth: The auth section of the connector. Required. + :vartype auth: "GCPAuthProperties" + :ivar request: The request section of the connector. Required. + :vartype request: "GCPRequestProperties" + :ivar dcrConfig: The configuration of the destination of the data. + :vartype dcrConfig: "DCRConfiguration" + """ + + connectorDefinitionName: Required[str] + """The name of the connector definition that represents the UI config. Required.""" + auth: Required["GCPAuthProperties"] + """The auth section of the connector. Required.""" + request: Required["GCPRequestProperties"] + """The request section of the connector. Required.""" + dcrConfig: "DCRConfiguration" + """The configuration of the destination of the data.""" + + +class GCPRequestProperties(TypedDict, total=False): + """Google Cloud Platform request section properties. + + :ivar projectId: The GCP project id. Required. + :vartype projectId: str + :ivar subscriptionNames: The GCP pub/sub subscription names. Required. + :vartype subscriptionNames: list[str] + """ + + projectId: Required[str] + """The GCP project id. Required.""" + subscriptionNames: Required[list[str]] + """The GCP pub/sub subscription names. Required.""" + + +class GenericBlobSbsAuthModel(TypedDict, total=False): + """Model for API authentication for working with service bus or storage account. + + :ivar credentialsConfig: Credentials for service bus namespace, keyvault uri for access key. + :vartype credentialsConfig: dict[str, str] + :ivar storageAccountCredentialsConfig: Credentials for storage account, keyvault uri for access + key. + :vartype storageAccountCredentialsConfig: dict[str, str] + :ivar type: The auth type. Required. ServiceBus. + :vartype type: Literal[CcpAuthType.SERVICE_BUS] + """ + + credentialsConfig: dict[str, str] + """Credentials for service bus namespace, keyvault uri for access key.""" + storageAccountCredentialsConfig: dict[str, str] + """Credentials for storage account, keyvault uri for access key.""" + type: Required[Literal[CcpAuthType.SERVICE_BUS]] + """The auth type. Required. ServiceBus.""" + + +class GitHubAuthModel(TypedDict, total=False): + """Model for API authentication for GitHub. For this authentication first we need to approve the + Router app (Microsoft Security DevOps) to access the GitHub account, Then we only need the + InstallationId to get the access token from + `https://api.github.com/app/installations/{installId}/access_tokens + `_. + + :ivar installationId: The GitHubApp auth installation id. + :vartype installationId: str + :ivar type: The auth type. Required. GitHub. + :vartype type: Literal[CcpAuthType.GIT_HUB] + """ + + installationId: str + """The GitHubApp auth installation id.""" + type: Required[Literal[CcpAuthType.GIT_HUB]] + """The auth type. Required. GitHub.""" + + +class GitHubResourceInfo(TypedDict, total=False): + """Resources created in GitHub repository. + + :ivar appInstallationId: GitHub application installation id. + :vartype appInstallationId: str + """ + + appInstallationId: str + """GitHub application installation id.""" + + +class GraphQuery(TypedDict, total=False): + """The graph query to show the volume of data arriving into the workspace over time. + + :ivar metricName: Gets or sets the metric name that the query is checking. For example: 'Total + data receive'. Required. + :vartype metricName: str + :ivar legend: Gets or sets the legend for the graph. Required. + :vartype legend: str + :ivar baseQuery: Gets or sets the base query for the graph. The base query is wrapped by + Sentinel UI infra with a KQL query, that measures the volume over time. Required. + :vartype baseQuery: str + """ + + metricName: Required[str] + """Gets or sets the metric name that the query is checking. For example: 'Total data receive'. + Required.""" + legend: Required[str] + """Gets or sets the legend for the graph. Required.""" + baseQuery: Required[str] + """Gets or sets the base query for the graph. The base query is wrapped by Sentinel UI infra with + a KQL query, that measures the volume over time. Required.""" + + +class GroupingConfiguration(TypedDict, total=False): + """Grouping configuration property bag. + + :ivar enabled: Grouping enabled. Required. + :vartype enabled: bool + :ivar reopenClosedIncident: Re-open closed matching incidents. Required. + :vartype reopenClosedIncident: bool + :ivar lookbackDuration: Limit the group to alerts created within the lookback duration (in ISO + 8601 duration format). Required. + :vartype lookbackDuration: str + :ivar matchingMethod: Grouping matching method. When method is Selected at least one of + groupByEntities, groupByAlertDetails, groupByCustomDetails must be provided and not empty. + Required. Known values are: "AllEntities", "AnyAlert", and "Selected". + :vartype matchingMethod: Union[str, "MatchingMethod"] + :ivar groupByEntities: A list of entity types to group by (when matchingMethod is Selected). + Only entities defined in the current alert rule may be used. + :vartype groupByEntities: list[Union[str, "EntityMappingType"]] + :ivar groupByAlertDetails: A list of alert details to group by (when matchingMethod is + Selected). + :vartype groupByAlertDetails: list[Union[str, "AlertDetail"]] + :ivar groupByCustomDetails: A list of custom details keys to group by (when matchingMethod is + Selected). Only keys defined in the current alert rule may be used. + :vartype groupByCustomDetails: list[str] + """ + + enabled: Required[bool] + """Grouping enabled. Required.""" + reopenClosedIncident: Required[bool] + """Re-open closed matching incidents. Required.""" + lookbackDuration: Required[str] + """Limit the group to alerts created within the lookback duration (in ISO 8601 duration format). + Required.""" + matchingMethod: Required[Union[str, "MatchingMethod"]] + """Grouping matching method. When method is Selected at least one of groupByEntities, + groupByAlertDetails, groupByCustomDetails must be provided and not empty. Required. Known + values are: \"AllEntities\", \"AnyAlert\", and \"Selected\".""" + groupByEntities: list[Union[str, "EntityMappingType"]] + """A list of entity types to group by (when matchingMethod is Selected). Only entities defined in + the current alert rule may be used.""" + groupByAlertDetails: list[Union[str, "AlertDetail"]] + """A list of alert details to group by (when matchingMethod is Selected).""" + groupByCustomDetails: list[str] + """A list of custom details keys to group by (when matchingMethod is Selected). Only keys defined + in the current alert rule may be used.""" + + +class Hunt(ProxyResource): + """Represents a Hunt in Azure Security Insights. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar properties: Hunt properties. + :vartype properties: "HuntProperties" + :ivar etag: Etag of the azure resource. + :vartype etag: str + """ + + properties: "HuntProperties" + """Hunt properties.""" + etag: str + """Etag of the azure resource.""" + + +class HuntComment(ProxyResource): + """Represents a Hunt Comment in Azure Security Insights. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar properties: Hunt Comment properties. + :vartype properties: "HuntCommentProperties" + :ivar etag: Etag of the azure resource. + :vartype etag: str + """ + + properties: "HuntCommentProperties" + """Hunt Comment properties.""" + etag: str + """Etag of the azure resource.""" + + +class HuntCommentProperties(TypedDict, total=False): + """Describes a hunt comment properties. + + :ivar message: The message for the comment. Required. + :vartype message: str + """ + + message: Required[str] + """The message for the comment. Required.""" + + +class HuntOwner(TypedDict, total=False): + """Describes a user that the hunt is assigned to. + + :ivar email: The email of the user the hunt is assigned to. + :vartype email: str + :ivar assignedTo: The name of the user the hunt is assigned to. + :vartype assignedTo: str + :ivar objectId: The object id of the user the hunt is assigned to. + :vartype objectId: str + :ivar userPrincipalName: The user principal name of the user the hunt is assigned to. + :vartype userPrincipalName: str + :ivar ownerType: The type of the owner the hunt is assigned to. Known values are: "Unknown", + "User", and "Group". + :vartype ownerType: Union[str, "OwnerType"] + """ + + email: str + """The email of the user the hunt is assigned to.""" + assignedTo: str + """The name of the user the hunt is assigned to.""" + objectId: Optional[str] + """The object id of the user the hunt is assigned to.""" + userPrincipalName: str + """The user principal name of the user the hunt is assigned to.""" + ownerType: Union[str, "OwnerType"] + """The type of the owner the hunt is assigned to. Known values are: \"Unknown\", \"User\", and + \"Group\".""" + + +class HuntProperties(TypedDict, total=False): + """Describes hunt properties. + + :ivar displayName: The display name of the hunt. Required. + :vartype displayName: str + :ivar description: The description of the hunt. Required. + :vartype description: str + :ivar status: The status of the hunt. Known values are: "New", "Active", "Closed", "Backlog", + "Approved", "Succeeded", "Failed", and "InProgress". + :vartype status: Union[str, "Status"] + :ivar hypothesisStatus: The hypothesis status of the hunt. Known values are: "Unknown", + "Invalidated", and "Validated". + :vartype hypothesisStatus: Union[str, "HypothesisStatus"] + :ivar attackTactics: A list of mitre attack tactics the hunt is associated with. + :vartype attackTactics: list[Union[str, "AttackTactic"]] + :ivar attackTechniques: A list of a mitre attack techniques the hunt is associated with. + :vartype attackTechniques: list[str] + :ivar labels: List of labels relevant to this hunt. + :vartype labels: list[str] + :ivar owner: Describes a user that the hunt is assigned to. + :vartype owner: "HuntOwner" + """ + + displayName: Required[str] + """The display name of the hunt. Required.""" + description: Required[str] + """The description of the hunt. Required.""" + status: Union[str, "Status"] + """The status of the hunt. Known values are: \"New\", \"Active\", \"Closed\", \"Backlog\", + \"Approved\", \"Succeeded\", \"Failed\", and \"InProgress\".""" + hypothesisStatus: Union[str, "HypothesisStatus"] + """The hypothesis status of the hunt. Known values are: \"Unknown\", \"Invalidated\", and + \"Validated\".""" + attackTactics: list[Union[str, "AttackTactic"]] + """A list of mitre attack tactics the hunt is associated with.""" + attackTechniques: list[str] + """A list of a mitre attack techniques the hunt is associated with.""" + labels: list[str] + """List of labels relevant to this hunt.""" + owner: "HuntOwner" + """Describes a user that the hunt is assigned to.""" + + +class HuntRelation(ProxyResource): + """Represents a Hunt Relation in Azure Security Insights. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar properties: Hunt Relation properties. + :vartype properties: "HuntRelationProperties" + """ + + properties: "HuntRelationProperties" + """Hunt Relation properties.""" + + +class HuntRelationProperties(TypedDict, total=False): + """Describes hunt relation properties. + + :ivar relatedResourceId: The id of the related resource. Required. + :vartype relatedResourceId: str + :ivar relatedResourceName: The name of the related resource. + :vartype relatedResourceName: str + :ivar relationType: The type of the hunt relation. + :vartype relationType: str + :ivar relatedResourceKind: The resource that the relation is related to. + :vartype relatedResourceKind: str + :ivar labels: List of labels relevant to this hunt. + :vartype labels: list[str] + """ + + relatedResourceId: Required[str] + """The id of the related resource. Required.""" + relatedResourceName: str + """The name of the related resource.""" + relationType: str + """The type of the hunt relation.""" + relatedResourceKind: str + """The resource that the relation is related to.""" + labels: list[str] + """List of labels relevant to this hunt.""" + + +class Incident(ProxyResource): + """Represents an incident in Azure Security Insights. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar properties: Incident properties. + :vartype properties: "IncidentProperties" + :ivar etag: Etag of the azure resource. + :vartype etag: str + """ + + properties: "IncidentProperties" + """Incident properties.""" + etag: str + """Etag of the azure resource.""" + + +class IncidentAdditionalData(TypedDict, total=False): + """Incident additional data property bag. + + :ivar alertsCount: The number of alerts in the incident. + :vartype alertsCount: int + :ivar bookmarksCount: The number of bookmarks in the incident. + :vartype bookmarksCount: int + :ivar commentsCount: The number of comments in the incident. + :vartype commentsCount: int + :ivar alertProductNames: List of product names of alerts in the incident. + :vartype alertProductNames: list[str] + :ivar tactics: The tactics associated with incident. + :vartype tactics: list[Union[str, "AttackTactic"]] + :ivar techniques: The techniques associated with incident's tactics. + :vartype techniques: list[str] + :ivar providerIncidentUrl: The provider incident url to the incident in Microsoft 365 Defender + portal. + :vartype providerIncidentUrl: str + :ivar mergedIncidentNumber: The incident number of the incident that the current incident was + merged into. + :vartype mergedIncidentNumber: str + :ivar mergedIncidentUrl: The URL to the incident that the current incident was merged into. + :vartype mergedIncidentUrl: str + """ + + alertsCount: int + """The number of alerts in the incident.""" + bookmarksCount: int + """The number of bookmarks in the incident.""" + commentsCount: int + """The number of comments in the incident.""" + alertProductNames: list[str] + """List of product names of alerts in the incident.""" + tactics: list[Union[str, "AttackTactic"]] + """The tactics associated with incident.""" + techniques: list[str] + """The techniques associated with incident's tactics.""" + providerIncidentUrl: str + """The provider incident url to the incident in Microsoft 365 Defender portal.""" + mergedIncidentNumber: str + """The incident number of the incident that the current incident was merged into.""" + mergedIncidentUrl: str + """The URL to the incident that the current incident was merged into.""" + + +class IncidentComment(ProxyResource): + """Represents an incident comment. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar properties: Incident comment properties. + :vartype properties: "IncidentCommentProperties" + :ivar etag: Etag of the azure resource. + :vartype etag: str + """ + + properties: "IncidentCommentProperties" + """Incident comment properties.""" + etag: str + """Etag of the azure resource.""" + + +class IncidentCommentProperties(TypedDict, total=False): + """Incident comment property bag. + + :ivar message: The comment message. Required. + :vartype message: str + :ivar createdTimeUtc: The time the comment was created. + :vartype createdTimeUtc: str + :ivar lastModifiedTimeUtc: The time the comment was updated. + :vartype lastModifiedTimeUtc: str + :ivar author: Describes the client that created the comment. + :vartype author: "ClientInfo" + """ + + message: Required[str] + """The comment message. Required.""" + createdTimeUtc: str + """The time the comment was created.""" + lastModifiedTimeUtc: str + """The time the comment was updated.""" + author: "ClientInfo" + """Describes the client that created the comment.""" + + +class IncidentConfiguration(TypedDict, total=False): + """Incident Configuration property bag. + + :ivar createIncident: Create incidents from alerts triggered by this analytics rule. Required. + :vartype createIncident: bool + :ivar groupingConfiguration: Set how the alerts that are triggered by this analytics rule, are + grouped into incidents. + :vartype groupingConfiguration: "GroupingConfiguration" + """ + + createIncident: Required[bool] + """Create incidents from alerts triggered by this analytics rule. Required.""" + groupingConfiguration: "GroupingConfiguration" + """Set how the alerts that are triggered by this analytics rule, are grouped into incidents.""" + + +class IncidentInfo(TypedDict, total=False): + """Describes related incident information for the bookmark. + + :ivar incidentId: Incident Id. + :vartype incidentId: str + :ivar severity: The severity of the incident. Known values are: "High", "Medium", "Low", and + "Informational". + :vartype severity: Union[str, "IncidentSeverity"] + :ivar title: The title of the incident. + :vartype title: str + :ivar relationName: Relation Name. + :vartype relationName: str + """ + + incidentId: str + """Incident Id.""" + severity: Union[str, "IncidentSeverity"] + """The severity of the incident. Known values are: \"High\", \"Medium\", \"Low\", and + \"Informational\".""" + title: str + """The title of the incident.""" + relationName: str + """Relation Name.""" + + +class IncidentLabel(TypedDict, total=False): + """Represents an incident label. + + :ivar labelName: The name of the label. Required. + :vartype labelName: str + :ivar labelType: The type of the label. Known values are: "User" and "AutoAssigned". + :vartype labelType: Union[str, "IncidentLabelType"] + """ + + labelName: Required[str] + """The name of the label. Required.""" + labelType: Union[str, "IncidentLabelType"] + """The type of the label. Known values are: \"User\" and \"AutoAssigned\".""" + + +class IncidentOwnerInfo(TypedDict, total=False): + """Information on the user an incident is assigned to. + + :ivar email: The email of the user the incident is assigned to. + :vartype email: str + :ivar assignedTo: The name of the user the incident is assigned to. + :vartype assignedTo: str + :ivar objectId: The object id of the user the incident is assigned to. + :vartype objectId: str + :ivar userPrincipalName: The user principal name of the user the incident is assigned to. + :vartype userPrincipalName: str + :ivar ownerType: The type of the owner the incident is assigned to. Known values are: + "Unknown", "User", and "Group". + :vartype ownerType: Union[str, "OwnerType"] + """ + + email: str + """The email of the user the incident is assigned to.""" + assignedTo: str + """The name of the user the incident is assigned to.""" + objectId: str + """The object id of the user the incident is assigned to.""" + userPrincipalName: str + """The user principal name of the user the incident is assigned to.""" + ownerType: Union[str, "OwnerType"] + """The type of the owner the incident is assigned to. Known values are: \"Unknown\", \"User\", and + \"Group\".""" + + +class IncidentProperties(TypedDict, total=False): + """Describes incident properties. + + :ivar title: The title of the incident. Required. + :vartype title: str + :ivar description: The description of the incident. + :vartype description: str + :ivar severity: The severity of the incident. Required. Known values are: "High", "Medium", + "Low", and "Informational". + :vartype severity: Union[str, "IncidentSeverity"] + :ivar status: The status of the incident. Required. Known values are: "New", "Active", and + "Closed". + :vartype status: Union[str, "IncidentStatus"] + :ivar classification: The reason the incident was closed. Known values are: "Undetermined", + "TruePositive", "BenignPositive", and "FalsePositive". + :vartype classification: Union[str, "IncidentClassification"] + :ivar classificationReason: The classification reason the incident was closed with. Known + values are: "SuspiciousActivity", "SuspiciousButExpected", "IncorrectAlertLogic", and + "InaccurateData". + :vartype classificationReason: Union[str, "IncidentClassificationReason"] + :ivar classificationComment: Describes the reason the incident was closed. + :vartype classificationComment: str + :ivar owner: Describes a user that the incident is assigned to. + :vartype owner: "IncidentOwnerInfo" + :ivar labels: List of labels relevant to this incident. + :vartype labels: list["IncidentLabel"] + :ivar firstActivityTimeUtc: The time of the first activity in the incident. + :vartype firstActivityTimeUtc: str + :ivar lastActivityTimeUtc: The time of the last activity in the incident. + :vartype lastActivityTimeUtc: str + :ivar lastModifiedTimeUtc: The last time the incident was updated. + :vartype lastModifiedTimeUtc: str + :ivar createdTimeUtc: The time the incident was created. + :vartype createdTimeUtc: str + :ivar incidentNumber: A sequential number. + :vartype incidentNumber: int + :ivar additionalData: Additional data on the incident. + :vartype additionalData: "IncidentAdditionalData" + :ivar relatedAnalyticRuleIds: List of resource ids of Analytic rules related to the incident. + :vartype relatedAnalyticRuleIds: list[str] + :ivar incidentUrl: The deep-link url to the incident in Azure portal. + :vartype incidentUrl: str + :ivar providerName: The name of the source provider that generated the incident. + :vartype providerName: str + :ivar providerIncidentId: The incident ID assigned by the incident provider. + :vartype providerIncidentId: str + :ivar teamInformation: Describes a team for the incident. + :vartype teamInformation: "TeamInformation" + """ + + title: Required[str] + """The title of the incident. Required.""" + description: str + """The description of the incident.""" + severity: Required[Union[str, "IncidentSeverity"]] + """The severity of the incident. Required. Known values are: \"High\", \"Medium\", \"Low\", and + \"Informational\".""" + status: Required[Union[str, "IncidentStatus"]] + """The status of the incident. Required. Known values are: \"New\", \"Active\", and \"Closed\".""" + classification: Union[str, "IncidentClassification"] + """The reason the incident was closed. Known values are: \"Undetermined\", \"TruePositive\", + \"BenignPositive\", and \"FalsePositive\".""" + classificationReason: Union[str, "IncidentClassificationReason"] + """The classification reason the incident was closed with. Known values are: + \"SuspiciousActivity\", \"SuspiciousButExpected\", \"IncorrectAlertLogic\", and + \"InaccurateData\".""" + classificationComment: str + """Describes the reason the incident was closed.""" + owner: "IncidentOwnerInfo" + """Describes a user that the incident is assigned to.""" + labels: list["IncidentLabel"] + """List of labels relevant to this incident.""" + firstActivityTimeUtc: str + """The time of the first activity in the incident.""" + lastActivityTimeUtc: str + """The time of the last activity in the incident.""" + lastModifiedTimeUtc: str + """The last time the incident was updated.""" + createdTimeUtc: str + """The time the incident was created.""" + incidentNumber: int + """A sequential number.""" + additionalData: "IncidentAdditionalData" + """Additional data on the incident.""" + relatedAnalyticRuleIds: list[str] + """List of resource ids of Analytic rules related to the incident.""" + incidentUrl: str + """The deep-link url to the incident in Azure portal.""" + providerName: str + """The name of the source provider that generated the incident.""" + providerIncidentId: str + """The incident ID assigned by the incident provider.""" + teamInformation: "TeamInformation" + """Describes a team for the incident.""" + + +class IncidentPropertiesAction(TypedDict, total=False): + """IncidentPropertiesAction. + + :ivar severity: The severity of the incident. Known values are: "High", "Medium", "Low", and + "Informational". + :vartype severity: Union[str, "IncidentSeverity"] + :ivar status: The status of the incident. Known values are: "New", "Active", and "Closed". + :vartype status: Union[str, "IncidentStatus"] + :ivar classification: The reason the incident was closed. Known values are: "Undetermined", + "TruePositive", "BenignPositive", and "FalsePositive". + :vartype classification: Union[str, "IncidentClassification"] + :ivar classificationReason: The classification reason the incident was closed with. Known + values are: "SuspiciousActivity", "SuspiciousButExpected", "IncorrectAlertLogic", and + "InaccurateData". + :vartype classificationReason: Union[str, "IncidentClassificationReason"] + :ivar classificationComment: Describes the reason the incident was closed. + :vartype classificationComment: str + :ivar owner: Information on the user an incident is assigned to. + :vartype owner: "IncidentOwnerInfo" + :ivar labels: List of labels to add to the incident. + :vartype labels: list["IncidentLabel"] + """ + + severity: Union[str, "IncidentSeverity"] + """The severity of the incident. Known values are: \"High\", \"Medium\", \"Low\", and + \"Informational\".""" + status: Union[str, "IncidentStatus"] + """The status of the incident. Known values are: \"New\", \"Active\", and \"Closed\".""" + classification: Union[str, "IncidentClassification"] + """The reason the incident was closed. Known values are: \"Undetermined\", \"TruePositive\", + \"BenignPositive\", and \"FalsePositive\".""" + classificationReason: Union[str, "IncidentClassificationReason"] + """The classification reason the incident was closed with. Known values are: + \"SuspiciousActivity\", \"SuspiciousButExpected\", \"IncorrectAlertLogic\", and + \"InaccurateData\".""" + classificationComment: str + """Describes the reason the incident was closed.""" + owner: "IncidentOwnerInfo" + """Information on the user an incident is assigned to.""" + labels: list["IncidentLabel"] + """List of labels to add to the incident.""" + + +class IncidentTask(ProxyResource): + """Describes incident task properties. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar properties: Describes the properties of an incident task. Required. + :vartype properties: "IncidentTaskProperties" + :ivar etag: Etag of the azure resource. + :vartype etag: str + """ + + properties: Required["IncidentTaskProperties"] + """Describes the properties of an incident task. Required.""" + etag: str + """Etag of the azure resource.""" + + +class IncidentTaskProperties(TypedDict, total=False): + """Describes the properties of an incident task. + + :ivar title: The title of the task. Required. + :vartype title: str + :ivar description: The description of the task. + :vartype description: str + :ivar status: The status of the task. Required. Known values are: "New" and "Completed". + :vartype status: Union[str, "IncidentTaskStatus"] + :ivar createdTimeUtc: The time the task was created. + :vartype createdTimeUtc: str + :ivar lastModifiedTimeUtc: The last time the task was updated. + :vartype lastModifiedTimeUtc: str + :ivar createdBy: Information on the client (user or application) that made some action. + :vartype createdBy: "ClientInfo" + :ivar lastModifiedBy: Information on the client (user or application) that made some action. + :vartype lastModifiedBy: "ClientInfo" + """ + + title: Required[str] + """The title of the task. Required.""" + description: str + """The description of the task.""" + status: Required[Union[str, "IncidentTaskStatus"]] + """The status of the task. Required. Known values are: \"New\" and \"Completed\".""" + createdTimeUtc: str + """The time the task was created.""" + lastModifiedTimeUtc: str + """The last time the task was updated.""" + createdBy: "ClientInfo" + """Information on the client (user or application) that made some action.""" + lastModifiedBy: "ClientInfo" + """Information on the client (user or application) that made some action.""" + + +class InstructionStep(TypedDict, total=False): + """Instruction steps to enable the connector. + + :ivar title: Gets or sets the instruction step title. + :vartype title: str + :ivar description: Gets or sets the instruction step description. + :vartype description: str + :ivar instructions: Gets or sets the instruction step details. + :vartype instructions: list["InstructionStepDetails"] + :ivar innerSteps: Gets or sets the inner instruction steps details. For Example: instruction + step 1 might contain inner instruction steps: [instruction step 1.1, instruction step 1.2]. + :vartype innerSteps: list["InstructionStep"] + """ + + title: str + """Gets or sets the instruction step title.""" + description: str + """Gets or sets the instruction step description.""" + instructions: list["InstructionStepDetails"] + """Gets or sets the instruction step details.""" + innerSteps: list["InstructionStep"] + """Gets or sets the inner instruction steps details. For Example: instruction step 1 might contain + inner instruction steps: [instruction step 1.1, instruction step 1.2].""" + + +class InstructionStepDetails(TypedDict, total=False): + """Instruction step details, to be displayed in the Instructions steps section in the connector's + page in Sentinel Portal. + + :ivar parameters: Gets or sets the instruction type parameters settings. Required. + :vartype parameters: Any + :ivar type: Gets or sets the instruction type name. Required. + :vartype type: str + """ + + parameters: Required[Any] + """Gets or sets the instruction type parameters settings. Required.""" + type: Required[str] + """Gets or sets the instruction type name. Required.""" + + +class InstructionStepsInstructionsItem(ConnectorInstructionModelBase): + """InstructionStepsInstructionsItem. + + :ivar parameters: The parameters for the setting. + :vartype parameters: Any + :ivar type: The kind of the setting. Required. Known values are: "CopyableLabel", + "InstructionStepsGroup", and "InfoMessage". + :vartype type: Union[str, "SettingType"] + """ + + +class IoTCheckRequirements(TypedDict, total=False): + """Represents IoT requirements check request. + + :ivar properties: IoT requirements check properties. + :vartype properties: "IoTCheckRequirementsProperties" + :ivar kind: Describes the kind of connector to be checked. Required. IOT. + :vartype kind: Literal[DataConnectorKind.IOT] + """ + + properties: "IoTCheckRequirementsProperties" + """IoT requirements check properties.""" + kind: Required[Literal[DataConnectorKind.IOT]] + """Describes the kind of connector to be checked. Required. IOT.""" + + +class IoTCheckRequirementsProperties(TypedDict, total=False): + """IoT requirements check properties. + + :ivar subscriptionId: The subscription id to connect to, and get the data from. + :vartype subscriptionId: str + """ + + subscriptionId: str + """The subscription id to connect to, and get the data from.""" + + +class IoTDataConnector(TypedDict, total=False): + """Represents IoT data connector. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: IoT data connector properties. + :vartype properties: "IoTDataConnectorProperties" + :ivar kind: The data connector kind. Required. IOT. + :vartype kind: Literal[DataConnectorKind.IOT] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "IoTDataConnectorProperties" + """IoT data connector properties.""" + kind: Required[Literal[DataConnectorKind.IOT]] + """The data connector kind. Required. IOT.""" + + +class IoTDataConnectorProperties(DataConnectorWithAlertsProperties): + """IoT data connector properties. + + :ivar dataTypes: The available data types for the connector. + :vartype dataTypes: "AlertsDataTypeOfDataConnector" + :ivar subscriptionId: The subscription id to connect to, and get the data from. + :vartype subscriptionId: str + """ + + subscriptionId: str + """The subscription id to connect to, and get the data from.""" + + +class JwtAuthModel(TypedDict, total=False): + """Model for API authentication with JWT. Simple exchange between user name + password to access + token. + + :ivar tokenEndpoint: Token endpoint to request JWT. Required. + :vartype tokenEndpoint: str + :ivar userName: The user name. If user name and password sent in header request we only need to + populate the ``value`` property with the user name (Same as basic auth). If user name and + password sent in body request we need to specify the ``Key`` and ``Value``. Required. + :vartype userName: dict[str, str] + :ivar password: The password. Required. + :vartype password: dict[str, str] + :ivar queryParameters: The custom query parameter we want to add once we send request to token + endpoint. + :vartype queryParameters: dict[str, str] + :ivar headers: The custom headers we want to add once we send request to token endpoint. + :vartype headers: dict[str, str] + :ivar isCredentialsInHeaders: Flag indicating whether we want to send the user name and + password to token endpoint in the headers. + :vartype isCredentialsInHeaders: bool + :ivar isJsonRequest: Flag indicating whether the body request is JSON (header Content-Type = + application/json), meaning its a Form URL encoded request (header Content-Type = + application/x-www-form-urlencoded). + :vartype isJsonRequest: bool + :ivar requestTimeoutInSeconds: Request timeout in seconds. + :vartype requestTimeoutInSeconds: int + :ivar type: The auth type. Required. JwtToken. + :vartype type: Literal[CcpAuthType.JWT_TOKEN] + """ + + tokenEndpoint: Required[str] + """Token endpoint to request JWT. Required.""" + userName: Required[dict[str, str]] + """The user name. If user name and password sent in header request we only need to populate the + ``value`` property with the user name (Same as basic auth). If user name and password sent in + body request we need to specify the ``Key`` and ``Value``. Required.""" + password: Required[dict[str, str]] + """The password. Required.""" + queryParameters: dict[str, str] + """The custom query parameter we want to add once we send request to token endpoint.""" + headers: dict[str, str] + """The custom headers we want to add once we send request to token endpoint.""" + isCredentialsInHeaders: Optional[bool] + """Flag indicating whether we want to send the user name and password to token endpoint in the + headers.""" + isJsonRequest: Optional[bool] + """Flag indicating whether the body request is JSON (header Content-Type = application/json), + meaning its a Form URL encoded request (header Content-Type = + application/x-www-form-urlencoded).""" + requestTimeoutInSeconds: int + """Request timeout in seconds.""" + type: Required[Literal[CcpAuthType.JWT_TOKEN]] + """The auth type. Required. JwtToken.""" + + +class ManualTriggerRequestBody(TypedDict, total=False): + """ManualTriggerRequestBody. + + :ivar tenantId: + :vartype tenantId: str + :ivar logicAppsResourceId: Required. + :vartype logicAppsResourceId: str + """ + + tenantId: str + logicAppsResourceId: Required[str] + """Required.""" + + +class MCASCheckRequirements(TypedDict, total=False): + """Represents MCAS (Microsoft Cloud App Security) requirements check request. + + :ivar properties: MCAS (Microsoft Cloud App Security) requirements check properties. + :vartype properties: "MCASCheckRequirementsProperties" + :ivar kind: Describes the kind of connector to be checked. Required. MicrosoftCloudAppSecurity. + :vartype kind: Literal[DataConnectorKind.MICROSOFT_CLOUD_APP_SECURITY] + """ + + properties: "MCASCheckRequirementsProperties" + """MCAS (Microsoft Cloud App Security) requirements check properties.""" + kind: Required[Literal[DataConnectorKind.MICROSOFT_CLOUD_APP_SECURITY]] + """Describes the kind of connector to be checked. Required. MicrosoftCloudAppSecurity.""" + + +class MCASCheckRequirementsProperties(DataConnectorTenantId): + """MCAS (Microsoft Cloud App Security) requirements check properties. + + :ivar tenantId: The tenant id to connect to, and get the data from. Required. + :vartype tenantId: str + """ + + +class MCASDataConnector(TypedDict, total=False): + """Represents MCAS (Microsoft Cloud App Security) data connector. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: MCAS (Microsoft Cloud App Security) data connector properties. + :vartype properties: "MCASDataConnectorProperties" + :ivar kind: The data connector kind. Required. MicrosoftCloudAppSecurity. + :vartype kind: Literal[DataConnectorKind.MICROSOFT_CLOUD_APP_SECURITY] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "MCASDataConnectorProperties" + """MCAS (Microsoft Cloud App Security) data connector properties.""" + kind: Required[Literal[DataConnectorKind.MICROSOFT_CLOUD_APP_SECURITY]] + """The data connector kind. Required. MicrosoftCloudAppSecurity.""" + + +class MCASDataConnectorDataTypes(AlertsDataTypeOfDataConnector): + """The available data types for MCAS (Microsoft Cloud App Security) data connector. + + :ivar alerts: Alerts data type connection. Required. + :vartype alerts: "DataConnectorDataTypeCommon" + :ivar discoveryLogs: Discovery log data type connection. + :vartype discoveryLogs: "DataConnectorDataTypeCommon" + """ + + discoveryLogs: "DataConnectorDataTypeCommon" + """Discovery log data type connection.""" + + +class MCASDataConnectorProperties(DataConnectorTenantId): + """MCAS (Microsoft Cloud App Security) data connector properties. + + :ivar tenantId: The tenant id to connect to, and get the data from. Required. + :vartype tenantId: str + :ivar dataTypes: The available data types for the connector. Required. + :vartype dataTypes: "MCASDataConnectorDataTypes" + """ + + dataTypes: Required["MCASDataConnectorDataTypes"] + """The available data types for the connector. Required.""" + + +class MDATPCheckRequirements(TypedDict, total=False): + """Represents MDATP (Microsoft Defender Advanced Threat Protection) requirements check request. + + :ivar properties: MDATP (Microsoft Defender Advanced Threat Protection) requirements check + properties. + :vartype properties: "MDATPCheckRequirementsProperties" + :ivar kind: Describes the kind of connector to be checked. Required. + MicrosoftDefenderAdvancedThreatProtection. + :vartype kind: Literal[DataConnectorKind.MICROSOFT_DEFENDER_ADVANCED_THREAT_PROTECTION] + """ + + properties: "MDATPCheckRequirementsProperties" + """MDATP (Microsoft Defender Advanced Threat Protection) requirements check properties.""" + kind: Required[Literal[DataConnectorKind.MICROSOFT_DEFENDER_ADVANCED_THREAT_PROTECTION]] + """Describes the kind of connector to be checked. Required. + MicrosoftDefenderAdvancedThreatProtection.""" + + +class MDATPCheckRequirementsProperties(DataConnectorTenantId): + """MDATP (Microsoft Defender Advanced Threat Protection) requirements check properties. + + :ivar tenantId: The tenant id to connect to, and get the data from. Required. + :vartype tenantId: str + """ + + +class MDATPDataConnector(TypedDict, total=False): + """Represents MDATP (Microsoft Defender Advanced Threat Protection) data connector. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: MDATP (Microsoft Defender Advanced Threat Protection) data connector + properties. + :vartype properties: "MDATPDataConnectorProperties" + :ivar kind: The data connector kind. Required. MicrosoftDefenderAdvancedThreatProtection. + :vartype kind: Literal[DataConnectorKind.MICROSOFT_DEFENDER_ADVANCED_THREAT_PROTECTION] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "MDATPDataConnectorProperties" + """MDATP (Microsoft Defender Advanced Threat Protection) data connector properties.""" + kind: Required[Literal[DataConnectorKind.MICROSOFT_DEFENDER_ADVANCED_THREAT_PROTECTION]] + """The data connector kind. Required. MicrosoftDefenderAdvancedThreatProtection.""" + + +class MDATPDataConnectorProperties(TypedDict, total=False): + """MDATP (Microsoft Defender Advanced Threat Protection) data connector properties. + + :ivar tenantId: The tenant id to connect to, and get the data from. Required. + :vartype tenantId: str + :ivar dataTypes: The available data types for the connector. + :vartype dataTypes: "AlertsDataTypeOfDataConnector" + """ + + tenantId: Required[str] + """The tenant id to connect to, and get the data from. Required.""" + dataTypes: "AlertsDataTypeOfDataConnector" + """The available data types for the connector.""" + + +class MetadataAuthor(TypedDict, total=False): + """Publisher or creator of the content item. + + :ivar name: Name of the author. Company or person. + :vartype name: str + :ivar email: Email of author contact. + :vartype email: str + :ivar link: Link for author/vendor page. + :vartype link: str + """ + + name: str + """Name of the author. Company or person.""" + email: str + """Email of author contact.""" + link: str + """Link for author/vendor page.""" + + +class MetadataCategories(TypedDict, total=False): + """ies for the solution content item. + + :ivar domains: domain for the solution content item. + :vartype domains: list[str] + :ivar verticals: Industry verticals for the solution content item. + :vartype verticals: list[str] + """ + + domains: list[str] + """domain for the solution content item.""" + verticals: list[str] + """Industry verticals for the solution content item.""" + + +class MetadataDependencies(TypedDict, total=False): + """Dependencies for the content item, what other content items it requires to work. Can describe + more complex dependencies using a recursive/nested structure. For a single dependency an + id/kind/version can be supplied or operator/criteria for complex dependencies. + + :ivar contentId: Id of the content item we depend on. + :vartype contentId: str + :ivar kind: Type of the content item we depend on. Known values are: "DataConnector", + "DataType", "Workbook", "WorkbookTemplate", "Playbook", "PlaybookTemplate", + "AnalyticsRuleTemplate", "AnalyticsRule", "HuntingQuery", "InvestigationQuery", "Parser", + "Watchlist", "WatchlistTemplate", "Solution", "AzureFunction", "LogicAppsCustomConnector", + "AutomationRule", "ResourcesDataConnector", "Notebook", "Standalone", "SummaryRule", and + "CustomDetection". + :vartype kind: Union[str, "Kind"] + :ivar version: Version of the the content item we depend on. Can be blank, * or missing to + indicate any version fulfills the dependency. If version does not match our defined numeric + format then an exact match is required. + :vartype version: str + :ivar name: Name of the content item. + :vartype name: str + :ivar operator: Operator used for list of dependencies in criteria array. Known values are: + "AND" and "OR". + :vartype operator: Union[str, "MetadataDependencyOperator"] + :ivar criteria: This is the list of dependencies we must fulfill, according to the AND/OR + operator. + :vartype criteria: list["MetadataDependencies"] + """ + + contentId: str + """Id of the content item we depend on.""" + kind: Union[str, "Kind"] + """Type of the content item we depend on. Known values are: \"DataConnector\", \"DataType\", + \"Workbook\", \"WorkbookTemplate\", \"Playbook\", \"PlaybookTemplate\", + \"AnalyticsRuleTemplate\", \"AnalyticsRule\", \"HuntingQuery\", \"InvestigationQuery\", + \"Parser\", \"Watchlist\", \"WatchlistTemplate\", \"Solution\", \"AzureFunction\", + \"LogicAppsCustomConnector\", \"AutomationRule\", \"ResourcesDataConnector\", \"Notebook\", + \"Standalone\", \"SummaryRule\", and \"CustomDetection\".""" + version: str + """Version of the the content item we depend on. Can be blank, * or missing to indicate any + version fulfills the dependency. If version does not match our defined numeric format then an + exact match is required.""" + name: str + """Name of the content item.""" + operator: Union[str, "MetadataDependencyOperator"] + """Operator used for list of dependencies in criteria array. Known values are: \"AND\" and \"OR\".""" + criteria: list["MetadataDependencies"] + """This is the list of dependencies we must fulfill, according to the AND/OR operator.""" + + +class MetadataModel(ProxyResource): + """Metadata resource definition. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar properties: Metadata properties. + :vartype properties: "MetadataProperties" + :ivar etag: Etag of the azure resource. + :vartype etag: str + """ + + properties: "MetadataProperties" + """Metadata properties.""" + etag: str + """Etag of the azure resource.""" + + +class MetadataPatch(ResourceWithEtag): + """Metadata patch request body. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: Metadata patch request body. + :vartype properties: "MetadataPropertiesPatch" + """ + + properties: "MetadataPropertiesPatch" + """Metadata patch request body.""" + + +class MetadataProperties(TypedDict, total=False): + """Metadata property bag. + + :ivar contentId: Static ID for the content. Used to identify dependencies and content from + solutions or community. Hard-coded/static for out of the box content and solutions. Can be + optionally set for user created content to define dependencies. If an active content item is + made from a template, both will have the same contentId. + :vartype contentId: str + :ivar parentId: Full parent resource ID of the content item the metadata is for. This is the + full resource ID including the scope (subscription and resource group). Required. + :vartype parentId: str + :ivar version: Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, + 1.0.0, 1.0.0.0), following ARM template best practices. Can also be any string, but then we + cannot guarantee any version checks. + :vartype version: str + :ivar kind: The kind of content the metadata is for. Required. + :vartype kind: str + :ivar source: Source of the content. This is where/how it was created. + :vartype source: "MetadataSource" + :ivar author: The creator of the content item. + :vartype author: "MetadataAuthor" + :ivar support: Support information for the metadata - type, name, contact information. + :vartype support: "MetadataSupport" + :ivar dependencies: Dependencies for the content item, what other content items it requires to + work. Can describe more complex dependencies using a recursive/nested structure. For a single + dependency an id/kind/version can be supplied or operator/criteria for complex formats. + :vartype dependencies: "MetadataDependencies" + :ivar categories: Categories for the solution content item. + :vartype categories: "MetadataCategories" + :ivar providers: Providers for the solution content item. + :vartype providers: list[str] + :ivar firstPublishDate: first publish date of solution content item. + :vartype firstPublishDate: str + :ivar lastPublishDate: last publish date of solution content item. + :vartype lastPublishDate: str + :ivar customVersion: The custom version of the content. A optional free text. + :vartype customVersion: str + :ivar contentSchemaVersion: Schema version of the content. Can be used to distinguish between + different flow based on the schema version. + :vartype contentSchemaVersion: str + :ivar icon: the icon identifier. this id can later be fetched from the solution template. + :vartype icon: str + :ivar threatAnalysisTactics: the tactics the resource covers. + :vartype threatAnalysisTactics: list[str] + :ivar threatAnalysisTechniques: the techniques the resource covers, these have to be aligned + with the tactics being used. + :vartype threatAnalysisTechniques: list[str] + :ivar previewImages: preview image file names. These will be taken from the solution artifacts. + :vartype previewImages: list[str] + :ivar previewImagesDark: preview image file names. These will be taken from the solution + artifacts. used for dark theme support. + :vartype previewImagesDark: list[str] + """ + + contentId: str + """Static ID for the content. Used to identify dependencies and content from solutions or + community. Hard-coded/static for out of the box content and solutions. Can be optionally set + for user created content to define dependencies. If an active content item is made from a + template, both will have the same contentId.""" + parentId: Required[str] + """Full parent resource ID of the content item the metadata is for. This is the full resource ID + including the scope (subscription and resource group). Required.""" + version: str + """Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, + 1.0.0.0), following ARM template best practices. Can also be any string, but then we cannot + guarantee any version checks.""" + kind: Required[str] + """The kind of content the metadata is for. Required.""" + source: "MetadataSource" + """Source of the content. This is where/how it was created.""" + author: "MetadataAuthor" + """The creator of the content item.""" + support: "MetadataSupport" + """Support information for the metadata - type, name, contact information.""" + dependencies: "MetadataDependencies" + """Dependencies for the content item, what other content items it requires to work. Can describe + more complex dependencies using a recursive/nested structure. For a single dependency an + id/kind/version can be supplied or operator/criteria for complex formats.""" + categories: "MetadataCategories" + """Categories for the solution content item.""" + providers: list[str] + """Providers for the solution content item.""" + firstPublishDate: str + """first publish date of solution content item.""" + lastPublishDate: str + """last publish date of solution content item.""" + customVersion: str + """The custom version of the content. A optional free text.""" + contentSchemaVersion: str + """Schema version of the content. Can be used to distinguish between different flow based on the + schema version.""" + icon: str + """the icon identifier. this id can later be fetched from the solution template.""" + threatAnalysisTactics: list[str] + """the tactics the resource covers.""" + threatAnalysisTechniques: list[str] + """the techniques the resource covers, these have to be aligned with the tactics being used.""" + previewImages: list[str] + """preview image file names. These will be taken from the solution artifacts.""" + previewImagesDark: list[str] + """preview image file names. These will be taken from the solution artifacts. used for dark theme + support.""" + + +class MetadataPropertiesPatch(TypedDict, total=False): + """Metadata property bag for patch requests. This is the same as the MetadataProperties, but with + nothing required. + + :ivar contentId: Static ID for the content. Used to identify dependencies and content from + solutions or community. Hard-coded/static for out of the box content and solutions. Can be + optionally set for user created content to define dependencies. If an active content item is + made from a template, both will have the same contentId. + :vartype contentId: str + :ivar parentId: Full parent resource ID of the content item the metadata is for. This is the + full resource ID including the scope (subscription and resource group). + :vartype parentId: str + :ivar version: Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, + 1.0.0, 1.0.0.0), following ARM template best practices. Can also be any string, but then we + cannot guarantee any version checks. + :vartype version: str + :ivar kind: The kind of content the metadata is for. + :vartype kind: str + :ivar source: Source of the content. This is where/how it was created. + :vartype source: "MetadataSource" + :ivar author: The creator of the content item. + :vartype author: "MetadataAuthor" + :ivar support: Support information for the metadata - type, name, contact information. + :vartype support: "MetadataSupport" + :ivar dependencies: Dependencies for the content item, what other content items it requires to + work. Can describe more complex dependencies using a recursive/nested structure. For a single + dependency an id/kind/version can be supplied or operator/criteria for complex formats. + :vartype dependencies: "MetadataDependencies" + :ivar categories: Categories for the solution content item. + :vartype categories: "MetadataCategories" + :ivar providers: Providers for the solution content item. + :vartype providers: list[str] + :ivar firstPublishDate: first publish date of solution content item. + :vartype firstPublishDate: str + :ivar lastPublishDate: last publish date of solution content item. + :vartype lastPublishDate: str + :ivar customVersion: The custom version of the content. A optional free text. + :vartype customVersion: str + :ivar contentSchemaVersion: Schema version of the content. Can be used to distinguish between + different flow based on the schema version. + :vartype contentSchemaVersion: str + :ivar icon: the icon identifier. this id can later be fetched from the solution template. + :vartype icon: str + :ivar threatAnalysisTactics: the tactics the resource covers. + :vartype threatAnalysisTactics: list[str] + :ivar threatAnalysisTechniques: the techniques the resource covers, these have to be aligned + with the tactics being used. + :vartype threatAnalysisTechniques: list[str] + :ivar previewImages: preview image file names. These will be taken from the solution artifacts. + :vartype previewImages: list[str] + :ivar previewImagesDark: preview image file names. These will be taken from the solution + artifacts. used for dark theme support. + :vartype previewImagesDark: list[str] + """ + + contentId: str + """Static ID for the content. Used to identify dependencies and content from solutions or + community. Hard-coded/static for out of the box content and solutions. Can be optionally set + for user created content to define dependencies. If an active content item is made from a + template, both will have the same contentId.""" + parentId: str + """Full parent resource ID of the content item the metadata is for. This is the full resource ID + including the scope (subscription and resource group).""" + version: str + """Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, + 1.0.0.0), following ARM template best practices. Can also be any string, but then we cannot + guarantee any version checks.""" + kind: str + """The kind of content the metadata is for.""" + source: "MetadataSource" + """Source of the content. This is where/how it was created.""" + author: "MetadataAuthor" + """The creator of the content item.""" + support: "MetadataSupport" + """Support information for the metadata - type, name, contact information.""" + dependencies: "MetadataDependencies" + """Dependencies for the content item, what other content items it requires to work. Can describe + more complex dependencies using a recursive/nested structure. For a single dependency an + id/kind/version can be supplied or operator/criteria for complex formats.""" + categories: "MetadataCategories" + """Categories for the solution content item.""" + providers: list[str] + """Providers for the solution content item.""" + firstPublishDate: str + """first publish date of solution content item.""" + lastPublishDate: str + """last publish date of solution content item.""" + customVersion: str + """The custom version of the content. A optional free text.""" + contentSchemaVersion: str + """Schema version of the content. Can be used to distinguish between different flow based on the + schema version.""" + icon: str + """the icon identifier. this id can later be fetched from the solution template.""" + threatAnalysisTactics: list[str] + """the tactics the resource covers.""" + threatAnalysisTechniques: list[str] + """the techniques the resource covers, these have to be aligned with the tactics being used.""" + previewImages: list[str] + """preview image file names. These will be taken from the solution artifacts.""" + previewImagesDark: list[str] + """preview image file names. These will be taken from the solution artifacts. used for dark theme + support.""" + + +class MetadataSource(TypedDict, total=False): + """The original source of the content item, where it comes from. + + :ivar kind: Source type of the content. Required. Known values are: "LocalWorkspace", + "Community", "Solution", and "SourceRepository". + :vartype kind: Union[str, "SourceKind"] + :ivar name: Name of the content source. The repo name, solution name, LA workspace name etc. + :vartype name: str + :ivar sourceId: ID of the content source. The solution ID, workspace ID, etc. + :vartype sourceId: str + """ + + kind: Required[Union[str, "SourceKind"]] + """Source type of the content. Required. Known values are: \"LocalWorkspace\", \"Community\", + \"Solution\", and \"SourceRepository\".""" + name: str + """Name of the content source. The repo name, solution name, LA workspace name etc.""" + sourceId: str + """ID of the content source. The solution ID, workspace ID, etc.""" + + +class MetadataSupport(TypedDict, total=False): + """Support information for the content item. + + :ivar tier: Type of support for content item. Required. Known values are: "Microsoft", + "Partner", and "Community". + :vartype tier: Union[str, "SupportTier"] + :ivar name: Name of the support contact. Company or person. + :vartype name: str + :ivar email: Email of support contact. + :vartype email: str + :ivar link: Link for support help, like to support page to open a ticket etc. + :vartype link: str + """ + + tier: Required[Union[str, "SupportTier"]] + """Type of support for content item. Required. Known values are: \"Microsoft\", \"Partner\", and + \"Community\".""" + name: str + """Name of the support contact. Company or person.""" + email: str + """Email of support contact.""" + link: str + """Link for support help, like to support page to open a ticket etc.""" + + +class MicrosoftPurviewInformationProtectionCheckRequirements(TypedDict, total=False): # pylint: disable=name-too-long + """Represents MicrosoftPurviewInformationProtection requirements check request. + + :ivar properties: MicrosoftPurviewInformationProtection requirements check properties. + :vartype properties: "MicrosoftPurviewInformationProtectionCheckRequirementsProperties" + :ivar kind: Describes the kind of connector to be checked. Required. + MicrosoftPurviewInformationProtection. + :vartype kind: Literal[DataConnectorKind.MICROSOFT_PURVIEW_INFORMATION_PROTECTION] + """ + + properties: "MicrosoftPurviewInformationProtectionCheckRequirementsProperties" + """MicrosoftPurviewInformationProtection requirements check properties.""" + kind: Required[Literal[DataConnectorKind.MICROSOFT_PURVIEW_INFORMATION_PROTECTION]] + """Describes the kind of connector to be checked. Required. MicrosoftPurviewInformationProtection.""" + + +class MicrosoftPurviewInformationProtectionCheckRequirementsProperties( + DataConnectorTenantId +): # pylint: disable=name-too-long + """MicrosoftPurviewInformationProtection requirements check properties. + + :ivar tenantId: The tenant id to connect to, and get the data from. Required. + :vartype tenantId: str + """ + + +class MicrosoftPurviewInformationProtectionConnectorDataTypes(TypedDict, total=False): # pylint: disable=name-too-long + """The available data types for Microsoft Purview Information Protection data connector. + + :ivar logs: Logs data type. Required. + :vartype logs: "MicrosoftPurviewInformationProtectionConnectorDataTypesLogs" + """ + + logs: Required["MicrosoftPurviewInformationProtectionConnectorDataTypesLogs"] + """Logs data type. Required.""" + + +class MicrosoftPurviewInformationProtectionConnectorDataTypesLogs( + DataConnectorDataTypeCommon +): # pylint: disable=name-too-long + """Logs data type. + + :ivar state: Describe whether this data type connection is enabled or not. Required. Known + values are: "Enabled" and "Disabled". + :vartype state: Union[str, "DataTypeState"] + """ + + +class MicrosoftPurviewInformationProtectionDataConnector(TypedDict, total=False): # pylint: disable=name-too-long + """Represents Microsoft Purview Information Protection data connector. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: Microsoft Purview Information Protection data connector properties. + :vartype properties: "MicrosoftPurviewInformationProtectionDataConnectorProperties" + :ivar kind: The data connector kind. Required. MicrosoftPurviewInformationProtection. + :vartype kind: Literal[DataConnectorKind.MICROSOFT_PURVIEW_INFORMATION_PROTECTION] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "MicrosoftPurviewInformationProtectionDataConnectorProperties" + """Microsoft Purview Information Protection data connector properties.""" + kind: Required[Literal[DataConnectorKind.MICROSOFT_PURVIEW_INFORMATION_PROTECTION]] + """The data connector kind. Required. MicrosoftPurviewInformationProtection.""" + + +class MicrosoftPurviewInformationProtectionDataConnectorProperties( + DataConnectorTenantId +): # pylint: disable=name-too-long + """Microsoft Purview Information Protection data connector properties. + + :ivar tenantId: The tenant id to connect to, and get the data from. Required. + :vartype tenantId: str + :ivar dataTypes: The available data types for the connector. Required. + :vartype dataTypes: "MicrosoftPurviewInformationProtectionConnectorDataTypes" + """ + + dataTypes: Required["MicrosoftPurviewInformationProtectionConnectorDataTypes"] + """The available data types for the connector. Required.""" + + +class MicrosoftSecurityIncidentCreationAlertRule(TypedDict, total=False): # pylint: disable=name-too-long + """Represents MicrosoftSecurityIncidentCreation rule. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: MicrosoftSecurityIncidentCreation rule properties. + :vartype properties: "MicrosoftSecurityIncidentCreationAlertRuleProperties" + :ivar kind: The kind of the alert rule. Required. MicrosoftSecurityIncidentCreation. + :vartype kind: Literal[AlertRuleKind.MICROSOFT_SECURITY_INCIDENT_CREATION] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "MicrosoftSecurityIncidentCreationAlertRuleProperties" + """MicrosoftSecurityIncidentCreation rule properties.""" + kind: Required[Literal[AlertRuleKind.MICROSOFT_SECURITY_INCIDENT_CREATION]] + """The kind of the alert rule. Required. MicrosoftSecurityIncidentCreation.""" + + +class MicrosoftSecurityIncidentCreationAlertRuleCommonProperties( + TypedDict, total=False +): # pylint: disable=name-too-long + """MicrosoftSecurityIncidentCreation rule common property bag. + + :ivar displayNamesFilter: the alerts' displayNames on which the cases will be generated. + :vartype displayNamesFilter: list[str] + :ivar displayNamesExcludeFilter: the alerts' displayNames on which the cases will not be + generated. + :vartype displayNamesExcludeFilter: list[str] + :ivar productFilter: The alerts' productName on which the cases will be generated. Required. + Known values are: "Microsoft Cloud App Security", "Azure Security Center", "Azure Advanced + Threat Protection", "Azure Active Directory Identity Protection", "Azure Security Center for + IoT", "Office 365 Advanced Threat Protection", and "Microsoft Defender Advanced Threat + Protection". + :vartype productFilter: Union[str, "MicrosoftSecurityProductName"] + :ivar severitiesFilter: the alerts' severities on which the cases will be generated. + :vartype severitiesFilter: list[Union[str, "AlertSeverity"]] + """ + + displayNamesFilter: list[str] + """the alerts' displayNames on which the cases will be generated.""" + displayNamesExcludeFilter: list[str] + """the alerts' displayNames on which the cases will not be generated.""" + productFilter: Required[Union[str, "MicrosoftSecurityProductName"]] + """The alerts' productName on which the cases will be generated. Required. Known values are: + \"Microsoft Cloud App Security\", \"Azure Security Center\", \"Azure Advanced Threat + Protection\", \"Azure Active Directory Identity Protection\", \"Azure Security Center for + IoT\", \"Office 365 Advanced Threat Protection\", and \"Microsoft Defender Advanced Threat + Protection\".""" + severitiesFilter: list[Union[str, "AlertSeverity"]] + """the alerts' severities on which the cases will be generated.""" + + +class MicrosoftSecurityIncidentCreationAlertRuleProperties( + MicrosoftSecurityIncidentCreationAlertRuleCommonProperties +): # pylint: disable=name-too-long + """MicrosoftSecurityIncidentCreation rule property bag. + + :ivar displayNamesFilter: the alerts' displayNames on which the cases will be generated. + :vartype displayNamesFilter: list[str] + :ivar displayNamesExcludeFilter: the alerts' displayNames on which the cases will not be + generated. + :vartype displayNamesExcludeFilter: list[str] + :ivar productFilter: The alerts' productName on which the cases will be generated. Required. + Known values are: "Microsoft Cloud App Security", "Azure Security Center", "Azure Advanced + Threat Protection", "Azure Active Directory Identity Protection", "Azure Security Center for + IoT", "Office 365 Advanced Threat Protection", and "Microsoft Defender Advanced Threat + Protection". + :vartype productFilter: Union[str, "MicrosoftSecurityProductName"] + :ivar severitiesFilter: the alerts' severities on which the cases will be generated. + :vartype severitiesFilter: list[Union[str, "AlertSeverity"]] + :ivar alertRuleTemplateName: The Name of the alert rule template used to create this rule. + :vartype alertRuleTemplateName: str + :ivar description: The description of the alert rule. + :vartype description: str + :ivar displayName: The display name for alerts created by this alert rule. Required. + :vartype displayName: str + :ivar enabled: Determines whether this alert rule is enabled or disabled. Required. + :vartype enabled: bool + :ivar lastModifiedUtc: The last time that this alert has been modified. + :vartype lastModifiedUtc: str + """ + + alertRuleTemplateName: str + """The Name of the alert rule template used to create this rule.""" + description: str + """The description of the alert rule.""" + displayName: Required[str] + """The display name for alerts created by this alert rule. Required.""" + enabled: Required[bool] + """Determines whether this alert rule is enabled or disabled. Required.""" + lastModifiedUtc: str + """The last time that this alert has been modified.""" + + +class MLBehaviorAnalyticsAlertRule(TypedDict, total=False): + """Represents MLBehaviorAnalytics alert rule. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: MLBehaviorAnalytics alert rule properties. + :vartype properties: "MLBehaviorAnalyticsAlertRuleProperties" + :ivar kind: The kind of the alert rule. Required. MLBehaviorAnalytics. + :vartype kind: Literal[AlertRuleKind.ML_BEHAVIOR_ANALYTICS] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "MLBehaviorAnalyticsAlertRuleProperties" + """MLBehaviorAnalytics alert rule properties.""" + kind: Required[Literal[AlertRuleKind.ML_BEHAVIOR_ANALYTICS]] + """The kind of the alert rule. Required. MLBehaviorAnalytics.""" + + +class MLBehaviorAnalyticsAlertRuleProperties(TypedDict, total=False): + """MLBehaviorAnalytics alert rule base property bag. + + :ivar alertRuleTemplateName: The Name of the alert rule template used to create this rule. + Required. + :vartype alertRuleTemplateName: str + :ivar description: The description of the alert rule. + :vartype description: str + :ivar displayName: The display name for alerts created by this alert rule. + :vartype displayName: str + :ivar enabled: Determines whether this alert rule is enabled or disabled. Required. + :vartype enabled: bool + :ivar lastModifiedUtc: The last time that this alert rule has been modified. + :vartype lastModifiedUtc: str + :ivar severity: The severity for alerts created by this alert rule. Known values are: "High", + "Medium", "Low", and "Informational". + :vartype severity: Union[str, "AlertSeverity"] + :ivar tactics: The tactics of the alert rule. + :vartype tactics: list[Union[str, "AttackTactic"]] + :ivar techniques: The techniques of the alert rule. + :vartype techniques: list[str] + :ivar subTechniques: The sub-techniques of the alert rule. + :vartype subTechniques: list[str] + """ + + alertRuleTemplateName: Required[str] + """The Name of the alert rule template used to create this rule. Required.""" + description: str + """The description of the alert rule.""" + displayName: str + """The display name for alerts created by this alert rule.""" + enabled: Required[bool] + """Determines whether this alert rule is enabled or disabled. Required.""" + lastModifiedUtc: str + """The last time that this alert rule has been modified.""" + severity: Union[str, "AlertSeverity"] + """The severity for alerts created by this alert rule. Known values are: \"High\", \"Medium\", + \"Low\", and \"Informational\".""" + tactics: list[Union[str, "AttackTactic"]] + """The tactics of the alert rule.""" + techniques: list[str] + """The techniques of the alert rule.""" + subTechniques: list[str] + """The sub-techniques of the alert rule.""" + + +class MSTICheckRequirements(TypedDict, total=False): + """Represents Microsoft Threat Intelligence requirements check request. + + :ivar properties: Microsoft Threat Intelligence requirements check properties. + :vartype properties: "MSTICheckRequirementsProperties" + :ivar kind: Describes the kind of connector to be checked. Required. + MicrosoftThreatIntelligence. + :vartype kind: Literal[DataConnectorKind.MICROSOFT_THREAT_INTELLIGENCE] + """ + + properties: "MSTICheckRequirementsProperties" + """Microsoft Threat Intelligence requirements check properties.""" + kind: Required[Literal[DataConnectorKind.MICROSOFT_THREAT_INTELLIGENCE]] + """Describes the kind of connector to be checked. Required. MicrosoftThreatIntelligence.""" + + +class MSTICheckRequirementsProperties(DataConnectorTenantId): + """Microsoft Threat Intelligence requirements check properties. + + :ivar tenantId: The tenant id to connect to, and get the data from. Required. + :vartype tenantId: str + """ + + +class MSTIDataConnector(TypedDict, total=False): + """Represents Microsoft Threat Intelligence data connector. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: Microsoft Threat Intelligence data connector properties. + :vartype properties: "MSTIDataConnectorProperties" + :ivar kind: The data connector kind. Required. MicrosoftThreatIntelligence. + :vartype kind: Literal[DataConnectorKind.MICROSOFT_THREAT_INTELLIGENCE] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "MSTIDataConnectorProperties" + """Microsoft Threat Intelligence data connector properties.""" + kind: Required[Literal[DataConnectorKind.MICROSOFT_THREAT_INTELLIGENCE]] + """The data connector kind. Required. MicrosoftThreatIntelligence.""" + + +class MSTIDataConnectorDataTypes(TypedDict, total=False): + """The available data types for Microsoft Threat Intelligence Platforms data connector. + + :ivar microsoftEmergingThreatFeed: Data type for Microsoft Threat Intelligence Platforms data + connector. Required. + :vartype microsoftEmergingThreatFeed: "MSTIDataConnectorDataTypesMicrosoftEmergingThreatFeed" + """ + + microsoftEmergingThreatFeed: Required["MSTIDataConnectorDataTypesMicrosoftEmergingThreatFeed"] + """Data type for Microsoft Threat Intelligence Platforms data connector. Required.""" + + +class MSTIDataConnectorDataTypesMicrosoftEmergingThreatFeed( + DataConnectorDataTypeCommon +): # pylint: disable=name-too-long + """Data type for Microsoft Threat Intelligence Platforms data connector. + + :ivar state: Describe whether this data type connection is enabled or not. Required. Known + values are: "Enabled" and "Disabled". + :vartype state: Union[str, "DataTypeState"] + :ivar lookbackPeriod: The lookback period for the feed to be imported. Required. + :vartype lookbackPeriod: str + """ + + lookbackPeriod: Required[str] + """The lookback period for the feed to be imported. Required.""" + + +class MSTIDataConnectorProperties(DataConnectorTenantId): + """Microsoft Threat Intelligence data connector properties. + + :ivar tenantId: The tenant id to connect to, and get the data from. Required. + :vartype tenantId: str + :ivar dataTypes: The available data types for the connector. Required. + :vartype dataTypes: "MSTIDataConnectorDataTypes" + """ + + dataTypes: Required["MSTIDataConnectorDataTypes"] + """The available data types for the connector. Required.""" + + +class MtpCheckRequirements(TypedDict, total=False): + """Represents MTP (Microsoft Threat Protection) requirements check request. + + :ivar properties: MTP (Microsoft Threat Protection) requirements check properties. + :vartype properties: "MTPCheckRequirementsProperties" + :ivar kind: Describes the kind of connector to be checked. Required. MicrosoftThreatProtection. + :vartype kind: Literal[DataConnectorKind.MICROSOFT_THREAT_PROTECTION] + """ + + properties: "MTPCheckRequirementsProperties" + """MTP (Microsoft Threat Protection) requirements check properties.""" + kind: Required[Literal[DataConnectorKind.MICROSOFT_THREAT_PROTECTION]] + """Describes the kind of connector to be checked. Required. MicrosoftThreatProtection.""" + + +class MTPCheckRequirementsProperties(DataConnectorTenantId): + """MTP (Microsoft Threat Protection) requirements check properties. + + :ivar tenantId: The tenant id to connect to, and get the data from. Required. + :vartype tenantId: str + """ + + +class MTPDataConnector(TypedDict, total=False): + """Represents MTP (Microsoft Threat Protection) data connector. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: MTP (Microsoft Threat Protection) data connector properties. + :vartype properties: "MTPDataConnectorProperties" + :ivar kind: The data connector kind. Required. MicrosoftThreatProtection. + :vartype kind: Literal[DataConnectorKind.MICROSOFT_THREAT_PROTECTION] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "MTPDataConnectorProperties" + """MTP (Microsoft Threat Protection) data connector properties.""" + kind: Required[Literal[DataConnectorKind.MICROSOFT_THREAT_PROTECTION]] + """The data connector kind. Required. MicrosoftThreatProtection.""" + + +class MTPDataConnectorDataTypes(TypedDict, total=False): + """The available data types for Microsoft Threat Protection Platforms data connector. + + :ivar incidents: Incidents data type for Microsoft Threat Protection Platforms data connector. + Required. + :vartype incidents: "MTPDataConnectorDataTypesIncidents" + :ivar alerts: Alerts data type for Microsoft Threat Protection Platforms data connector. + :vartype alerts: "MTPDataConnectorDataTypesAlerts" + """ + + incidents: Required["MTPDataConnectorDataTypesIncidents"] + """Incidents data type for Microsoft Threat Protection Platforms data connector. Required.""" + alerts: "MTPDataConnectorDataTypesAlerts" + """Alerts data type for Microsoft Threat Protection Platforms data connector.""" + + +class MTPDataConnectorDataTypesAlerts(DataConnectorDataTypeCommon): + """Alerts data type for Microsoft Threat Protection Platforms data connector. + + :ivar state: Describe whether this data type connection is enabled or not. Required. Known + values are: "Enabled" and "Disabled". + :vartype state: Union[str, "DataTypeState"] + """ + + +class MTPDataConnectorDataTypesIncidents(DataConnectorDataTypeCommon): + """Incidents data type for Microsoft Threat Protection Platforms data connector. + + :ivar state: Describe whether this data type connection is enabled or not. Required. Known + values are: "Enabled" and "Disabled". + :vartype state: Union[str, "DataTypeState"] + """ + + +class MTPDataConnectorProperties(DataConnectorTenantId): + """MTP (Microsoft Threat Protection) data connector properties. + + :ivar tenantId: The tenant id to connect to, and get the data from. Required. + :vartype tenantId: str + :ivar dataTypes: The available data types for the connector. Required. + :vartype dataTypes: "MTPDataConnectorDataTypes" + :ivar filteredProviders: The available filtered providers for the connector. + :vartype filteredProviders: "MtpFilteredProviders" + """ + + dataTypes: Required["MTPDataConnectorDataTypes"] + """The available data types for the connector. Required.""" + filteredProviders: "MtpFilteredProviders" + """The available filtered providers for the connector.""" + + +class MtpFilteredProviders(TypedDict, total=False): + """Represents the connector's Filtered providers. + + :ivar alerts: Alerts filtered providers. When filters are not applied, all alerts will stream + through the MTP pipeline, still in private preview for all products EXCEPT MDA and MDI, which + are in GA state. Required. + :vartype alerts: list[Union[str, "MtpProvider"]] + """ + + alerts: Required[list[Union[str, "MtpProvider"]]] + """Alerts filtered providers. When filters are not applied, all alerts will stream through the MTP + pipeline, still in private preview for all products EXCEPT MDA and MDI, which are in GA state. + Required.""" + + +class NoneAuthModel(TypedDict, total=False): + """Model for API authentication with no authentication method - public API. + + :ivar type: The auth type. Required. None. + :vartype type: Literal[CcpAuthType.NONE] + """ + + type: Required[Literal[CcpAuthType.NONE]] + """The auth type. Required. None.""" + + +class NrtAlertRule(TypedDict, total=False): + """Represents NRT alert rule. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: NRT alert rule properties. + :vartype properties: "NrtAlertRuleProperties" + :ivar kind: The kind of the alert rule. Required. NRT. + :vartype kind: Literal[AlertRuleKind.NRT] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "NrtAlertRuleProperties" + """NRT alert rule properties.""" + kind: Required[Literal[AlertRuleKind.NRT]] + """The kind of the alert rule. Required. NRT.""" + + +class NrtAlertRuleProperties(TypedDict, total=False): + """Nrt alert rule base property bag. + + :ivar alertRuleTemplateName: The Name of the alert rule template used to create this rule. + :vartype alertRuleTemplateName: str + :ivar templateVersion: The version of the alert rule template used to create this rule - in + format , where all are numbers, for example 0 <1.0.2>. + :vartype templateVersion: str + :ivar description: The description of the alert rule. + :vartype description: str + :ivar query: The query that creates alerts for this rule. Required. + :vartype query: str + :ivar tactics: The tactics of the alert rule. + :vartype tactics: list[Union[str, "AttackTactic"]] + :ivar techniques: The techniques of the alert rule. + :vartype techniques: list[str] + :ivar subTechniques: The sub-techniques of the alert rule. + :vartype subTechniques: list[str] + :ivar displayName: The display name for alerts created by this alert rule. Required. + :vartype displayName: str + :ivar enabled: Determines whether this alert rule is enabled or disabled. Required. + :vartype enabled: bool + :ivar lastModifiedUtc: The last time that this alert rule has been modified. + :vartype lastModifiedUtc: str + :ivar suppressionDuration: The suppression (in ISO 8601 duration format) to wait since last + time this alert rule been triggered. Required. + :vartype suppressionDuration: str + :ivar suppressionEnabled: Determines whether the suppression for this alert rule is enabled or + disabled. Required. + :vartype suppressionEnabled: bool + :ivar severity: The severity for alerts created by this alert rule. Required. Known values are: + "High", "Medium", "Low", and "Informational". + :vartype severity: Union[str, "AlertSeverity"] + :ivar incidentConfiguration: The settings of the incidents that created from alerts triggered + by this analytics rule. + :vartype incidentConfiguration: "IncidentConfiguration" + :ivar customDetails: Dictionary of string key-value pairs of columns to be attached to the + alert. + :vartype customDetails: dict[str, str] + :ivar entityMappings: Array of the entity mappings of the alert rule. + :vartype entityMappings: list["EntityMapping"] + :ivar alertDetailsOverride: The alert details override settings. + :vartype alertDetailsOverride: "AlertDetailsOverride" + :ivar eventGroupingSettings: The event grouping settings. + :vartype eventGroupingSettings: "EventGroupingSettings" + :ivar sentinelEntitiesMappings: Array of the sentinel entity mappings of the alert rule. + :vartype sentinelEntitiesMappings: list["SentinelEntityMapping"] + """ + + alertRuleTemplateName: str + """The Name of the alert rule template used to create this rule.""" + templateVersion: str + """The version of the alert rule template used to create this rule - in format , where all + are numbers, for example 0 <1.0.2>.""" + description: str + """The description of the alert rule.""" + query: Required[str] + """The query that creates alerts for this rule. Required.""" + tactics: list[Union[str, "AttackTactic"]] + """The tactics of the alert rule.""" + techniques: list[str] + """The techniques of the alert rule.""" + subTechniques: list[str] + """The sub-techniques of the alert rule.""" + displayName: Required[str] + """The display name for alerts created by this alert rule. Required.""" + enabled: Required[bool] + """Determines whether this alert rule is enabled or disabled. Required.""" + lastModifiedUtc: str + """The last time that this alert rule has been modified.""" + suppressionDuration: Required[str] + """The suppression (in ISO 8601 duration format) to wait since last time this alert rule been + triggered. Required.""" + suppressionEnabled: Required[bool] + """Determines whether the suppression for this alert rule is enabled or disabled. Required.""" + severity: Required[Union[str, "AlertSeverity"]] + """The severity for alerts created by this alert rule. Required. Known values are: \"High\", + \"Medium\", \"Low\", and \"Informational\".""" + incidentConfiguration: "IncidentConfiguration" + """The settings of the incidents that created from alerts triggered by this analytics rule.""" + customDetails: dict[str, str] + """Dictionary of string key-value pairs of columns to be attached to the alert.""" + entityMappings: list["EntityMapping"] + """Array of the entity mappings of the alert rule.""" + alertDetailsOverride: "AlertDetailsOverride" + """The alert details override settings.""" + eventGroupingSettings: "EventGroupingSettings" + """The event grouping settings.""" + sentinelEntitiesMappings: list["SentinelEntityMapping"] + """Array of the sentinel entity mappings of the alert rule.""" + + +class OAuthModel(TypedDict, total=False): + """Model for API authentication with OAuth2. + + :ivar authorizationCode: The user's authorization code. + :vartype authorizationCode: str + :ivar clientSecret: The Application (client) secret that the OAuth provider assigned to your + app. Required. + :vartype clientSecret: str + :ivar clientId: The Application (client) ID that the OAuth provider assigned to your app. + Required. + :vartype clientId: str + :ivar isCredentialsInHeaders: Indicating whether we want to send the clientId and clientSecret + to token endpoint in the headers. + :vartype isCredentialsInHeaders: bool + :ivar scope: The Application (client) Scope that the OAuth provider assigned to your app. + :vartype scope: str + :ivar redirectUri: The Application redirect url that the user config in the OAuth provider. + :vartype redirectUri: str + :ivar grantType: The grant type, usually will be 'authorization code'. Required. + :vartype grantType: str + :ivar tokenEndpoint: The token endpoint. Defines the OAuth2 refresh token. Required. + :vartype tokenEndpoint: str + :ivar tokenEndpointHeaders: The token endpoint headers. + :vartype tokenEndpointHeaders: dict[str, str] + :ivar tokenEndpointQueryParameters: The token endpoint query parameters. + :vartype tokenEndpointQueryParameters: dict[str, str] + :ivar authorizationEndpoint: The authorization endpoint. + :vartype authorizationEndpoint: str + :ivar authorizationEndpointHeaders: The authorization endpoint headers. + :vartype authorizationEndpointHeaders: dict[str, str] + :ivar authorizationEndpointQueryParameters: The authorization endpoint query parameters. + :vartype authorizationEndpointQueryParameters: dict[str, str] + :ivar isJwtBearerFlow: A value indicating whether it's a JWT flow. + :vartype isJwtBearerFlow: bool + :ivar accessTokenPrepend: Access token prepend. Default is 'Bearer'. + :vartype accessTokenPrepend: str + :ivar type: The auth type. Required. OAuth2. + :vartype type: Literal[CcpAuthType.O_AUTH2] + """ + + authorizationCode: str + """The user's authorization code.""" + clientSecret: Required[str] + """The Application (client) secret that the OAuth provider assigned to your app. Required.""" + clientId: Required[str] + """The Application (client) ID that the OAuth provider assigned to your app. Required.""" + isCredentialsInHeaders: Optional[bool] + """Indicating whether we want to send the clientId and clientSecret to token endpoint in the + headers.""" + scope: str + """The Application (client) Scope that the OAuth provider assigned to your app.""" + redirectUri: str + """The Application redirect url that the user config in the OAuth provider.""" + grantType: Required[str] + """The grant type, usually will be 'authorization code'. Required.""" + tokenEndpoint: Required[str] + """The token endpoint. Defines the OAuth2 refresh token. Required.""" + tokenEndpointHeaders: dict[str, str] + """The token endpoint headers.""" + tokenEndpointQueryParameters: dict[str, str] + """The token endpoint query parameters.""" + authorizationEndpoint: str + """The authorization endpoint.""" + authorizationEndpointHeaders: dict[str, str] + """The authorization endpoint headers.""" + authorizationEndpointQueryParameters: dict[str, str] + """The authorization endpoint query parameters.""" + isJwtBearerFlow: bool + """A value indicating whether it's a JWT flow.""" + accessTokenPrepend: str + """Access token prepend. Default is 'Bearer'.""" + type: Required[Literal[CcpAuthType.O_AUTH2]] + """The auth type. Required. OAuth2.""" + + +class Office365ProjectCheckRequirements(TypedDict, total=False): + """Represents Office365 Project requirements check request. + + :ivar properties: Office365 Project requirements check properties. + :vartype properties: "Office365ProjectCheckRequirementsProperties" + :ivar kind: Describes the kind of connector to be checked. Required. Office365Project. + :vartype kind: Literal[DataConnectorKind.OFFICE365_PROJECT] + """ + + properties: "Office365ProjectCheckRequirementsProperties" + """Office365 Project requirements check properties.""" + kind: Required[Literal[DataConnectorKind.OFFICE365_PROJECT]] + """Describes the kind of connector to be checked. Required. Office365Project.""" + + +class Office365ProjectCheckRequirementsProperties(DataConnectorTenantId): # pylint: disable=name-too-long + """Office365 Project requirements check properties. + + :ivar tenantId: The tenant id to connect to, and get the data from. Required. + :vartype tenantId: str + """ + + +class Office365ProjectConnectorDataTypes(TypedDict, total=False): + """The available data types for Office Microsoft Project data connector. + + :ivar logs: Logs data type. Required. + :vartype logs: "Office365ProjectConnectorDataTypesLogs" + """ + + logs: Required["Office365ProjectConnectorDataTypesLogs"] + """Logs data type. Required.""" + + +class Office365ProjectConnectorDataTypesLogs(DataConnectorDataTypeCommon): + """Logs data type. + + :ivar state: Describe whether this data type connection is enabled or not. Required. Known + values are: "Enabled" and "Disabled". + :vartype state: Union[str, "DataTypeState"] + """ + + +class Office365ProjectDataConnector(TypedDict, total=False): + """Represents Office Microsoft Project data connector. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: Office Microsoft Project data connector properties. + :vartype properties: "Office365ProjectDataConnectorProperties" + :ivar kind: The data connector kind. Required. Office365Project. + :vartype kind: Literal[DataConnectorKind.OFFICE365_PROJECT] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "Office365ProjectDataConnectorProperties" + """Office Microsoft Project data connector properties.""" + kind: Required[Literal[DataConnectorKind.OFFICE365_PROJECT]] + """The data connector kind. Required. Office365Project.""" + + +class Office365ProjectDataConnectorProperties(DataConnectorTenantId): + """Office Microsoft Project data connector properties. + + :ivar tenantId: The tenant id to connect to, and get the data from. Required. + :vartype tenantId: str + :ivar dataTypes: The available data types for the connector. Required. + :vartype dataTypes: "Office365ProjectConnectorDataTypes" + """ + + dataTypes: Required["Office365ProjectConnectorDataTypes"] + """The available data types for the connector. Required.""" + + +class OfficeATPCheckRequirements(TypedDict, total=False): + """Represents OfficeATP (Office 365 Advanced Threat Protection) requirements check request. + + :ivar properties: OfficeATP (Office 365 Advanced Threat Protection) requirements check + properties. + :vartype properties: "OfficeATPCheckRequirementsProperties" + :ivar kind: Describes the kind of connector to be checked. Required. OfficeATP. + :vartype kind: Literal[DataConnectorKind.OFFICE_ATP] + """ + + properties: "OfficeATPCheckRequirementsProperties" + """OfficeATP (Office 365 Advanced Threat Protection) requirements check properties.""" + kind: Required[Literal[DataConnectorKind.OFFICE_ATP]] + """Describes the kind of connector to be checked. Required. OfficeATP.""" + + +class OfficeATPCheckRequirementsProperties(DataConnectorTenantId): + """OfficeATP (Office 365 Advanced Threat Protection) requirements check properties. + + :ivar tenantId: The tenant id to connect to, and get the data from. Required. + :vartype tenantId: str + """ + + +class OfficeATPDataConnector(TypedDict, total=False): + """Represents OfficeATP (Office 365 Advanced Threat Protection) data connector. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: OfficeATP (Office 365 Advanced Threat Protection) data connector properties. + :vartype properties: "OfficeATPDataConnectorProperties" + :ivar kind: The data connector kind. Required. OfficeATP. + :vartype kind: Literal[DataConnectorKind.OFFICE_ATP] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "OfficeATPDataConnectorProperties" + """OfficeATP (Office 365 Advanced Threat Protection) data connector properties.""" + kind: Required[Literal[DataConnectorKind.OFFICE_ATP]] + """The data connector kind. Required. OfficeATP.""" + + +class OfficeATPDataConnectorProperties(TypedDict, total=False): + """OfficeATP (Office 365 Advanced Threat Protection) data connector properties. + + :ivar tenantId: The tenant id to connect to, and get the data from. Required. + :vartype tenantId: str + :ivar dataTypes: The available data types for the connector. + :vartype dataTypes: "AlertsDataTypeOfDataConnector" + """ + + tenantId: Required[str] + """The tenant id to connect to, and get the data from. Required.""" + dataTypes: "AlertsDataTypeOfDataConnector" + """The available data types for the connector.""" + + +class OfficeDataConnector(TypedDict, total=False): + """Represents office data connector. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: Office data connector properties. + :vartype properties: "OfficeDataConnectorProperties" + :ivar kind: The data connector kind. Required. Office365. + :vartype kind: Literal[DataConnectorKind.OFFICE365] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "OfficeDataConnectorProperties" + """Office data connector properties.""" + kind: Required[Literal[DataConnectorKind.OFFICE365]] + """The data connector kind. Required. Office365.""" + + +class OfficeDataConnectorDataTypes(TypedDict, total=False): + """The available data types for office data connector. + + :ivar exchange: Exchange data type connection. Required. + :vartype exchange: "OfficeDataConnectorDataTypesExchange" + :ivar sharePoint: SharePoint data type connection. Required. + :vartype sharePoint: "OfficeDataConnectorDataTypesSharePoint" + :ivar teams: Teams data type connection. Required. + :vartype teams: "OfficeDataConnectorDataTypesTeams" + """ + + exchange: Required["OfficeDataConnectorDataTypesExchange"] + """Exchange data type connection. Required.""" + sharePoint: Required["OfficeDataConnectorDataTypesSharePoint"] + """SharePoint data type connection. Required.""" + teams: Required["OfficeDataConnectorDataTypesTeams"] + """Teams data type connection. Required.""" + + +class OfficeDataConnectorDataTypesExchange(DataConnectorDataTypeCommon): + """Exchange data type connection. + + :ivar state: Describe whether this data type connection is enabled or not. Required. Known + values are: "Enabled" and "Disabled". + :vartype state: Union[str, "DataTypeState"] + """ + + +class OfficeDataConnectorDataTypesSharePoint(DataConnectorDataTypeCommon): + """SharePoint data type connection. + + :ivar state: Describe whether this data type connection is enabled or not. Required. Known + values are: "Enabled" and "Disabled". + :vartype state: Union[str, "DataTypeState"] + """ + + +class OfficeDataConnectorDataTypesTeams(DataConnectorDataTypeCommon): + """Teams data type connection. + + :ivar state: Describe whether this data type connection is enabled or not. Required. Known + values are: "Enabled" and "Disabled". + :vartype state: Union[str, "DataTypeState"] + """ + + +class OfficeDataConnectorProperties(DataConnectorTenantId): + """Office data connector properties. + + :ivar tenantId: The tenant id to connect to, and get the data from. Required. + :vartype tenantId: str + :ivar dataTypes: The available data types for the connector. Required. + :vartype dataTypes: "OfficeDataConnectorDataTypes" + """ + + dataTypes: Required["OfficeDataConnectorDataTypes"] + """The available data types for the connector. Required.""" + + +class OfficeIRMCheckRequirements(TypedDict, total=False): + """Represents OfficeIRM (Microsoft Insider Risk Management) requirements check request. + + :ivar properties: OfficeIRM (Microsoft Insider Risk Management) requirements check properties. + :vartype properties: "OfficeIRMCheckRequirementsProperties" + :ivar kind: Describes the kind of connector to be checked. Required. OfficeIRM. + :vartype kind: Literal[DataConnectorKind.OFFICE_IRM] + """ + + properties: "OfficeIRMCheckRequirementsProperties" + """OfficeIRM (Microsoft Insider Risk Management) requirements check properties.""" + kind: Required[Literal[DataConnectorKind.OFFICE_IRM]] + """Describes the kind of connector to be checked. Required. OfficeIRM.""" + + +class OfficeIRMCheckRequirementsProperties(DataConnectorTenantId): + """OfficeIRM (Microsoft Insider Risk Management) requirements check properties. + + :ivar tenantId: The tenant id to connect to, and get the data from. Required. + :vartype tenantId: str + """ + + +class OfficeIRMDataConnector(TypedDict, total=False): + """Represents OfficeIRM (Microsoft Insider Risk Management) data connector. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: OfficeIRM (Microsoft Insider Risk Management) data connector properties. + :vartype properties: "OfficeIRMDataConnectorProperties" + :ivar kind: The data connector kind. Required. OfficeIRM. + :vartype kind: Literal[DataConnectorKind.OFFICE_IRM] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "OfficeIRMDataConnectorProperties" + """OfficeIRM (Microsoft Insider Risk Management) data connector properties.""" + kind: Required[Literal[DataConnectorKind.OFFICE_IRM]] + """The data connector kind. Required. OfficeIRM.""" + + +class OfficeIRMDataConnectorProperties(TypedDict, total=False): + """OfficeIRM (Microsoft Insider Risk Management) data connector properties. + + :ivar tenantId: The tenant id to connect to, and get the data from. Required. + :vartype tenantId: str + :ivar dataTypes: The available data types for the connector. + :vartype dataTypes: "AlertsDataTypeOfDataConnector" + """ + + tenantId: Required[str] + """The tenant id to connect to, and get the data from. Required.""" + dataTypes: "AlertsDataTypeOfDataConnector" + """The available data types for the connector.""" + + +class OfficePowerBICheckRequirements(TypedDict, total=False): + """Represents Office PowerBI requirements check request. + + :ivar properties: Office Power BI requirements check properties. + :vartype properties: "OfficePowerBICheckRequirementsProperties" + :ivar kind: Describes the kind of connector to be checked. Required. OfficePowerBI. + :vartype kind: Literal[DataConnectorKind.OFFICE_POWER_BI] + """ + + properties: "OfficePowerBICheckRequirementsProperties" + """Office Power BI requirements check properties.""" + kind: Required[Literal[DataConnectorKind.OFFICE_POWER_BI]] + """Describes the kind of connector to be checked. Required. OfficePowerBI.""" + + +class OfficePowerBICheckRequirementsProperties(DataConnectorTenantId): + """Office PowerBI requirements check properties. + + :ivar tenantId: The tenant id to connect to, and get the data from. Required. + :vartype tenantId: str + """ + + +class OfficePowerBIConnectorDataTypes(TypedDict, total=False): + """The available data types for Office Microsoft PowerBI data connector. + + :ivar logs: Logs data type. Required. + :vartype logs: "OfficePowerBIConnectorDataTypesLogs" + """ + + logs: Required["OfficePowerBIConnectorDataTypesLogs"] + """Logs data type. Required.""" + + +class OfficePowerBIConnectorDataTypesLogs(DataConnectorDataTypeCommon): + """Logs data type. + + :ivar state: Describe whether this data type connection is enabled or not. Required. Known + values are: "Enabled" and "Disabled". + :vartype state: Union[str, "DataTypeState"] + """ + + +class OfficePowerBIDataConnector(TypedDict, total=False): + """Represents Office Microsoft PowerBI data connector. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: Office Microsoft PowerBI data connector properties. + :vartype properties: "OfficePowerBIDataConnectorProperties" + :ivar kind: The data connector kind. Required. OfficePowerBI. + :vartype kind: Literal[DataConnectorKind.OFFICE_POWER_BI] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "OfficePowerBIDataConnectorProperties" + """Office Microsoft PowerBI data connector properties.""" + kind: Required[Literal[DataConnectorKind.OFFICE_POWER_BI]] + """The data connector kind. Required. OfficePowerBI.""" + + +class OfficePowerBIDataConnectorProperties(DataConnectorTenantId): + """Office Microsoft PowerBI data connector properties. + + :ivar tenantId: The tenant id to connect to, and get the data from. Required. + :vartype tenantId: str + :ivar dataTypes: The available data types for the connector. Required. + :vartype dataTypes: "OfficePowerBIConnectorDataTypes" + """ + + dataTypes: Required["OfficePowerBIConnectorDataTypes"] + """The available data types for the connector. Required.""" + + +class OracleAuthModel(TypedDict, total=False): + """Model for API authentication for Oracle. + + :ivar tenantId: Oracle tenant ID. Required. + :vartype tenantId: str + :ivar userId: Oracle user ID. Required. + :vartype userId: str + :ivar publicFingerprint: Public Fingerprint. Required. + :vartype publicFingerprint: str + :ivar pemFile: Content of the PRM file. Required. + :vartype pemFile: str + :ivar type: The auth type. Required. Oracle. + :vartype type: Literal[CcpAuthType.ORACLE] + """ + + tenantId: Required[str] + """Oracle tenant ID. Required.""" + userId: Required[str] + """Oracle user ID. Required.""" + publicFingerprint: Required[str] + """Public Fingerprint. Required.""" + pemFile: Required[str] + """Content of the PRM file. Required.""" + type: Required[Literal[CcpAuthType.ORACLE]] + """The auth type. Required. Oracle.""" + + +class PackageBaseProperties(TypedDict, total=False): + """Describes package properties. + + :ivar contentId: The content id of the package. + :vartype contentId: str + :ivar contentProductId: Unique ID for the content. It should be generated based on the + contentId, contentKind and the contentVersion of the package. + :vartype contentProductId: str + :ivar contentKind: The package kind. Known values are: "Solution" and "Standalone". + :vartype contentKind: Union[str, "PackageKind"] + :ivar contentSchemaVersion: The version of the content schema. + :vartype contentSchemaVersion: str + :ivar isNew: Flag indicates if this is a newly published package. Known values are: "true" and + "false". + :vartype isNew: Union[str, "Flag"] + :ivar isPreview: Flag indicates if this package is in preview. Known values are: "true" and + "false". + :vartype isPreview: Union[str, "Flag"] + :ivar isFeatured: Flag indicates if this package is among the featured list. Known values are: + "true" and "false". + :vartype isFeatured: Union[str, "Flag"] + :ivar isDeprecated: Flag indicates if this template is deprecated. Known values are: "true" and + "false". + :vartype isDeprecated: Union[str, "Flag"] + :ivar version: the latest version number of the package. + :vartype version: str + :ivar displayName: The display name of the package. + :vartype displayName: str + :ivar description: The description of the package. + :vartype description: str + :ivar publisherDisplayName: The publisher display name of the package. + :vartype publisherDisplayName: str + :ivar source: The source of the package. + :vartype source: "MetadataSource" + :ivar author: The author of the package. + :vartype author: "MetadataAuthor" + :ivar support: The support tier of the package. + :vartype support: "MetadataSupport" + :ivar dependencies: The support tier of the package. + :vartype dependencies: "MetadataDependencies" + :ivar providers: Providers for the package item. + :vartype providers: list[str] + :ivar firstPublishDate: first publish date package item. + :vartype firstPublishDate: str + :ivar lastPublishDate: last publish date for the package item. + :vartype lastPublishDate: str + :ivar categories: The categories of the package. + :vartype categories: "MetadataCategories" + :ivar threatAnalysisTactics: the tactics the resource covers. + :vartype threatAnalysisTactics: list[str] + :ivar threatAnalysisTechniques: the techniques the resource covers, these have to be aligned + with the tactics being used. + :vartype threatAnalysisTechniques: list[str] + :ivar icon: the icon identifier. this id can later be fetched from the content metadata. + :vartype icon: str + """ + + contentId: str + """The content id of the package.""" + contentProductId: str + """Unique ID for the content. It should be generated based on the contentId, contentKind and the + contentVersion of the package.""" + contentKind: Union[str, "PackageKind"] + """The package kind. Known values are: \"Solution\" and \"Standalone\".""" + contentSchemaVersion: str + """The version of the content schema.""" + isNew: Union[str, "Flag"] + """Flag indicates if this is a newly published package. Known values are: \"true\" and \"false\".""" + isPreview: Union[str, "Flag"] + """Flag indicates if this package is in preview. Known values are: \"true\" and \"false\".""" + isFeatured: Union[str, "Flag"] + """Flag indicates if this package is among the featured list. Known values are: \"true\" and + \"false\".""" + isDeprecated: Union[str, "Flag"] + """Flag indicates if this template is deprecated. Known values are: \"true\" and \"false\".""" + version: str + """the latest version number of the package.""" + displayName: str + """The display name of the package.""" + description: str + """The description of the package.""" + publisherDisplayName: str + """The publisher display name of the package.""" + source: "MetadataSource" + """The source of the package.""" + author: "MetadataAuthor" + """The author of the package.""" + support: "MetadataSupport" + """The support tier of the package.""" + dependencies: "MetadataDependencies" + """The support tier of the package.""" + providers: list[str] + """Providers for the package item.""" + firstPublishDate: str + """first publish date package item.""" + lastPublishDate: str + """last publish date for the package item.""" + categories: "MetadataCategories" + """The categories of the package.""" + threatAnalysisTactics: list[str] + """the tactics the resource covers.""" + threatAnalysisTechniques: list[str] + """the techniques the resource covers, these have to be aligned with the tactics being used.""" + icon: str + """the icon identifier. this id can later be fetched from the content metadata.""" + + +class PackageModel(ProxyResource): + """Represents a Package in Azure Security Insights. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar properties: package properties. + :vartype properties: "PackageProperties" + :ivar etag: Etag of the azure resource. + :vartype etag: str + """ + + properties: "PackageProperties" + """package properties.""" + etag: str + """Etag of the azure resource.""" + + +class PackageProperties(PackageBaseProperties): + """Describes package properties. + + :ivar contentId: The content id of the package. + :vartype contentId: str + :ivar contentProductId: Unique ID for the content. It should be generated based on the + contentId, contentKind and the contentVersion of the package. + :vartype contentProductId: str + :ivar contentKind: The package kind. Known values are: "Solution" and "Standalone". + :vartype contentKind: Union[str, "PackageKind"] + :ivar contentSchemaVersion: The version of the content schema. + :vartype contentSchemaVersion: str + :ivar isNew: Flag indicates if this is a newly published package. Known values are: "true" and + "false". + :vartype isNew: Union[str, "Flag"] + :ivar isPreview: Flag indicates if this package is in preview. Known values are: "true" and + "false". + :vartype isPreview: Union[str, "Flag"] + :ivar isFeatured: Flag indicates if this package is among the featured list. Known values are: + "true" and "false". + :vartype isFeatured: Union[str, "Flag"] + :ivar isDeprecated: Flag indicates if this template is deprecated. Known values are: "true" and + "false". + :vartype isDeprecated: Union[str, "Flag"] + :ivar version: the latest version number of the package. + :vartype version: str + :ivar displayName: The display name of the package. + :vartype displayName: str + :ivar description: The description of the package. + :vartype description: str + :ivar publisherDisplayName: The publisher display name of the package. + :vartype publisherDisplayName: str + :ivar source: The source of the package. + :vartype source: "MetadataSource" + :ivar author: The author of the package. + :vartype author: "MetadataAuthor" + :ivar support: The support tier of the package. + :vartype support: "MetadataSupport" + :ivar dependencies: The support tier of the package. + :vartype dependencies: "MetadataDependencies" + :ivar providers: Providers for the package item. + :vartype providers: list[str] + :ivar firstPublishDate: first publish date package item. + :vartype firstPublishDate: str + :ivar lastPublishDate: last publish date for the package item. + :vartype lastPublishDate: str + :ivar categories: The categories of the package. + :vartype categories: "MetadataCategories" + :ivar threatAnalysisTactics: the tactics the resource covers. + :vartype threatAnalysisTactics: list[str] + :ivar threatAnalysisTechniques: the techniques the resource covers, these have to be aligned + with the tactics being used. + :vartype threatAnalysisTechniques: list[str] + :ivar icon: the icon identifier. this id can later be fetched from the content metadata. + :vartype icon: str + """ + + +class Permissions(TypedDict, total=False): + """Permissions required for the connector. + + :ivar resourceProvider: Resource provider permissions required for the connector. + :vartype resourceProvider: list["PermissionsResourceProviderItem"] + :ivar customs: Customs permissions required for the connector. + :vartype customs: list["PermissionsCustomsItem"] + """ + + resourceProvider: list["PermissionsResourceProviderItem"] + """Resource provider permissions required for the connector.""" + customs: list["PermissionsCustomsItem"] + """Customs permissions required for the connector.""" + + +class PermissionsCustomsItem(Customs): + """PermissionsCustomsItem. + + :ivar name: Customs permissions name. + :vartype name: str + :ivar description: Customs permissions description. + :vartype description: str + """ + + +class ResourceProvider(TypedDict, total=False): + """Resource provider permissions required for the connector. + + :ivar provider: Provider name. Known values are: "Microsoft.OperationalInsights/solutions", + "Microsoft.OperationalInsights/workspaces", + "Microsoft.OperationalInsights/workspaces/datasources", "microsoft.aadiam/diagnosticSettings", + "Microsoft.OperationalInsights/workspaces/sharedKeys", and + "Microsoft.Authorization/policyAssignments". + :vartype provider: Union[str, "ProviderName"] + :ivar permissionsDisplayText: Permission description text. + :vartype permissionsDisplayText: str + :ivar providerDisplayName: Permission provider display name. + :vartype providerDisplayName: str + :ivar scope: Permission provider scope. Known values are: "ResourceGroup", "Subscription", and + "Workspace". + :vartype scope: Union[str, "PermissionProviderScope"] + :ivar requiredPermissions: Required permissions for the connector. + :vartype requiredPermissions: "RequiredPermissions" + """ + + provider: Union[str, "ProviderName"] + """Provider name. Known values are: \"Microsoft.OperationalInsights/solutions\", + \"Microsoft.OperationalInsights/workspaces\", + \"Microsoft.OperationalInsights/workspaces/datasources\", + \"microsoft.aadiam/diagnosticSettings\", + \"Microsoft.OperationalInsights/workspaces/sharedKeys\", and + \"Microsoft.Authorization/policyAssignments\".""" + permissionsDisplayText: str + """Permission description text.""" + providerDisplayName: str + """Permission provider display name.""" + scope: Union[str, "PermissionProviderScope"] + """Permission provider scope. Known values are: \"ResourceGroup\", \"Subscription\", and + \"Workspace\".""" + requiredPermissions: "RequiredPermissions" + """Required permissions for the connector.""" + + +class PermissionsResourceProviderItem(ResourceProvider): + """PermissionsResourceProviderItem. + + :ivar provider: Provider name. Known values are: "Microsoft.OperationalInsights/solutions", + "Microsoft.OperationalInsights/workspaces", + "Microsoft.OperationalInsights/workspaces/datasources", "microsoft.aadiam/diagnosticSettings", + "Microsoft.OperationalInsights/workspaces/sharedKeys", and + "Microsoft.Authorization/policyAssignments". + :vartype provider: Union[str, "ProviderName"] + :ivar permissionsDisplayText: Permission description text. + :vartype permissionsDisplayText: str + :ivar providerDisplayName: Permission provider display name. + :vartype providerDisplayName: str + :ivar scope: Permission provider scope. Known values are: "ResourceGroup", "Subscription", and + "Workspace". + :vartype scope: Union[str, "PermissionProviderScope"] + :ivar requiredPermissions: Required permissions for the connector. + :vartype requiredPermissions: "RequiredPermissions" + """ + + +class PlaybookActionProperties(TypedDict, total=False): + """PlaybookActionProperties. + + :ivar logicAppResourceId: The resource id of the playbook resource. Required. + :vartype logicAppResourceId: str + :ivar tenantId: The tenant id of the playbook resource. + :vartype tenantId: str + """ + + logicAppResourceId: Required[str] + """The resource id of the playbook resource. Required.""" + tenantId: str + """The tenant id of the playbook resource.""" + + +class PremiumMdtiDataConnectorDataTypes(TypedDict, total=False): + """The available data types for Microsoft Defender for Threat Intelligence Premium data connector. + + :ivar connector: Data type for Microsoft Defender for Threat Intelligence Premium data + connector. Required. + :vartype connector: "PremiumMdtiDataConnectorDataTypesConnector" + """ + + connector: Required["PremiumMdtiDataConnectorDataTypesConnector"] + """Data type for Microsoft Defender for Threat Intelligence Premium data connector. Required.""" + + +class PremiumMdtiDataConnectorDataTypesConnector(DataConnectorDataTypeCommon): # pylint: disable=name-too-long + """Data type for Microsoft Defender for Threat Intelligence Premium data connector. + + :ivar state: Describe whether this data type connection is enabled or not. Required. Known + values are: "Enabled" and "Disabled". + :vartype state: Union[str, "DataTypeState"] + """ + + +class PremiumMdtiDataConnectorProperties(DataConnectorTenantId): + """Microsoft Defender for Threat Intelligence Premium data connector properties. + + :ivar tenantId: The tenant id to connect to, and get the data from. Required. + :vartype tenantId: str + :ivar lookbackPeriod: The lookback period for the feed to be imported. The date-time to begin + importing the feed from, for example: 2024-01-01T00:00:00.000Z. Required. + :vartype lookbackPeriod: str + :ivar requiredSKUsPresent: The flag to indicate whether the tenant has the premium SKU required + to access this connector. + :vartype requiredSKUsPresent: bool + :ivar dataTypes: The available data types for the connector. Required. + :vartype dataTypes: "PremiumMdtiDataConnectorDataTypes" + """ + + lookbackPeriod: Required[str] + """The lookback period for the feed to be imported. The date-time to begin importing the feed + from, for example: 2024-01-01T00:00:00.000Z. Required.""" + requiredSKUsPresent: bool + """The flag to indicate whether the tenant has the premium SKU required to access this connector.""" + dataTypes: Required["PremiumMdtiDataConnectorDataTypes"] + """The available data types for the connector. Required.""" + + +class PremiumMicrosoftDefenderForThreatIntelligence(TypedDict, total=False): # pylint: disable=name-too-long + """Represents Microsoft Defender for Threat Intelligence Premium data connector. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: Microsoft Defender for Threat Intelligence Premium data connector properties. + :vartype properties: "PremiumMdtiDataConnectorProperties" + :ivar kind: The data connector kind. Required. PremiumMicrosoftDefenderForThreatIntelligence. + :vartype kind: Literal[DataConnectorKind.PREMIUM_MICROSOFT_DEFENDER_FOR_THREAT_INTELLIGENCE] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "PremiumMdtiDataConnectorProperties" + """Microsoft Defender for Threat Intelligence Premium data connector properties.""" + kind: Required[Literal[DataConnectorKind.PREMIUM_MICROSOFT_DEFENDER_FOR_THREAT_INTELLIGENCE]] + """The data connector kind. Required. PremiumMicrosoftDefenderForThreatIntelligence.""" + + +class PropertyArrayChangedConditionProperties(TypedDict, total=False): + """Describes an automation rule condition that evaluates an array property's value change. + + :ivar conditionProperties: + :vartype conditionProperties: "AutomationRulePropertyArrayChangedValuesCondition" + :ivar conditionType: Required. Evaluate an object array property changed value. + :vartype conditionType: Literal[ConditionType.PROPERTY_ARRAY_CHANGED] + """ + + conditionProperties: "AutomationRulePropertyArrayChangedValuesCondition" + conditionType: Required[Literal[ConditionType.PROPERTY_ARRAY_CHANGED]] + """Required. Evaluate an object array property changed value.""" + + +class PropertyArrayConditionProperties(TypedDict, total=False): + """Describes an automation rule condition that evaluates an array property's value. + + :ivar conditionProperties: + :vartype conditionProperties: "AutomationRulePropertyArrayValuesCondition" + :ivar conditionType: Required. Evaluate an object array property value. + :vartype conditionType: Literal[ConditionType.PROPERTY_ARRAY] + """ + + conditionProperties: "AutomationRulePropertyArrayValuesCondition" + conditionType: Required[Literal[ConditionType.PROPERTY_ARRAY]] + """Required. Evaluate an object array property value.""" + + +class PropertyChangedConditionProperties(TypedDict, total=False): + """Describes an automation rule condition that evaluates a property's value change. + + :ivar conditionProperties: + :vartype conditionProperties: "AutomationRulePropertyValuesChangedCondition" + :ivar conditionType: Required. Evaluate an object property changed value. + :vartype conditionType: Literal[ConditionType.PROPERTY_CHANGED] + """ + + conditionProperties: "AutomationRulePropertyValuesChangedCondition" + conditionType: Required[Literal[ConditionType.PROPERTY_CHANGED]] + """Required. Evaluate an object property changed value.""" + + +class PropertyConditionProperties(TypedDict, total=False): + """Describes an automation rule condition that evaluates a property's value. + + :ivar conditionProperties: + :vartype conditionProperties: "AutomationRulePropertyValuesCondition" + :ivar conditionType: Required. Evaluate an object property value. + :vartype conditionType: Literal[ConditionType.PROPERTY] + """ + + conditionProperties: "AutomationRulePropertyValuesCondition" + conditionType: Required[Literal[ConditionType.PROPERTY]] + """Required. Evaluate an object property value.""" + + +class PullRequest(TypedDict, total=False): + """Information regarding pull request for protected branches. + + :ivar url: URL of pull request. + :vartype url: str + :ivar state: State of the pull request. Known values are: "Open" and "Closed". + :vartype state: Union[str, "PullRequestState"] + """ + + url: str + """URL of pull request.""" + state: Union[str, "PullRequestState"] + """State of the pull request. Known values are: \"Open\" and \"Closed\".""" + + +class PurviewAuditCheckRequirements(TypedDict, total=False): + """Represents PurviewAudit requirements check request. + + :ivar properties: PurviewAudit requirements check properties. + :vartype properties: "PurviewAuditCheckRequirementsProperties" + :ivar kind: Describes the kind of connector to be checked. Required. PurviewAudit. + :vartype kind: Literal[DataConnectorKind.PURVIEW_AUDIT] + """ + + properties: "PurviewAuditCheckRequirementsProperties" + """PurviewAudit requirements check properties.""" + kind: Required[Literal[DataConnectorKind.PURVIEW_AUDIT]] + """Describes the kind of connector to be checked. Required. PurviewAudit.""" + + +class PurviewAuditCheckRequirementsProperties(DataConnectorTenantId): + """PurviewAudit requirements check properties. + + :ivar tenantId: The tenant id to connect to, and get the data from. Required. + :vartype tenantId: str + """ + + +class PurviewAuditConnectorDataTypes(TypedDict, total=False): + """The available data types for PurviewAudit data connector. + + :ivar logs: Logs data type. Required. + :vartype logs: "PurviewAuditConnectorDataTypesLogs" + """ + + logs: Required["PurviewAuditConnectorDataTypesLogs"] + """Logs data type. Required.""" + + +class PurviewAuditConnectorDataTypesLogs(DataConnectorDataTypeCommon): + """Logs data type. + + :ivar state: Describe whether this data type connection is enabled or not. Required. Known + values are: "Enabled" and "Disabled". + :vartype state: Union[str, "DataTypeState"] + """ + + +class PurviewAuditDataConnector(TypedDict, total=False): + """Represents PurviewAudit data connector. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: PurviewAudit data connector properties. + :vartype properties: "PurviewAuditDataConnectorProperties" + :ivar kind: The data connector kind. Required. PurviewAudit. + :vartype kind: Literal[DataConnectorKind.PURVIEW_AUDIT] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "PurviewAuditDataConnectorProperties" + """PurviewAudit data connector properties.""" + kind: Required[Literal[DataConnectorKind.PURVIEW_AUDIT]] + """The data connector kind. Required. PurviewAudit.""" + + +class PurviewAuditDataConnectorProperties(DataConnectorTenantId): + """PurviewAudit data connector properties. + + :ivar tenantId: The tenant id to connect to, and get the data from. Required. + :vartype tenantId: str + :ivar connectorDefinitionName: The connector definition name (the dataConnectorDefinition + resource id). + :vartype connectorDefinitionName: str + :ivar sourceType: The source type indicates which kind of data is relevant for this connector. + :vartype sourceType: str + :ivar dcrConfig: The DCR related properties. + :vartype dcrConfig: "DCRConfiguration" + :ivar dataTypes: The available data types for the connector. Required. + :vartype dataTypes: "PurviewAuditConnectorDataTypes" + """ + + connectorDefinitionName: str + """The connector definition name (the dataConnectorDefinition resource id).""" + sourceType: str + """The source type indicates which kind of data is relevant for this connector.""" + dcrConfig: "DCRConfiguration" + """The DCR related properties.""" + dataTypes: Required["PurviewAuditConnectorDataTypes"] + """The available data types for the connector. Required.""" + + +class Query(TypedDict, total=False): + """Represents a query to run on the TI objects in the workspace. + + :ivar condition: Represents a condition used to query for TI objects. + :vartype condition: "QueryCondition" + :ivar sortBy: Specifies how to sort the query results. + :vartype sortBy: "QuerySortBy" + :ivar maxPageSize: Represents the maximum size of the page that will be returned from the query + API. + :vartype maxPageSize: int + :ivar minPageSize: Represents the minimum size of the page that will be returned from the query + API. + :vartype minPageSize: int + """ + + condition: "QueryCondition" + """Represents a condition used to query for TI objects.""" + sortBy: "QuerySortBy" + """Specifies how to sort the query results.""" + maxPageSize: int + """Represents the maximum size of the page that will be returned from the query API.""" + minPageSize: int + """Represents the minimum size of the page that will be returned from the query API.""" + + +class QueryCondition(TypedDict, total=False): + """Represents a condition used to query for TI objects. + + :ivar stixObjectType: The STIX type for the objects returned by this query. + :vartype stixObjectType: str + :ivar clauses: The list of clauses to be evaluated in disjunction or conjunction base on the + specified top level connective operator. Required. + :vartype clauses: list["ConditionClause"] + :ivar conditionConnective: The top level connective operator for this condition. Known values + are: "And" and "Or". + :vartype conditionConnective: Union[str, "Connective"] + """ + + stixObjectType: str + """The STIX type for the objects returned by this query.""" + clauses: Required[list["ConditionClause"]] + """The list of clauses to be evaluated in disjunction or conjunction base on the specified top + level connective operator. Required.""" + conditionConnective: Union[str, "Connective"] + """The top level connective operator for this condition. Known values are: \"And\" and \"Or\".""" + + +class QueryProperties(TypedDict, total=False): + """Describes the query properties. + + :ivar condition: Represents a condition used to query for TI objects. + :vartype condition: "ConditionProperties" + """ + + condition: "ConditionProperties" + """Represents a condition used to query for TI objects.""" + + +class QuerySortBy(TypedDict, total=False): + """Specifies how to sort the query results. + + :ivar direction: The direction to sort the results by. Known values are: "ASC" and "DESC". + :vartype direction: Union[str, "SortingDirection"] + :ivar field: Represents the field to sort the results by. + :vartype field: str + """ + + direction: Union[str, "SortingDirection"] + """The direction to sort the results by. Known values are: \"ASC\" and \"DESC\".""" + field: str + """Represents the field to sort the results by.""" + + +class RecommendationPatch(TypedDict, total=False): + """Recommendation Fields to update. + + :ivar properties: Recommendation Fields Properties to update. + :vartype properties: "RecommendationPatchProperties" + """ + + properties: "RecommendationPatchProperties" + """Recommendation Fields Properties to update.""" + + +class RecommendationPatchProperties(TypedDict, total=False): + """Recommendation Fields Properties to update. + + :ivar state: State of the recommendation. Known values are: "Active", "InProgress", + "Dismissed", "CompletedByUser", and "CompletedBySystem". + :vartype state: Union[str, "State"] + """ + + state: Union[str, "State"] + """State of the recommendation. Known values are: \"Active\", \"InProgress\", \"Dismissed\", + \"CompletedByUser\", and \"CompletedBySystem\".""" + + +class Relation(ProxyResource): + """Represents a relation between two resources. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar properties: Relation properties. + :vartype properties: "RelationProperties" + :ivar etag: Etag of the azure resource. + :vartype etag: str + """ + + properties: "RelationProperties" + """Relation properties.""" + etag: str + """Etag of the azure resource.""" + + +class RelationProperties(TypedDict, total=False): + """Relation property bag. + + :ivar relatedResourceId: The resource ID of the related resource. Required. + :vartype relatedResourceId: str + :ivar relatedResourceName: The name of the related resource. + :vartype relatedResourceName: str + :ivar relatedResourceType: The resource type of the related resource. + :vartype relatedResourceType: str + :ivar relatedResourceKind: The resource kind of the related resource. + :vartype relatedResourceKind: str + """ + + relatedResourceId: Required[str] + """The resource ID of the related resource. Required.""" + relatedResourceName: str + """The name of the related resource.""" + relatedResourceType: str + """The resource type of the related resource.""" + relatedResourceKind: str + """The resource kind of the related resource.""" + + +class Repository(TypedDict, total=False): + """metadata of a repository. + + :ivar url: Url of repository. Required. + :vartype url: str + :ivar branch: Branch name of repository. Required. + :vartype branch: str + :ivar displayUrl: Display url of repository. + :vartype displayUrl: str + :ivar deploymentLogsUrl: Url to access repository action logs. + :vartype deploymentLogsUrl: str + """ + + url: Required[str] + """Url of repository. Required.""" + branch: Required[str] + """Branch name of repository. Required.""" + displayUrl: str + """Display url of repository.""" + deploymentLogsUrl: str + """Url to access repository action logs.""" + + +class RepositoryAccess(TypedDict, total=False): + """Credentials to access repository. + + :ivar kind: The kind of repository access credentials. Required. Known values are: "OAuth", + "PAT", and "App". + :vartype kind: Union[str, "RepositoryAccessKind"] + :ivar code: OAuth Code. Required when ``kind`` is ``OAuth``. + :vartype code: str + :ivar state: OAuth State. Required when ``kind`` is ``OAuth``. + :vartype state: str + :ivar clientId: OAuth ClientId. Required when ``kind`` is ``OAuth``. + :vartype clientId: str + :ivar token: Personal Access Token. Required when ``kind`` is ``PAT``. + :vartype token: str + :ivar installationId: Application installation ID. Required when ``kind`` is ``App``. Supported + by ``GitHub`` only. + :vartype installationId: str + """ + + kind: Required[Union[str, "RepositoryAccessKind"]] + """The kind of repository access credentials. Required. Known values are: \"OAuth\", \"PAT\", and + \"App\".""" + code: str + """OAuth Code. Required when ``kind`` is ``OAuth``.""" + state: str + """OAuth State. Required when ``kind`` is ``OAuth``.""" + clientId: str + """OAuth ClientId. Required when ``kind`` is ``OAuth``.""" + token: str + """Personal Access Token. Required when ``kind`` is ``PAT``.""" + installationId: str + """Application installation ID. Required when ``kind`` is ``App``. Supported by ``GitHub`` only.""" + + +class RepositoryAccessObject(TypedDict, total=False): + """Credentials to access repository. + + :ivar repositoryAccess: RepositoryAccess properties. Required. + :vartype repositoryAccess: "RepositoryAccess" + """ + + repositoryAccess: Required["RepositoryAccess"] + """RepositoryAccess properties. Required.""" + + +class RepositoryAccessProperties(TypedDict, total=False): + """Credentials to access repository. + + :ivar properties: RepositoryAccess properties. Required. + :vartype properties: "RepositoryAccessObject" + """ + + properties: Required["RepositoryAccessObject"] + """RepositoryAccess properties. Required.""" + + +class RepositoryResourceInfo(TypedDict, total=False): + """Resources created in user's repository for the source-control. + + :ivar webhook: The webhook object created for the source-control. + :vartype webhook: "Webhook" + :ivar gitHubResourceInfo: Resources created in GitHub for this source-control. + :vartype gitHubResourceInfo: "GitHubResourceInfo" + :ivar azureDevOpsResourceInfo: Resources created in Azure DevOps for this source-control. + :vartype azureDevOpsResourceInfo: "AzureDevOpsResourceInfo" + """ + + webhook: "Webhook" + """The webhook object created for the source-control.""" + gitHubResourceInfo: "GitHubResourceInfo" + """Resources created in GitHub for this source-control.""" + azureDevOpsResourceInfo: "AzureDevOpsResourceInfo" + """Resources created in Azure DevOps for this source-control.""" + + +class RequiredPermissions(TypedDict, total=False): + """Required permissions for the connector. + + :ivar action: action permission. + :vartype action: bool + :ivar write: write permission. + :vartype write: bool + :ivar read: read permission. + :vartype read: bool + :ivar delete: delete permission. + :vartype delete: bool + """ + + action: bool + """action permission.""" + write: bool + """write permission.""" + read: bool + """read permission.""" + delete: bool + """delete permission.""" + + +class ResourceProviderRequiredPermissions(TypedDict, total=False): + """Required permissions for the connector resource provider that define in ResourceProviders. For + more information about the permissions see here. + + :ivar read: Gets or sets a value indicating whether the permission is read action (GET). + :vartype read: bool + :ivar write: Gets or sets a value indicating whether the permission is write action (PUT or + PATCH). + :vartype write: bool + :ivar delete: Gets or sets a value indicating whether the permission is delete action (DELETE). + :vartype delete: bool + :ivar action: Gets or sets a value indicating whether the permission is custom actions (POST). + :vartype action: bool + """ + + read: bool + """Gets or sets a value indicating whether the permission is read action (GET).""" + write: bool + """Gets or sets a value indicating whether the permission is write action (PUT or PATCH).""" + delete: bool + """Gets or sets a value indicating whether the permission is delete action (DELETE).""" + action: bool + """Gets or sets a value indicating whether the permission is custom actions (POST).""" + + +class RestApiPollerDataConnector(TypedDict, total=False): + """Represents Rest Api Poller data connector. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: Rest Api Poller data connector properties. + :vartype properties: "RestApiPollerDataConnectorProperties" + :ivar kind: The data connector kind. Required. RestApiPoller. + :vartype kind: Literal[DataConnectorKind.REST_API_POLLER] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "RestApiPollerDataConnectorProperties" + """Rest Api Poller data connector properties.""" + kind: Required[Literal[DataConnectorKind.REST_API_POLLER]] + """The data connector kind. Required. RestApiPoller.""" + + +class RestApiPollerDataConnectorProperties(TypedDict, total=False): + """Rest Api Poller data connector properties. + + :ivar connectorDefinitionName: The connector definition name (the dataConnectorDefinition + resource id). Required. + :vartype connectorDefinitionName: str + :ivar auth: The a authentication model. Required. + :vartype auth: "CcpAuthConfig" + :ivar request: The request configuration. Required. + :vartype request: "RestApiPollerRequestConfig" + :ivar dcrConfig: The DCR related properties. + :vartype dcrConfig: "DCRConfiguration" + :ivar isActive: Indicates whether the connector is active or not. + :vartype isActive: bool + :ivar dataType: The Log Analytics table destination. + :vartype dataType: str + :ivar response: The response configuration. + :vartype response: "CcpResponseConfig" + :ivar paging: The paging configuration. + :vartype paging: "RestApiPollerRequestPagingConfig" + :ivar addOnAttributes: The add on attributes. The key name will become attribute name (a + column) and the value will become the attribute value in the payload. + :vartype addOnAttributes: dict[str, str] + """ + + connectorDefinitionName: Required[str] + """The connector definition name (the dataConnectorDefinition resource id). Required.""" + auth: Required["CcpAuthConfig"] + """The a authentication model. Required.""" + request: Required["RestApiPollerRequestConfig"] + """The request configuration. Required.""" + dcrConfig: "DCRConfiguration" + """The DCR related properties.""" + isActive: bool + """Indicates whether the connector is active or not.""" + dataType: str + """The Log Analytics table destination.""" + response: "CcpResponseConfig" + """The response configuration.""" + paging: "RestApiPollerRequestPagingConfig" + """The paging configuration.""" + addOnAttributes: dict[str, str] + """The add on attributes. The key name will become attribute name (a column) and the value will + become the attribute value in the payload.""" + + +class RestApiPollerRequestConfig(TypedDict, total=False): + """The request configuration. + + :ivar apiEndpoint: The API endpoint. Required. + :vartype apiEndpoint: str + :ivar rateLimitQPS: The Rate limit queries per second for the request.. + :vartype rateLimitQPS: int + :ivar queryWindowInMin: The query window in minutes for the request. + :vartype queryWindowInMin: int + :ivar httpMethod: The HTTP method, default value GET. Known values are: "GET", "POST", "PUT", + and "DELETE". + :vartype httpMethod: Union[str, "HttpMethodVerb"] + :ivar queryTimeFormat: The query time format. A remote server can have a query to pull data + from range 'start' to 'end'. This property indicate what is the expected time format the remote + server know to parse. + :vartype queryTimeFormat: str + :ivar retryCount: The retry count. + :vartype retryCount: int + :ivar timeoutInSeconds: The timeout in seconds. + :vartype timeoutInSeconds: int + :ivar isPostPayloadJson: Flag to indicate if HTTP POST payload is in JSON format (vs + form-urlencoded). + :vartype isPostPayloadJson: bool + :ivar headers: The header for the request for the remote server. + :vartype headers: dict[str, str] + :ivar queryParameters: The HTTP query parameters to RESTful API. + :vartype queryParameters: dict[str, Any] + :ivar queryParametersTemplate: the query parameters template. Defines the query parameters + template to use when passing query parameters in advanced scenarios. + :vartype queryParametersTemplate: str + :ivar startTimeAttributeName: The query parameter name which the remote server expect to start + query. This property goes hand to hand with ``endTimeAttributeName``. + :vartype startTimeAttributeName: str + :ivar endTimeAttributeName: The query parameter name which the remote server expect to end + query. This property goes hand to hand with ``startTimeAttributeName``. + :vartype endTimeAttributeName: str + :ivar queryTimeIntervalAttributeName: The query parameter name which we need to send the server + for query logs in time interval. Should be defined with ``queryTimeIntervalPrepend`` and + ``queryTimeIntervalDelimiter``. + :vartype queryTimeIntervalAttributeName: str + :ivar queryTimeIntervalPrepend: The string prepend to the value of the query parameter in + ``queryTimeIntervalAttributeName``. + :vartype queryTimeIntervalPrepend: str + :ivar queryTimeIntervalDelimiter: The delimiter string between 2 QueryTimeFormat in the query + parameter ``queryTimeIntervalAttributeName``. + :vartype queryTimeIntervalDelimiter: str + """ + + apiEndpoint: Required[str] + """The API endpoint. Required.""" + rateLimitQPS: Optional[int] + """The Rate limit queries per second for the request..""" + queryWindowInMin: Optional[int] + """The query window in minutes for the request.""" + httpMethod: Union[str, "HttpMethodVerb"] + """The HTTP method, default value GET. Known values are: \"GET\", \"POST\", \"PUT\", and + \"DELETE\".""" + queryTimeFormat: str + """The query time format. A remote server can have a query to pull data from range 'start' to + 'end'. This property indicate what is the expected time format the remote server know to parse.""" + retryCount: Optional[int] + """The retry count.""" + timeoutInSeconds: Optional[int] + """The timeout in seconds.""" + isPostPayloadJson: Optional[bool] + """Flag to indicate if HTTP POST payload is in JSON format (vs form-urlencoded).""" + headers: dict[str, str] + """The header for the request for the remote server.""" + queryParameters: dict[str, Any] + """The HTTP query parameters to RESTful API.""" + queryParametersTemplate: str + """the query parameters template. Defines the query parameters template to use when passing query + parameters in advanced scenarios.""" + startTimeAttributeName: str + """The query parameter name which the remote server expect to start query. This property goes hand + to hand with ``endTimeAttributeName``.""" + endTimeAttributeName: str + """The query parameter name which the remote server expect to end query. This property goes hand + to hand with ``startTimeAttributeName``.""" + queryTimeIntervalAttributeName: str + """The query parameter name which we need to send the server for query logs in time interval. + Should be defined with ``queryTimeIntervalPrepend`` and ``queryTimeIntervalDelimiter``.""" + queryTimeIntervalPrepend: str + """The string prepend to the value of the query parameter in ``queryTimeIntervalAttributeName``.""" + queryTimeIntervalDelimiter: str + """The delimiter string between 2 QueryTimeFormat in the query parameter + ``queryTimeIntervalAttributeName``.""" + + +class RestApiPollerRequestPagingConfig(TypedDict, total=False): + """The request paging configuration. + + :ivar pagingType: Type of paging. Required. Known values are: "LinkHeader", "NextPageToken", + "NextPageUrl", "PersistentToken", "PersistentLinkHeader", "Offset", and "CountBasedPaging". + :vartype pagingType: Union[str, "RestApiPollerRequestPagingKind"] + :ivar pageSize: Page size. + :vartype pageSize: int + :ivar pageSizeParameterName: Page size parameter name. + :vartype pageSizeParameterName: str + """ + + pagingType: Required[Union[str, "RestApiPollerRequestPagingKind"]] + """Type of paging. Required. Known values are: \"LinkHeader\", \"NextPageToken\", \"NextPageUrl\", + \"PersistentToken\", \"PersistentLinkHeader\", \"Offset\", and \"CountBasedPaging\".""" + pageSize: int + """Page size.""" + pageSizeParameterName: str + """Page size parameter name.""" + + +class ScheduledAlertRule(TypedDict, total=False): + """Represents scheduled alert rule. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: Scheduled alert rule properties. + :vartype properties: "ScheduledAlertRuleProperties" + :ivar kind: The kind of the alert rule. Required. Scheduled. + :vartype kind: Literal[AlertRuleKind.SCHEDULED] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "ScheduledAlertRuleProperties" + """Scheduled alert rule properties.""" + kind: Required[Literal[AlertRuleKind.SCHEDULED]] + """The kind of the alert rule. Required. Scheduled.""" + + +class ScheduledAlertRuleCommonProperties(TypedDict, total=False): + """Scheduled alert rule template property bag. + + :ivar query: The query that creates alerts for this rule. + :vartype query: str + :ivar queryFrequency: The frequency (in ISO 8601 duration format) for this alert rule to run. + :vartype queryFrequency: str + :ivar queryPeriod: The period (in ISO 8601 duration format) that this alert rule looks at. + :vartype queryPeriod: str + :ivar severity: The severity for alerts created by this alert rule. Known values are: "High", + "Medium", "Low", and "Informational". + :vartype severity: Union[str, "AlertSeverity"] + :ivar triggerOperator: The operation against the threshold that triggers alert rule. Known + values are: "GreaterThan", "LessThan", "Equal", and "NotEqual". + :vartype triggerOperator: Union[str, "TriggerOperator"] + :ivar triggerThreshold: The threshold triggers this alert rule. + :vartype triggerThreshold: int + :ivar eventGroupingSettings: The event grouping settings. + :vartype eventGroupingSettings: "EventGroupingSettings" + :ivar customDetails: Dictionary of string key-value pairs of columns to be attached to the + alert. + :vartype customDetails: dict[str, str] + :ivar entityMappings: Array of the entity mappings of the alert rule. + :vartype entityMappings: list["EntityMapping"] + :ivar alertDetailsOverride: The alert details override settings. + :vartype alertDetailsOverride: "AlertDetailsOverride" + :ivar sentinelEntitiesMappings: Array of the sentinel entity mappings of the alert rule. + :vartype sentinelEntitiesMappings: list["SentinelEntityMapping"] + """ + + query: str + """The query that creates alerts for this rule.""" + queryFrequency: str + """The frequency (in ISO 8601 duration format) for this alert rule to run.""" + queryPeriod: str + """The period (in ISO 8601 duration format) that this alert rule looks at.""" + severity: Union[str, "AlertSeverity"] + """The severity for alerts created by this alert rule. Known values are: \"High\", \"Medium\", + \"Low\", and \"Informational\".""" + triggerOperator: Union[str, "TriggerOperator"] + """The operation against the threshold that triggers alert rule. Known values are: + \"GreaterThan\", \"LessThan\", \"Equal\", and \"NotEqual\".""" + triggerThreshold: int + """The threshold triggers this alert rule.""" + eventGroupingSettings: "EventGroupingSettings" + """The event grouping settings.""" + customDetails: dict[str, str] + """Dictionary of string key-value pairs of columns to be attached to the alert.""" + entityMappings: list["EntityMapping"] + """Array of the entity mappings of the alert rule.""" + alertDetailsOverride: "AlertDetailsOverride" + """The alert details override settings.""" + sentinelEntitiesMappings: list["SentinelEntityMapping"] + """Array of the sentinel entity mappings of the alert rule.""" + + +class ScheduledAlertRuleProperties(ScheduledAlertRuleCommonProperties): + """Scheduled alert rule base property bag. + + :ivar query: The query that creates alerts for this rule. + :vartype query: str + :ivar queryFrequency: The frequency (in ISO 8601 duration format) for this alert rule to run. + :vartype queryFrequency: str + :ivar queryPeriod: The period (in ISO 8601 duration format) that this alert rule looks at. + :vartype queryPeriod: str + :ivar severity: The severity for alerts created by this alert rule. Known values are: "High", + "Medium", "Low", and "Informational". + :vartype severity: Union[str, "AlertSeverity"] + :ivar triggerOperator: The operation against the threshold that triggers alert rule. Known + values are: "GreaterThan", "LessThan", "Equal", and "NotEqual". + :vartype triggerOperator: Union[str, "TriggerOperator"] + :ivar triggerThreshold: The threshold triggers this alert rule. + :vartype triggerThreshold: int + :ivar eventGroupingSettings: The event grouping settings. + :vartype eventGroupingSettings: "EventGroupingSettings" + :ivar customDetails: Dictionary of string key-value pairs of columns to be attached to the + alert. + :vartype customDetails: dict[str, str] + :ivar entityMappings: Array of the entity mappings of the alert rule. + :vartype entityMappings: list["EntityMapping"] + :ivar alertDetailsOverride: The alert details override settings. + :vartype alertDetailsOverride: "AlertDetailsOverride" + :ivar sentinelEntitiesMappings: Array of the sentinel entity mappings of the alert rule. + :vartype sentinelEntitiesMappings: list["SentinelEntityMapping"] + :ivar alertRuleTemplateName: The Name of the alert rule template used to create this rule. + :vartype alertRuleTemplateName: str + :ivar templateVersion: The version of the alert rule template used to create this rule - in + format , where all are numbers, for example 0 <1.0.2>. + :vartype templateVersion: str + :ivar description: The description of the alert rule. + :vartype description: str + :ivar displayName: The display name for alerts created by this alert rule. Required. + :vartype displayName: str + :ivar enabled: Determines whether this alert rule is enabled or disabled. Required. + :vartype enabled: bool + :ivar lastModifiedUtc: The last time that this alert rule has been modified. + :vartype lastModifiedUtc: str + :ivar suppressionDuration: The suppression (in ISO 8601 duration format) to wait since last + time this alert rule been triggered. Required. + :vartype suppressionDuration: str + :ivar suppressionEnabled: Determines whether the suppression for this alert rule is enabled or + disabled. Required. + :vartype suppressionEnabled: bool + :ivar tactics: The tactics of the alert rule. + :vartype tactics: list[Union[str, "AttackTactic"]] + :ivar techniques: The techniques of the alert rule. + :vartype techniques: list[str] + :ivar subTechniques: The sub-techniques of the alert rule. + :vartype subTechniques: list[str] + :ivar incidentConfiguration: The settings of the incidents that created from alerts triggered + by this analytics rule. + :vartype incidentConfiguration: "IncidentConfiguration" + """ + + alertRuleTemplateName: str + """The Name of the alert rule template used to create this rule.""" + templateVersion: str + """The version of the alert rule template used to create this rule - in format , where all + are numbers, for example 0 <1.0.2>.""" + description: str + """The description of the alert rule.""" + displayName: Required[str] + """The display name for alerts created by this alert rule. Required.""" + enabled: Required[bool] + """Determines whether this alert rule is enabled or disabled. Required.""" + lastModifiedUtc: str + """The last time that this alert rule has been modified.""" + suppressionDuration: Required[str] + """The suppression (in ISO 8601 duration format) to wait since last time this alert rule been + triggered. Required.""" + suppressionEnabled: Required[bool] + """Determines whether the suppression for this alert rule is enabled or disabled. Required.""" + tactics: list[Union[str, "AttackTactic"]] + """The tactics of the alert rule.""" + techniques: list[str] + """The techniques of the alert rule.""" + subTechniques: list[str] + """The sub-techniques of the alert rule.""" + incidentConfiguration: "IncidentConfiguration" + """The settings of the incidents that created from alerts triggered by this analytics rule.""" + + +class SecurityMLAnalyticsSettingsDataSource(TypedDict, total=False): + """security ml analytics settings data sources. + + :ivar connectorId: The connector id that provides the following data types. + :vartype connectorId: str + :ivar dataTypes: The data types used by the security ml analytics settings. + :vartype dataTypes: list[str] + """ + + connectorId: str + """The connector id that provides the following data types.""" + dataTypes: list[str] + """The data types used by the security ml analytics settings.""" + + +class SentinelEntityMapping(TypedDict, total=False): + """A single sentinel entity mapping. + + :ivar columnName: the column name to be mapped to the SentinelEntities. + :vartype columnName: str + """ + + columnName: str + """the column name to be mapped to the SentinelEntities.""" + + +class SentinelOnboardingState(ProxyResource): + """Sentinel onboarding state. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar properties: The Sentinel onboarding state object. + :vartype properties: "SentinelOnboardingStateProperties" + :ivar etag: Etag of the azure resource. + :vartype etag: str + """ + + properties: "SentinelOnboardingStateProperties" + """The Sentinel onboarding state object.""" + etag: str + """Etag of the azure resource.""" + + +class SentinelOnboardingStateProperties(TypedDict, total=False): + """The Sentinel onboarding state properties. + + :ivar customerManagedKey: Flag that indicates the status of the CMK setting. + :vartype customerManagedKey: bool + """ + + customerManagedKey: bool + """Flag that indicates the status of the CMK setting.""" + + +class ServicePrincipal(TypedDict, total=False): + """Service principal metadata. + + :ivar id: Id of service principal. + :vartype id: str + :ivar tenantId: Tenant id of service principal. + :vartype tenantId: str + :ivar appId: App id of service principal. + :vartype appId: str + :ivar credentialsExpireOn: Expiration time of service principal credentials. + :vartype credentialsExpireOn: str + """ + + id: str + """Id of service principal.""" + tenantId: str + """Tenant id of service principal.""" + appId: str + """App id of service principal.""" + credentialsExpireOn: str + """Expiration time of service principal credentials.""" + + +class SessionAuthModel(TypedDict, total=False): + """Model for API authentication with session cookie. + + :ivar userName: The user name attribute key value. Required. + :vartype userName: dict[str, str] + :ivar password: The password attribute name. Required. + :vartype password: dict[str, str] + :ivar queryParameters: Query parameters to session service endpoint. + :vartype queryParameters: dict[str, Any] + :ivar isPostPayloadJson: Indicating whether API key is set in HTTP POST payload. + :vartype isPostPayloadJson: bool + :ivar headers: HTTP request headers to session service endpoint. + :vartype headers: dict[str, str] + :ivar sessionTimeoutInMinutes: Session timeout in minutes. + :vartype sessionTimeoutInMinutes: int + :ivar sessionIdName: Session id attribute name from HTTP response header. + :vartype sessionIdName: str + :ivar sessionLoginRequestUri: HTTP request URL to session service endpoint. + :vartype sessionLoginRequestUri: str + :ivar type: The auth type. Required. Session. + :vartype type: Literal[CcpAuthType.SESSION] + """ + + userName: Required[dict[str, str]] + """The user name attribute key value. Required.""" + password: Required[dict[str, str]] + """The password attribute name. Required.""" + queryParameters: dict[str, Any] + """Query parameters to session service endpoint.""" + isPostPayloadJson: Optional[bool] + """Indicating whether API key is set in HTTP POST payload.""" + headers: dict[str, str] + """HTTP request headers to session service endpoint.""" + sessionTimeoutInMinutes: Optional[int] + """Session timeout in minutes.""" + sessionIdName: str + """Session id attribute name from HTTP response header.""" + sessionLoginRequestUri: str + """HTTP request URL to session service endpoint.""" + type: Required[Literal[CcpAuthType.SESSION]] + """The auth type. Required. Session.""" + + +class SourceControl(ProxyResource): + """Represents a SourceControl in Azure Security Insights. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar properties: source control properties. Required. + :vartype properties: "SourceControlProperties" + :ivar etag: Etag of the azure resource. + :vartype etag: str + """ + + properties: Required["SourceControlProperties"] + """source control properties. Required.""" + etag: str + """Etag of the azure resource.""" + + +class SourceControlProperties(TypedDict, total=False): + """Describes source control properties. + + :ivar id: The id (a Guid) of the source control. + :vartype id: str + :ivar version: The version number associated with the source control. Known values are: "V1" + and "V2". + :vartype version: Union[str, "Version"] + :ivar displayName: The display name of the source control. Required. + :vartype displayName: str + :ivar description: A description of the source control. + :vartype description: str + :ivar repoType: The repository type of the source control. Required. Known values are: "Github" + and "AzureDevOps". + :vartype repoType: Union[str, "RepoType"] + :ivar contentTypes: Array of source control content types. Required. + :vartype contentTypes: list[Union[str, "ContentType"]] + :ivar repository: Repository metadata. Required. + :vartype repository: "Repository" + :ivar servicePrincipal: Service principal metadata. + :vartype servicePrincipal: "ServicePrincipal" + :ivar workloadIdentityFederation: Workload Identity metadata. + :vartype workloadIdentityFederation: "WorkloadIdentityFederation" + :ivar repositoryAccess: Repository access credentials. This is write-only object and it never + returns back to a user. + :vartype repositoryAccess: "RepositoryAccess" + :ivar repositoryResourceInfo: Information regarding the resources created in user's repository. + :vartype repositoryResourceInfo: "RepositoryResourceInfo" + :ivar lastDeploymentInfo: Information regarding the latest deployment for the source control. + :vartype lastDeploymentInfo: "DeploymentInfo" + :ivar pullRequest: Information regarding the pull request of the source control. + :vartype pullRequest: "PullRequest" + """ + + id: str + """The id (a Guid) of the source control.""" + version: Union[str, "Version"] + """The version number associated with the source control. Known values are: \"V1\" and \"V2\".""" + displayName: Required[str] + """The display name of the source control. Required.""" + description: str + """A description of the source control.""" + repoType: Required[Union[str, "RepoType"]] + """The repository type of the source control. Required. Known values are: \"Github\" and + \"AzureDevOps\".""" + contentTypes: Required[list[Union[str, "ContentType"]]] + """Array of source control content types. Required.""" + repository: Required["Repository"] + """Repository metadata. Required.""" + servicePrincipal: "ServicePrincipal" + """Service principal metadata.""" + workloadIdentityFederation: "WorkloadIdentityFederation" + """Workload Identity metadata.""" + repositoryAccess: "RepositoryAccess" + """Repository access credentials. This is write-only object and it never returns back to a user.""" + repositoryResourceInfo: "RepositoryResourceInfo" + """Information regarding the resources created in user's repository.""" + lastDeploymentInfo: "DeploymentInfo" + """Information regarding the latest deployment for the source control.""" + pullRequest: "PullRequest" + """Information regarding the pull request of the source control.""" + + +class SystemData(TypedDict, total=False): + """Metadata pertaining to creation and last modification of the resource. + + :ivar createdBy: The identity that created the resource. + :vartype createdBy: str + :ivar createdByType: The type of identity that created the resource. Known values are: "User", + "Application", "ManagedIdentity", and "Key". + :vartype createdByType: Union[str, "CreatedByType"] + :ivar createdAt: The timestamp of resource creation (UTC). + :vartype createdAt: str + :ivar lastModifiedBy: The identity that last modified the resource. + :vartype lastModifiedBy: str + :ivar lastModifiedByType: The type of identity that last modified the resource. Known values + are: "User", "Application", "ManagedIdentity", and "Key". + :vartype lastModifiedByType: Union[str, "CreatedByType"] + :ivar lastModifiedAt: The timestamp of resource last modification (UTC). + :vartype lastModifiedAt: str + """ + + createdBy: str + """The identity that created the resource.""" + createdByType: Union[str, "CreatedByType"] + """The type of identity that created the resource. Known values are: \"User\", \"Application\", + \"ManagedIdentity\", and \"Key\".""" + createdAt: str + """The timestamp of resource creation (UTC).""" + lastModifiedBy: str + """The identity that last modified the resource.""" + lastModifiedByType: Union[str, "CreatedByType"] + """The type of identity that last modified the resource. Known values are: \"User\", + \"Application\", \"ManagedIdentity\", and \"Key\".""" + lastModifiedAt: str + """The timestamp of resource last modification (UTC).""" + + +class TeamInformation(TypedDict, total=False): + """Describes team information. + + :ivar teamId: Team ID. + :vartype teamId: str + :ivar primaryChannelUrl: The primary channel URL of the team. + :vartype primaryChannelUrl: str + :ivar teamCreationTimeUtc: The time the team was created. + :vartype teamCreationTimeUtc: str + :ivar name: The name of the team. + :vartype name: str + :ivar description: The description of the team. + :vartype description: str + """ + + teamId: str + """Team ID.""" + primaryChannelUrl: str + """The primary channel URL of the team.""" + teamCreationTimeUtc: str + """The time the team was created.""" + name: str + """The name of the team.""" + description: str + """The description of the team.""" + + +class TemplateModel(ProxyResource): + """Template resource definition. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar properties: template properties. + :vartype properties: "TemplateProperties" + :ivar etag: Etag of the azure resource. + :vartype etag: str + """ + + properties: "TemplateProperties" + """template properties.""" + etag: str + """Etag of the azure resource.""" + + +class TemplateProperties(TypedDict, total=False): + """Template property bag. + + :ivar contentId: Static ID for the content. Used to identify dependencies and content from + solutions or community. Hard-coded/static for out of the box content and solutions. Dynamic + for user-created. This is the resource name. + :vartype contentId: str + :ivar contentProductId: Unique ID for the content. It should be generated based on the + contentId of the package, contentId of the template, contentKind of the template and the + contentVersion of the template. + :vartype contentProductId: str + :ivar packageVersion: Version of the package. Default and recommended format is numeric (e.g. + 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but + then we cannot guarantee any version checks. + :vartype packageVersion: str + :ivar version: Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, + 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we + cannot guarantee any version checks. + :vartype version: str + :ivar displayName: The display name of the template. + :vartype displayName: str + :ivar contentKind: The kind of content the template is for. Known values are: "DataConnector", + "DataType", "Workbook", "WorkbookTemplate", "Playbook", "PlaybookTemplate", + "AnalyticsRuleTemplate", "AnalyticsRule", "HuntingQuery", "InvestigationQuery", "Parser", + "Watchlist", "WatchlistTemplate", "Solution", "AzureFunction", "LogicAppsCustomConnector", + "AutomationRule", "ResourcesDataConnector", "Notebook", "Standalone", "SummaryRule", and + "CustomDetection". + :vartype contentKind: Union[str, "Kind"] + :ivar source: Source of the content. This is where/how it was created. + :vartype source: "MetadataSource" + :ivar author: The creator of the content item. + :vartype author: "MetadataAuthor" + :ivar support: Support information for the template - type, name, contact information. + :vartype support: "MetadataSupport" + :ivar dependencies: Dependencies for the content item, what other content items it requires to + work. Can describe more complex dependencies using a recursive/nested structure. For a single + dependency an id/kind/version can be supplied or operator/criteria for complex formats. + :vartype dependencies: "MetadataDependencies" + :ivar categories: Categories for the item. + :vartype categories: "MetadataCategories" + :ivar providers: Providers for the content item. + :vartype providers: list[str] + :ivar firstPublishDate: first publish date content item. + :vartype firstPublishDate: str + :ivar lastPublishDate: last publish date for the content item. + :vartype lastPublishDate: str + :ivar customVersion: The custom version of the content. A optional free text. + :vartype customVersion: str + :ivar contentSchemaVersion: Schema version of the content. Can be used to distinguish between + different flow based on the schema version. + :vartype contentSchemaVersion: str + :ivar icon: the icon identifier. this id can later be fetched from the content metadata. + :vartype icon: str + :ivar threatAnalysisTactics: the tactics the resource covers. + :vartype threatAnalysisTactics: list[str] + :ivar threatAnalysisTechniques: the techniques the resource covers, these have to be aligned + with the tactics being used. + :vartype threatAnalysisTechniques: list[str] + :ivar previewImages: preview image file names. These will be taken from the solution artifacts. + :vartype previewImages: list[str] + :ivar previewImagesDark: preview image file names. These will be taken from the solution + artifacts. used for dark theme support. + :vartype previewImagesDark: list[str] + :ivar packageId: the package Id contains this template. + :vartype packageId: str + :ivar packageKind: the packageKind of the package contains this template. Known values are: + "Solution" and "Standalone". + :vartype packageKind: Union[str, "PackageKind"] + :ivar packageName: the name of the package contains this template. + :vartype packageName: str + :ivar isDeprecated: Flag indicates if this template is deprecated. Known values are: "true" and + "false". + :vartype isDeprecated: Union[str, "Flag"] + :ivar mainTemplate: The JSON of the ARM template to deploy active content. Expandable. + :vartype mainTemplate: Any + :ivar dependantTemplates: Dependant templates. Expandable. + :vartype dependantTemplates: list["TemplateProperties"] + """ + + contentId: str + """Static ID for the content. Used to identify dependencies and content from solutions or + community. Hard-coded/static for out of the box content and solutions. Dynamic for + user-created. This is the resource name.""" + contentProductId: str + """Unique ID for the content. It should be generated based on the contentId of the package, + contentId of the template, contentKind of the template and the contentVersion of the template.""" + packageVersion: str + """Version of the package. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, + 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot + guarantee any version checks.""" + version: str + """Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, + 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot + guarantee any version checks.""" + displayName: str + """The display name of the template.""" + contentKind: Union[str, "Kind"] + """The kind of content the template is for. Known values are: \"DataConnector\", \"DataType\", + \"Workbook\", \"WorkbookTemplate\", \"Playbook\", \"PlaybookTemplate\", + \"AnalyticsRuleTemplate\", \"AnalyticsRule\", \"HuntingQuery\", \"InvestigationQuery\", + \"Parser\", \"Watchlist\", \"WatchlistTemplate\", \"Solution\", \"AzureFunction\", + \"LogicAppsCustomConnector\", \"AutomationRule\", \"ResourcesDataConnector\", \"Notebook\", + \"Standalone\", \"SummaryRule\", and \"CustomDetection\".""" + source: "MetadataSource" + """Source of the content. This is where/how it was created.""" + author: "MetadataAuthor" + """The creator of the content item.""" + support: "MetadataSupport" + """Support information for the template - type, name, contact information.""" + dependencies: "MetadataDependencies" + """Dependencies for the content item, what other content items it requires to work. Can describe + more complex dependencies using a recursive/nested structure. For a single dependency an + id/kind/version can be supplied or operator/criteria for complex formats.""" + categories: "MetadataCategories" + """Categories for the item.""" + providers: list[str] + """Providers for the content item.""" + firstPublishDate: str + """first publish date content item.""" + lastPublishDate: str + """last publish date for the content item.""" + customVersion: str + """The custom version of the content. A optional free text.""" + contentSchemaVersion: str + """Schema version of the content. Can be used to distinguish between different flow based on the + schema version.""" + icon: str + """the icon identifier. this id can later be fetched from the content metadata.""" + threatAnalysisTactics: list[str] + """the tactics the resource covers.""" + threatAnalysisTechniques: list[str] + """the techniques the resource covers, these have to be aligned with the tactics being used.""" + previewImages: list[str] + """preview image file names. These will be taken from the solution artifacts.""" + previewImagesDark: list[str] + """preview image file names. These will be taken from the solution artifacts. used for dark theme + support.""" + packageId: str + """the package Id contains this template.""" + packageKind: Union[str, "PackageKind"] + """the packageKind of the package contains this template. Known values are: \"Solution\" and + \"Standalone\".""" + packageName: str + """the name of the package contains this template.""" + isDeprecated: Union[str, "Flag"] + """Flag indicates if this template is deprecated. Known values are: \"true\" and \"false\".""" + mainTemplate: Any + """The JSON of the ARM template to deploy active content. Expandable.""" + dependantTemplates: list["TemplateProperties"] + """Dependant templates. Expandable.""" + + +class ThreatIntelligenceAlertRule(TypedDict, total=False): + """Represents Threat Intelligence alert rule. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: Threat Intelligence alert rule properties. + :vartype properties: "ThreatIntelligenceAlertRuleProperties" + :ivar kind: The kind of the alert rule. Required. ThreatIntelligence. + :vartype kind: Literal[AlertRuleKind.THREAT_INTELLIGENCE] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "ThreatIntelligenceAlertRuleProperties" + """Threat Intelligence alert rule properties.""" + kind: Required[Literal[AlertRuleKind.THREAT_INTELLIGENCE]] + """The kind of the alert rule. Required. ThreatIntelligence.""" + + +class ThreatIntelligenceAlertRuleProperties(TypedDict, total=False): + """Threat Intelligence alert rule base property bag. + + :ivar alertRuleTemplateName: The Name of the alert rule template used to create this rule. + Required. + :vartype alertRuleTemplateName: str + :ivar description: The description of the alert rule. + :vartype description: str + :ivar displayName: The display name for alerts created by this alert rule. + :vartype displayName: str + :ivar enabled: Determines whether this alert rule is enabled or disabled. Required. + :vartype enabled: bool + :ivar lastModifiedUtc: The last time that this alert has been modified. + :vartype lastModifiedUtc: str + :ivar severity: The severity for alerts created by this alert rule. Known values are: "High", + "Medium", "Low", and "Informational". + :vartype severity: Union[str, "AlertSeverity"] + :ivar tactics: The tactics of the alert rule. + :vartype tactics: list[Union[str, "AttackTactic"]] + :ivar techniques: The techniques of the alert rule. + :vartype techniques: list[str] + :ivar subTechniques: The sub-techniques of the alert rule. + :vartype subTechniques: list[str] + """ + + alertRuleTemplateName: Required[str] + """The Name of the alert rule template used to create this rule. Required.""" + description: str + """The description of the alert rule.""" + displayName: str + """The display name for alerts created by this alert rule.""" + enabled: Required[bool] + """Determines whether this alert rule is enabled or disabled. Required.""" + lastModifiedUtc: str + """The last time that this alert has been modified.""" + severity: Union[str, "AlertSeverity"] + """The severity for alerts created by this alert rule. Known values are: \"High\", \"Medium\", + \"Low\", and \"Informational\".""" + tactics: list[Union[str, "AttackTactic"]] + """The tactics of the alert rule.""" + techniques: list[str] + """The techniques of the alert rule.""" + subTechniques: list[str] + """The sub-techniques of the alert rule.""" + + +class ThreatIntelligenceAppendTags(TypedDict, total=False): + """Array of tags to be appended to the threat intelligence indicator. + + :ivar threatIntelligenceTags: List of tags to be appended. + :vartype threatIntelligenceTags: list[str] + """ + + threatIntelligenceTags: list[str] + """List of tags to be appended.""" + + +class ThreatIntelligenceExternalReference(TypedDict, total=False): + """Describes external reference. + + :ivar description: External reference description. + :vartype description: str + :ivar externalId: External reference ID. + :vartype externalId: str + :ivar sourceName: External reference source name. + :vartype sourceName: str + :ivar url: External reference URL. + :vartype url: str + :ivar hashes: External reference hashes. + :vartype hashes: dict[str, str] + """ + + description: str + """External reference description.""" + externalId: str + """External reference ID.""" + sourceName: str + """External reference source name.""" + url: str + """External reference URL.""" + hashes: dict[str, str] + """External reference hashes.""" + + +class ThreatIntelligenceFilteringCriteria(TypedDict, total=False): + """Filtering criteria for querying threat intelligence indicators. + + :ivar pageSize: Page size. + :vartype pageSize: int + :ivar minConfidence: Minimum confidence. + :vartype minConfidence: int + :ivar maxConfidence: Maximum confidence. + :vartype maxConfidence: int + :ivar minValidUntil: Start time for ValidUntil filter. + :vartype minValidUntil: str + :ivar maxValidUntil: End time for ValidUntil filter. + :vartype maxValidUntil: str + :ivar includeDisabled: Parameter to include/exclude disabled indicators. + :vartype includeDisabled: bool + :ivar sortBy: Columns to sort by and sorting order. + :vartype sortBy: list["ThreatIntelligenceSortingCriteria"] + :ivar sources: Sources of threat intelligence indicators. + :vartype sources: list[str] + :ivar patternTypes: Pattern types. + :vartype patternTypes: list[str] + :ivar threatTypes: Threat types of threat intelligence indicators. + :vartype threatTypes: list[str] + :ivar ids: Ids of threat intelligence indicators. + :vartype ids: list[str] + :ivar keywords: Keywords for searching threat intelligence indicators. + :vartype keywords: list[str] + :ivar skipToken: Skip token. + :vartype skipToken: str + """ + + pageSize: int + """Page size.""" + minConfidence: int + """Minimum confidence.""" + maxConfidence: int + """Maximum confidence.""" + minValidUntil: str + """Start time for ValidUntil filter.""" + maxValidUntil: str + """End time for ValidUntil filter.""" + includeDisabled: bool + """Parameter to include/exclude disabled indicators.""" + sortBy: list["ThreatIntelligenceSortingCriteria"] + """Columns to sort by and sorting order.""" + sources: list[str] + """Sources of threat intelligence indicators.""" + patternTypes: list[str] + """Pattern types.""" + threatTypes: list[str] + """Threat types of threat intelligence indicators.""" + ids: list[str] + """Ids of threat intelligence indicators.""" + keywords: list[str] + """Keywords for searching threat intelligence indicators.""" + skipToken: str + """Skip token.""" + + +class ThreatIntelligenceGranularMarkingModel(TypedDict, total=False): + """Describes threat granular marking model entity. + + :ivar language: Language granular marking model. + :vartype language: str + :ivar markingRef: marking reference granular marking model. + :vartype markingRef: int + :ivar selectors: granular marking model selectors. + :vartype selectors: list[str] + """ + + language: str + """Language granular marking model.""" + markingRef: int + """marking reference granular marking model.""" + selectors: list[str] + """granular marking model selectors.""" + + +class ThreatIntelligenceIndicatorModel(TypedDict, total=False): + """Threat intelligence indicator entity. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: Threat Intelligence Entity properties. + :vartype properties: "ThreatIntelligenceIndicatorProperties" + :ivar kind: Required. Entity represents threat intelligence indicator in the system. + :vartype kind: Literal[ThreatIntelligenceResourceKindEnum.INDICATOR] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "ThreatIntelligenceIndicatorProperties" + """Threat Intelligence Entity properties.""" + kind: Required[Literal[ThreatIntelligenceResourceKindEnum.INDICATOR]] + """Required. Entity represents threat intelligence indicator in the system.""" + + +class ThreatIntelligenceIndicatorProperties(EntityCommonProperties): + """Describes threat intelligence entity properties. + + :ivar additionalData: A bag of custom fields that should be part of the entity and will be + presented to the user. + :vartype additionalData: dict[str, Any] + :ivar friendlyName: The graph item display name which is a short humanly readable description + of the graph item instance. This property is optional and might be system generated. + :vartype friendlyName: str + :ivar threatIntelligenceTags: List of tags. + :vartype threatIntelligenceTags: list[str] + :ivar lastUpdatedTimeUtc: Last updated time in UTC. + :vartype lastUpdatedTimeUtc: str + :ivar source: Source of a threat intelligence entity. + :vartype source: str + :ivar displayName: Display name of a threat intelligence entity. + :vartype displayName: str + :ivar description: Description of a threat intelligence entity. + :vartype description: str + :ivar indicatorTypes: Indicator types of threat intelligence entities. + :vartype indicatorTypes: list[str] + :ivar pattern: Pattern of a threat intelligence entity. + :vartype pattern: str + :ivar patternType: Pattern type of a threat intelligence entity. + :vartype patternType: str + :ivar patternVersion: Pattern version of a threat intelligence entity. + :vartype patternVersion: str + :ivar killChainPhases: Kill chain phases. + :vartype killChainPhases: list["ThreatIntelligenceKillChainPhase"] + :ivar parsedPattern: Parsed patterns. + :vartype parsedPattern: list["ThreatIntelligenceParsedPattern"] + :ivar externalId: External ID of threat intelligence entity. + :vartype externalId: str + :ivar createdByRef: Created by reference of threat intelligence entity. + :vartype createdByRef: str + :ivar defanged: Is threat intelligence entity defanged. + :vartype defanged: bool + :ivar externalLastUpdatedTimeUtc: External last updated time in UTC. + :vartype externalLastUpdatedTimeUtc: str + :ivar externalReferences: External References. + :vartype externalReferences: list["ThreatIntelligenceExternalReference"] + :ivar granularMarkings: Granular Markings. + :vartype granularMarkings: list["ThreatIntelligenceGranularMarkingModel"] + :ivar labels: Labels of threat intelligence entity. + :vartype labels: list[str] + :ivar revoked: Is threat intelligence entity revoked. + :vartype revoked: bool + :ivar confidence: Confidence of threat intelligence entity. + :vartype confidence: int + :ivar objectMarkingRefs: Threat intelligence entity object marking references. + :vartype objectMarkingRefs: list[str] + :ivar language: Language of threat intelligence entity. + :vartype language: str + :ivar threatTypes: Threat types. + :vartype threatTypes: list[str] + :ivar validFrom: Valid from. + :vartype validFrom: str + :ivar validUntil: Valid until. + :vartype validUntil: str + :ivar created: Created by. + :vartype created: str + :ivar modified: Modified by. + :vartype modified: str + :ivar extensions: Extensions map. + :vartype extensions: dict[str, Any] + """ + + threatIntelligenceTags: list[str] + """List of tags.""" + lastUpdatedTimeUtc: str + """Last updated time in UTC.""" + source: str + """Source of a threat intelligence entity.""" + displayName: str + """Display name of a threat intelligence entity.""" + description: str + """Description of a threat intelligence entity.""" + indicatorTypes: list[str] + """Indicator types of threat intelligence entities.""" + pattern: str + """Pattern of a threat intelligence entity.""" + patternType: str + """Pattern type of a threat intelligence entity.""" + patternVersion: str + """Pattern version of a threat intelligence entity.""" + killChainPhases: list["ThreatIntelligenceKillChainPhase"] + """Kill chain phases.""" + parsedPattern: list["ThreatIntelligenceParsedPattern"] + """Parsed patterns.""" + externalId: str + """External ID of threat intelligence entity.""" + createdByRef: str + """Created by reference of threat intelligence entity.""" + defanged: bool + """Is threat intelligence entity defanged.""" + externalLastUpdatedTimeUtc: str + """External last updated time in UTC.""" + externalReferences: list["ThreatIntelligenceExternalReference"] + """External References.""" + granularMarkings: list["ThreatIntelligenceGranularMarkingModel"] + """Granular Markings.""" + labels: list[str] + """Labels of threat intelligence entity.""" + revoked: bool + """Is threat intelligence entity revoked.""" + confidence: int + """Confidence of threat intelligence entity.""" + objectMarkingRefs: list[str] + """Threat intelligence entity object marking references.""" + language: str + """Language of threat intelligence entity.""" + threatTypes: list[str] + """Threat types.""" + validFrom: str + """Valid from.""" + validUntil: str + """Valid until.""" + created: str + """Created by.""" + modified: str + """Modified by.""" + extensions: dict[str, Any] + """Extensions map.""" + + +class ThreatIntelligenceKillChainPhase(TypedDict, total=False): + """Describes threat kill chain phase entity. + + :ivar killChainName: Kill chainName name. + :vartype killChainName: str + :ivar phaseName: Phase name. + :vartype phaseName: str + """ + + killChainName: str + """Kill chainName name.""" + phaseName: str + """Phase name.""" + + +class ThreatIntelligenceParsedPattern(TypedDict, total=False): + """Describes parsed pattern entity. + + :ivar patternTypeKey: Pattern type key. + :vartype patternTypeKey: str + :ivar patternTypeValues: Pattern type keys. + :vartype patternTypeValues: list["ThreatIntelligenceParsedPatternTypeValue"] + """ + + patternTypeKey: str + """Pattern type key.""" + patternTypeValues: list["ThreatIntelligenceParsedPatternTypeValue"] + """Pattern type keys.""" + + +class ThreatIntelligenceParsedPatternTypeValue(TypedDict, total=False): + """Describes threat kill chain phase entity. + + :ivar valueType: Type of the value. + :vartype valueType: str + :ivar value: Value of parsed pattern. + :vartype value: str + """ + + valueType: str + """Type of the value.""" + value: str + """Value of parsed pattern.""" + + +class ThreatIntelligenceSortingCriteria(TypedDict, total=False): + """List of available columns for sorting. + + :ivar itemKey: Column name. + :vartype itemKey: str + :ivar sortOrder: Sorting order (ascending/descending/unsorted). Known values are: "unsorted", + "ascending", and "descending". + :vartype sortOrder: Union[str, "ThreatIntelligenceSortingCriteriaEnum"] + """ + + itemKey: str + """Column name.""" + sortOrder: Union[str, "ThreatIntelligenceSortingCriteriaEnum"] + """Sorting order (ascending/descending/unsorted). Known values are: \"unsorted\", \"ascending\", + and \"descending\".""" + + +class TICheckRequirements(TypedDict, total=False): + """Threat Intelligence Platforms data connector check requirements. + + :ivar properties: Threat Intelligence Platforms data connector check required properties. + :vartype properties: "TICheckRequirementsProperties" + :ivar kind: Describes the kind of connector to be checked. Required. ThreatIntelligence. + :vartype kind: Literal[DataConnectorKind.THREAT_INTELLIGENCE] + """ + + properties: "TICheckRequirementsProperties" + """Threat Intelligence Platforms data connector check required properties.""" + kind: Required[Literal[DataConnectorKind.THREAT_INTELLIGENCE]] + """Describes the kind of connector to be checked. Required. ThreatIntelligence.""" + + +class TICheckRequirementsProperties(DataConnectorTenantId): + """Threat Intelligence Platforms data connector required properties. + + :ivar tenantId: The tenant id to connect to, and get the data from. Required. + :vartype tenantId: str + """ + + +class TIDataConnector(TypedDict, total=False): + """Represents threat intelligence data connector. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: TI (Threat Intelligence) data connector properties. + :vartype properties: "TIDataConnectorProperties" + :ivar kind: The data connector kind. Required. ThreatIntelligence. + :vartype kind: Literal[DataConnectorKind.THREAT_INTELLIGENCE] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "TIDataConnectorProperties" + """TI (Threat Intelligence) data connector properties.""" + kind: Required[Literal[DataConnectorKind.THREAT_INTELLIGENCE]] + """The data connector kind. Required. ThreatIntelligence.""" + + +class TIDataConnectorDataTypes(TypedDict, total=False): + """The available data types for TI (Threat Intelligence) data connector. + + :ivar indicators: Data type for indicators connection. Required. + :vartype indicators: "TIDataConnectorDataTypesIndicators" + """ + + indicators: Required["TIDataConnectorDataTypesIndicators"] + """Data type for indicators connection. Required.""" + + +class TIDataConnectorDataTypesIndicators(DataConnectorDataTypeCommon): + """Data type for indicators connection. + + :ivar state: Describe whether this data type connection is enabled or not. Required. Known + values are: "Enabled" and "Disabled". + :vartype state: Union[str, "DataTypeState"] + """ + + +class TIDataConnectorProperties(DataConnectorTenantId): + """TI (Threat Intelligence) data connector properties. + + :ivar tenantId: The tenant id to connect to, and get the data from. Required. + :vartype tenantId: str + :ivar tipLookbackPeriod: The lookback period for the feed to be imported. + :vartype tipLookbackPeriod: str + :ivar dataTypes: The available data types for the connector. Required. + :vartype dataTypes: "TIDataConnectorDataTypes" + """ + + tipLookbackPeriod: Optional[str] + """The lookback period for the feed to be imported.""" + dataTypes: Required["TIDataConnectorDataTypes"] + """The available data types for the connector. Required.""" + + +class TiTaxiiCheckRequirements(TypedDict, total=False): + """Threat Intelligence TAXII data connector check requirements. + + :ivar properties: Threat Intelligence TAXII check required properties. + :vartype properties: "TiTaxiiCheckRequirementsProperties" + :ivar kind: Describes the kind of connector to be checked. Required. ThreatIntelligenceTaxii. + :vartype kind: Literal[DataConnectorKind.THREAT_INTELLIGENCE_TAXII] + """ + + properties: "TiTaxiiCheckRequirementsProperties" + """Threat Intelligence TAXII check required properties.""" + kind: Required[Literal[DataConnectorKind.THREAT_INTELLIGENCE_TAXII]] + """Describes the kind of connector to be checked. Required. ThreatIntelligenceTaxii.""" + + +class TiTaxiiCheckRequirementsProperties(DataConnectorTenantId): + """Threat Intelligence TAXII data connector required properties. + + :ivar tenantId: The tenant id to connect to, and get the data from. Required. + :vartype tenantId: str + """ + + +class TiTaxiiDataConnector(TypedDict, total=False): + """Data connector to pull Threat intelligence data from TAXII 2.0/2.1 server. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: Threat intelligence TAXII data connector properties. + :vartype properties: "TiTaxiiDataConnectorProperties" + :ivar kind: The data connector kind. Required. ThreatIntelligenceTaxii. + :vartype kind: Literal[DataConnectorKind.THREAT_INTELLIGENCE_TAXII] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "TiTaxiiDataConnectorProperties" + """Threat intelligence TAXII data connector properties.""" + kind: Required[Literal[DataConnectorKind.THREAT_INTELLIGENCE_TAXII]] + """The data connector kind. Required. ThreatIntelligenceTaxii.""" + + +class TiTaxiiDataConnectorDataTypes(TypedDict, total=False): + """The available data types for Threat Intelligence TAXII data connector. + + :ivar taxiiClient: Data type for TAXII connector. Required. + :vartype taxiiClient: "TiTaxiiDataConnectorDataTypesTaxiiClient" + """ + + taxiiClient: Required["TiTaxiiDataConnectorDataTypesTaxiiClient"] + """Data type for TAXII connector. Required.""" + + +class TiTaxiiDataConnectorDataTypesTaxiiClient(DataConnectorDataTypeCommon): + """Data type for TAXII connector. + + :ivar state: Describe whether this data type connection is enabled or not. Required. Known + values are: "Enabled" and "Disabled". + :vartype state: Union[str, "DataTypeState"] + """ + + +class TiTaxiiDataConnectorProperties(DataConnectorTenantId): + """Threat Intelligence TAXII data connector properties. + + :ivar tenantId: The tenant id to connect to, and get the data from. Required. + :vartype tenantId: str + :ivar workspaceId: The workspace id. + :vartype workspaceId: str + :ivar friendlyName: The friendly name for the TAXII server. + :vartype friendlyName: str + :ivar taxiiServer: The API root for the TAXII server. + :vartype taxiiServer: str + :ivar collectionId: The collection id of the TAXII server. + :vartype collectionId: str + :ivar userName: The userName for the TAXII server. + :vartype userName: str + :ivar password: The password for the TAXII server. + :vartype password: str + :ivar taxiiLookbackPeriod: The lookback period for the TAXII server. + :vartype taxiiLookbackPeriod: str + :ivar pollingFrequency: The polling frequency for the TAXII server. Required. Known values are: + "OnceAMinute", "OnceAnHour", and "OnceADay". + :vartype pollingFrequency: Union[str, "PollingFrequency"] + :ivar dataTypes: The available data types for Threat Intelligence TAXII data connector. + Required. + :vartype dataTypes: "TiTaxiiDataConnectorDataTypes" + """ + + workspaceId: str + """The workspace id.""" + friendlyName: str + """The friendly name for the TAXII server.""" + taxiiServer: str + """The API root for the TAXII server.""" + collectionId: str + """The collection id of the TAXII server.""" + userName: str + """The userName for the TAXII server.""" + password: str + """The password for the TAXII server.""" + taxiiLookbackPeriod: Optional[str] + """The lookback period for the TAXII server.""" + pollingFrequency: Required[Optional[Union[str, "PollingFrequency"]]] + """The polling frequency for the TAXII server. Required. Known values are: \"OnceAMinute\", + \"OnceAnHour\", and \"OnceADay\".""" + dataTypes: Required["TiTaxiiDataConnectorDataTypes"] + """The available data types for Threat Intelligence TAXII data connector. Required.""" + + +class Ueba(TypedDict, total=False): + """Settings with single toggle. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar etag: Etag of the azure resource. + :vartype etag: str + :ivar properties: Ueba properties. + :vartype properties: "UebaProperties" + :ivar kind: The kind of the setting. Required. Ueba. + :vartype kind: Literal[SettingKind.UEBA] + """ + + id: str + """Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.""" + name: str + """The name of the resource.""" + type: str + """The type of the resource. E.g. \"Microsoft.Compute/virtualMachines\" or + \"Microsoft.Storage/storageAccounts\".""" + systemData: "SystemData" + """Azure Resource Manager metadata containing createdBy and modifiedBy information.""" + etag: str + """Etag of the azure resource.""" + properties: "UebaProperties" + """Ueba properties.""" + kind: Required[Literal[SettingKind.UEBA]] + """The kind of the setting. Required. Ueba.""" + + +class UebaProperties(TypedDict, total=False): + """Ueba property bag. + + :ivar dataSources: The relevant data sources that enriched by ueba. + :vartype dataSources: list[Union[str, "UebaDataSources"]] + """ + + dataSources: list[Union[str, "UebaDataSources"]] + """The relevant data sources that enriched by ueba.""" + + +class UserInfo(TypedDict, total=False): + """User information that made some action. + + :ivar email: The email of the user. + :vartype email: str + :ivar name: The name of the user. + :vartype name: str + :ivar objectId: The object id of the user. + :vartype objectId: str + """ + + email: str + """The email of the user.""" + name: str + """The name of the user.""" + objectId: Optional[str] + """The object id of the user.""" + + +class ValidationError(TypedDict, total=False): + """Describes an error encountered in the file during validation. + + :ivar recordIndex: The number of the record that has the error. + :vartype recordIndex: int + :ivar errorMessages: A list of descriptions of the error. + :vartype errorMessages: list[str] + """ + + recordIndex: int + """The number of the record that has the error.""" + errorMessages: list[str] + """A list of descriptions of the error.""" + + +class Watchlist(ProxyResource): + """Represents a Watchlist in Azure Security Insights. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar properties: Watchlist properties. + :vartype properties: "WatchlistProperties" + :ivar etag: Etag of the azure resource. + :vartype etag: str + """ + + properties: "WatchlistProperties" + """Watchlist properties.""" + etag: str + """Etag of the azure resource.""" + + +class WatchlistItem(ProxyResource): + """Represents a Watchlist Item in Azure Security Insights. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar properties: Watchlist Item properties. + :vartype properties: "WatchlistItemProperties" + :ivar etag: Etag of the azure resource. + :vartype etag: str + """ + + properties: "WatchlistItemProperties" + """Watchlist Item properties.""" + etag: str + """Etag of the azure resource.""" + + +class WatchlistItemProperties(TypedDict, total=False): + """Describes watchlist item properties. + + :ivar watchlistItemType: The type of the watchlist item. + :vartype watchlistItemType: str + :ivar watchlistItemId: The id (a Guid) of the watchlist item. + :vartype watchlistItemId: str + :ivar tenantId: The tenantId to which the watchlist item belongs to. + :vartype tenantId: str + :ivar isDeleted: A flag that indicates if the watchlist item is deleted or not. + :vartype isDeleted: bool + :ivar created: The time the watchlist item was created. + :vartype created: str + :ivar updated: The last time the watchlist item was updated. + :vartype updated: str + :ivar createdBy: Describes a user that created the watchlist item. + :vartype createdBy: "UserInfo" + :ivar updatedBy: Describes a user that updated the watchlist item. + :vartype updatedBy: "UserInfo" + :ivar itemsKeyValue: key-value pairs for a watchlist item. Required. + :vartype itemsKeyValue: Any + :ivar entityMapping: key-value pairs for a watchlist item entity mapping. + :vartype entityMapping: Any + """ + + watchlistItemType: str + """The type of the watchlist item.""" + watchlistItemId: str + """The id (a Guid) of the watchlist item.""" + tenantId: str + """The tenantId to which the watchlist item belongs to.""" + isDeleted: bool + """A flag that indicates if the watchlist item is deleted or not.""" + created: str + """The time the watchlist item was created.""" + updated: str + """The last time the watchlist item was updated.""" + createdBy: "UserInfo" + """Describes a user that created the watchlist item.""" + updatedBy: "UserInfo" + """Describes a user that updated the watchlist item.""" + itemsKeyValue: Required[Any] + """key-value pairs for a watchlist item. Required.""" + entityMapping: Any + """key-value pairs for a watchlist item entity mapping.""" + + +class WatchlistProperties(TypedDict, total=False): + """Describes watchlist properties. + + :ivar watchlistId: The id (a Guid) of the watchlist. + :vartype watchlistId: str + :ivar displayName: The display name of the watchlist. Required. + :vartype displayName: str + :ivar provider: The provider of the watchlist. Required. + :vartype provider: str + :ivar source: The filename of the watchlist, called 'source'. + :vartype source: str + :ivar sourceType: The sourceType of the watchlist. Known values are: "Local" and + "AzureStorage". + :vartype sourceType: Union[str, "SourceType"] + :ivar created: The time the watchlist was created. + :vartype created: str + :ivar updated: The last time the watchlist was updated. + :vartype updated: str + :ivar createdBy: Describes a user that created the watchlist. + :vartype createdBy: "UserInfo" + :ivar updatedBy: Describes a user that updated the watchlist. + :vartype updatedBy: "UserInfo" + :ivar description: A description of the watchlist. + :vartype description: str + :ivar watchlistType: The type of the watchlist. + :vartype watchlistType: str + :ivar watchlistAlias: The alias of the watchlist. + :vartype watchlistAlias: str + :ivar isDeleted: A flag that indicates if the watchlist is deleted or not. + :vartype isDeleted: bool + :ivar labels: List of labels relevant to this watchlist. + :vartype labels: list[str] + :ivar defaultDuration: The default duration of a watchlist (in ISO 8601 duration format). + :vartype defaultDuration: str + :ivar tenantId: The tenantId where the watchlist belongs to. + :vartype tenantId: str + :ivar numberOfLinesToSkip: The number of lines in a csv/tsv content to skip before the header. + :vartype numberOfLinesToSkip: int + :ivar rawContent: The raw content that represents to watchlist items to create. In case of + csv/tsv content type, it's the content of the file that will parsed by the endpoint. + :vartype rawContent: str + :ivar itemsSearchKey: The search key is used to optimize query performance when using + watchlists for joins with other data. For example, enable a column with IP addresses to be the + designated SearchKey field, then use this field as the key field when joining to other event + data by IP address. Required. + :vartype itemsSearchKey: str + :ivar contentType: The content type of the raw content. Example : text/csv or text/tsv. + :vartype contentType: str + :ivar uploadStatus: The status of the Watchlist upload : New, InProgress or Complete. **Note** + : When a Watchlist upload status is InProgress, the Watchlist cannot be deleted. + :vartype uploadStatus: str + :ivar provisioningState: Describes provisioning state. Known values are: "New", "InProgress", + "Uploading", "Deleting", "Succeeded", "Failed", and "Canceled". + :vartype provisioningState: Union[str, "WatchlistProvisioningState"] + """ + + watchlistId: str + """The id (a Guid) of the watchlist.""" + displayName: Required[str] + """The display name of the watchlist. Required.""" + provider: Required[str] + """The provider of the watchlist. Required.""" + source: str + """The filename of the watchlist, called 'source'.""" + sourceType: Union[str, "SourceType"] + """The sourceType of the watchlist. Known values are: \"Local\" and \"AzureStorage\".""" + created: str + """The time the watchlist was created.""" + updated: str + """The last time the watchlist was updated.""" + createdBy: "UserInfo" + """Describes a user that created the watchlist.""" + updatedBy: "UserInfo" + """Describes a user that updated the watchlist.""" + description: str + """A description of the watchlist.""" + watchlistType: str + """The type of the watchlist.""" + watchlistAlias: str + """The alias of the watchlist.""" + isDeleted: bool + """A flag that indicates if the watchlist is deleted or not.""" + labels: list[str] + """List of labels relevant to this watchlist.""" + defaultDuration: str + """The default duration of a watchlist (in ISO 8601 duration format).""" + tenantId: str + """The tenantId where the watchlist belongs to.""" + numberOfLinesToSkip: int + """The number of lines in a csv/tsv content to skip before the header.""" + rawContent: str + """The raw content that represents to watchlist items to create. In case of csv/tsv content type, + it's the content of the file that will parsed by the endpoint.""" + itemsSearchKey: Required[str] + """The search key is used to optimize query performance when using watchlists for joins with other + data. For example, enable a column with IP addresses to be the designated SearchKey field, then + use this field as the key field when joining to other event data by IP address. Required.""" + contentType: str + """The content type of the raw content. Example : text/csv or text/tsv.""" + uploadStatus: str + """The status of the Watchlist upload : New, InProgress or Complete. **Note** : When a Watchlist + upload status is InProgress, the Watchlist cannot be deleted.""" + provisioningState: Union[str, "WatchlistProvisioningState"] + """Describes provisioning state. Known values are: \"New\", \"InProgress\", \"Uploading\", + \"Deleting\", \"Succeeded\", \"Failed\", and \"Canceled\".""" + + +class Webhook(TypedDict, total=False): + """Detail about the webhook object. + + :ivar webhookId: Unique identifier for the webhook. + :vartype webhookId: str + :ivar webhookUrl: URL that gets invoked by the webhook. + :vartype webhookUrl: str + :ivar webhookSecretUpdateTime: Time when the webhook secret was updated. + :vartype webhookSecretUpdateTime: str + :ivar rotateWebhookSecret: A flag to instruct the backend service to rotate webhook secret. + :vartype rotateWebhookSecret: bool + """ + + webhookId: str + """Unique identifier for the webhook.""" + webhookUrl: str + """URL that gets invoked by the webhook.""" + webhookSecretUpdateTime: str + """Time when the webhook secret was updated.""" + rotateWebhookSecret: bool + """A flag to instruct the backend service to rotate webhook secret.""" + + +class WorkloadIdentityFederation(TypedDict, total=False): + """Workload Identity Federation metadata. + + :ivar id: Id of Workload Identity Federation. + :vartype id: str + :ivar tenantId: Tenant id of Workload Identity Federation. + :vartype tenantId: str + :ivar appId: App id of Workload Identity Federation. + :vartype appId: str + :ivar subject: Subject of Workload Identity Federation. + :vartype subject: str + :ivar issuer: Issuer of Workload Identity Federation. + :vartype issuer: str + """ + + id: str + """Id of Workload Identity Federation.""" + tenantId: str + """Tenant id of Workload Identity Federation.""" + appId: str + """App id of Workload Identity Federation.""" + subject: str + """Subject of Workload Identity Federation.""" + issuer: str + """Issuer of Workload Identity Federation.""" + + +class WorkspaceManagerAssignment(ProxyResource): + """The workspace manager assignment. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar properties: The workspace manager assignment object. + :vartype properties: "WorkspaceManagerAssignmentProperties" + :ivar etag: Resource Etag. + :vartype etag: str + """ + + properties: "WorkspaceManagerAssignmentProperties" + """The workspace manager assignment object.""" + etag: str + """Resource Etag.""" + + +class WorkspaceManagerAssignmentProperties(TypedDict, total=False): + """The workspace manager assignment properties. + + :ivar targetResourceName: The resource name of the workspace manager group targeted by the + workspace manager assignment. Required. + :vartype targetResourceName: str + :ivar lastJobEndTime: The time the last job associated to this assignment ended at. + :vartype lastJobEndTime: str + :ivar lastJobProvisioningState: State of the last job associated to this assignment. Known + values are: "Succeeded", "InProgress", "Canceled", and "Failed". + :vartype lastJobProvisioningState: Union[str, "JobProvisioningState"] + :ivar items: List of resources included in this workspace manager assignment. Required. + :vartype items: list["AssignmentItem"] + """ + + targetResourceName: Required[str] + """The resource name of the workspace manager group targeted by the workspace manager assignment. + Required.""" + lastJobEndTime: str + """The time the last job associated to this assignment ended at.""" + lastJobProvisioningState: Union[str, "JobProvisioningState"] + """State of the last job associated to this assignment. Known values are: \"Succeeded\", + \"InProgress\", \"Canceled\", and \"Failed\".""" + items: Required[list["AssignmentItem"]] + """List of resources included in this workspace manager assignment. Required.""" + + +class WorkspaceManagerConfiguration(ProxyResource): + """The workspace manager configuration. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar properties: The workspace manager configuration object. + :vartype properties: "WorkspaceManagerConfigurationProperties" + :ivar etag: Resource Etag. + :vartype etag: str + """ + + properties: "WorkspaceManagerConfigurationProperties" + """The workspace manager configuration object.""" + etag: str + """Resource Etag.""" + + +class WorkspaceManagerConfigurationProperties(TypedDict, total=False): + """The workspace manager configuration properties. + + :ivar mode: The current mode of the workspace manager configuration. Required. Known values + are: "Enabled" and "Disabled". + :vartype mode: Union[str, "Mode"] + """ + + mode: Required[Union[str, "Mode"]] + """The current mode of the workspace manager configuration. Required. Known values are: + \"Enabled\" and \"Disabled\".""" + + +class WorkspaceManagerGroup(ProxyResource): + """The workspace manager group. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar properties: The workspace manager group object. + :vartype properties: "WorkspaceManagerGroupProperties" + :ivar etag: Resource Etag. + :vartype etag: str + """ + + properties: "WorkspaceManagerGroupProperties" + """The workspace manager group object.""" + etag: str + """Resource Etag.""" + + +class WorkspaceManagerGroupProperties(TypedDict, total=False): + """The workspace manager group properties. + + :ivar description: The description of the workspace manager group. + :vartype description: str + :ivar displayName: The display name of the workspace manager group. Required. + :vartype displayName: str + :ivar memberResourceNames: The names of the workspace manager members participating in this + group. Required. + :vartype memberResourceNames: list[str] + """ + + description: str + """The description of the workspace manager group.""" + displayName: Required[str] + """The display name of the workspace manager group. Required.""" + memberResourceNames: Required[list[str]] + """The names of the workspace manager members participating in this group. Required.""" + + +class WorkspaceManagerMember(ProxyResource): + """The workspace manager member. + + :ivar id: Fully qualified resource ID for the resource. Ex - + /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. + :vartype id: str + :ivar name: The name of the resource. + :vartype name: str + :ivar type: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or + "Microsoft.Storage/storageAccounts". + :vartype type: str + :ivar systemData: Azure Resource Manager metadata containing createdBy and modifiedBy + information. + :vartype systemData: "SystemData" + :ivar properties: The workspace manager member object. + :vartype properties: "WorkspaceManagerMemberProperties" + :ivar etag: Resource Etag. + :vartype etag: str + """ + + properties: "WorkspaceManagerMemberProperties" + """The workspace manager member object.""" + etag: str + """Resource Etag.""" + + +class WorkspaceManagerMemberProperties(TypedDict, total=False): + """The workspace manager member properties. + + :ivar targetWorkspaceResourceId: Fully qualified resource ID of the target Sentinel workspace + joining the given Sentinel workspace manager. Required. + :vartype targetWorkspaceResourceId: str + :ivar targetWorkspaceTenantId: Tenant id of the target Sentinel workspace joining the given + Sentinel workspace manager. Required. + :vartype targetWorkspaceTenantId: str + """ + + targetWorkspaceResourceId: Required[str] + """Fully qualified resource ID of the target Sentinel workspace joining the given Sentinel + workspace manager. Required.""" + targetWorkspaceTenantId: Required[str] + """Tenant id of the target Sentinel workspace joining the given Sentinel workspace manager. + Required.""" + + +DataConnectorsCheckRequirements = Union[ + AwsCloudTrailCheckRequirements, + AwsS3CheckRequirements, + AADCheckRequirements, + AATPCheckRequirements, + ASCCheckRequirements, + Dynamics365CheckRequirements, + IoTCheckRequirements, + MCASCheckRequirements, + MDATPCheckRequirements, + MicrosoftPurviewInformationProtectionCheckRequirements, + MSTICheckRequirements, + MtpCheckRequirements, + Office365ProjectCheckRequirements, + OfficeATPCheckRequirements, + OfficeIRMCheckRequirements, + OfficePowerBICheckRequirements, + PurviewAuditCheckRequirements, + TICheckRequirements, + TiTaxiiCheckRequirements, +] +DataConnector = Union[ + CodelessApiPollingDataConnector, + AwsCloudTrailDataConnector, + AwsS3DataConnector, + AADDataConnector, + AATPDataConnector, + ASCDataConnector, + Dynamics365DataConnector, + GCPDataConnector, + CodelessUiDataConnector, + IoTDataConnector, + MCASDataConnector, + MDATPDataConnector, + MicrosoftPurviewInformationProtectionDataConnector, + MSTIDataConnector, + MTPDataConnector, + OfficeDataConnector, + Office365ProjectDataConnector, + OfficeATPDataConnector, + OfficeIRMDataConnector, + OfficePowerBIDataConnector, + PremiumMicrosoftDefenderForThreatIntelligence, + PurviewAuditDataConnector, + RestApiPollerDataConnector, + TIDataConnector, + TiTaxiiDataConnector, +] +CustomEntityQuery = Union[ActivityCustomEntityQuery] +AlertRule = Union[ + FusionAlertRule, + MLBehaviorAnalyticsAlertRule, + MicrosoftSecurityIncidentCreationAlertRule, + NrtAlertRule, + ScheduledAlertRule, + ThreatIntelligenceAlertRule, +] +Settings = Union[Anomalies, EntityAnalytics, EyesOn, Ueba] +SecurityMLAnalyticsSetting = Union[AnomalySecurityMLAnalyticsSettings] +CcpAuthConfig = Union[ + ApiKeyAuthModel, + AWSAuthModel, + BasicAuthModel, + GCPAuthModel, + GitHubAuthModel, + JwtAuthModel, + NoneAuthModel, + OAuthModel, + OracleAuthModel, + GenericBlobSbsAuthModel, + SessionAuthModel, +] +AutomationRuleAction = Union[ + AutomationRuleAddIncidentTaskAction, AutomationRuleModifyPropertiesAction, AutomationRuleRunPlaybookAction +] +AutomationRuleCondition = Union[ + BooleanConditionProperties, + PropertyConditionProperties, + PropertyArrayConditionProperties, + PropertyArrayChangedConditionProperties, + PropertyChangedConditionProperties, +] +DataConnectorDefinition = Union[CustomizableConnectorDefinition] +ThreatIntelligenceInformation = Union[ThreatIntelligenceIndicatorModel] diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/append_tags_threat_intelligence.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/append_tags_threat_intelligence.py index 7144aced8e21..d442971ddb59 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/append_tags_threat_intelligence.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/append_tags_threat_intelligence.py @@ -38,6 +38,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/threatintelligence/AppendTagsThreatIntelligence.json +# x-ms-original-file: 2025-10-01-preview/threatintelligence/AppendTagsThreatIntelligence.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/automation_rules_create_or_update.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/automation_rules_create_or_update.py index 427109f878fb..929899045154 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/automation_rules_create_or_update.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/automation_rules_create_or_update.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/automationRules/AutomationRules_CreateOrUpdate.json +# x-ms-original-file: 2025-10-01-preview/automationRules/AutomationRules_CreateOrUpdate.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/automation_rules_delete.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/automation_rules_delete.py index ee56d623dc6f..f4e7e25fdff2 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/automation_rules_delete.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/automation_rules_delete.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/automationRules/AutomationRules_Delete.json +# x-ms-original-file: 2025-10-01-preview/automationRules/AutomationRules_Delete.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/automation_rules_get.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/automation_rules_get.py index 49e7b7bba2f4..aa0aec0a0dbe 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/automation_rules_get.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/automation_rules_get.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/automationRules/AutomationRules_Get.json +# x-ms-original-file: 2025-10-01-preview/automationRules/AutomationRules_Get.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/automation_rules_list.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/automation_rules_list.py index 332d0749b359..98a792405dfc 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/automation_rules_list.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/automation_rules_list.py @@ -38,6 +38,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/automationRules/AutomationRules_List.json +# x-ms-original-file: 2025-10-01-preview/automationRules/AutomationRules_List.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_azure_active_directory.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_azure_active_directory.py index 33ae25a8d24a..d702bdd656ed 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_azure_active_directory.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_azure_active_directory.py @@ -41,6 +41,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/CheckRequirementsAzureActiveDirectory.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/CheckRequirementsAzureActiveDirectory.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_azure_active_directory_no_authorization.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_azure_active_directory_no_authorization.py index 196ff512d4df..6bb25f02bb34 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_azure_active_directory_no_authorization.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_azure_active_directory_no_authorization.py @@ -41,6 +41,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/CheckRequirementsAzureActiveDirectoryNoAuthorization.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/CheckRequirementsAzureActiveDirectoryNoAuthorization.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_azure_active_directory_no_license.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_azure_active_directory_no_license.py index e10a5144bd6c..d71c2bed3d04 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_azure_active_directory_no_license.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_azure_active_directory_no_license.py @@ -41,6 +41,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/CheckRequirementsAzureActiveDirectoryNoLicense.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/CheckRequirementsAzureActiveDirectoryNoLicense.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_azure_security_center.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_azure_security_center.py index b571d252a9ff..e41c9342787e 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_azure_security_center.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_azure_security_center.py @@ -41,6 +41,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/CheckRequirementsAzureSecurityCenter.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/CheckRequirementsAzureSecurityCenter.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_dynamics365.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_dynamics365.py index e54259e9e17c..3873685cc8eb 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_dynamics365.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_dynamics365.py @@ -41,6 +41,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/CheckRequirementsDynamics365.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/CheckRequirementsDynamics365.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_io_t.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_io_t.py index 3affccd3df48..197777281340 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_io_t.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_io_t.py @@ -41,6 +41,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/CheckRequirementsIoT.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/CheckRequirementsIoT.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_mdatp.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_mdatp.py index ef57268dcc02..59e51c80df7f 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_mdatp.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_mdatp.py @@ -41,6 +41,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/CheckRequirementsMdatp.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/CheckRequirementsMdatp.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_microsoft_cloud_app_security.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_microsoft_cloud_app_security.py index f9536193eeef..c6a41a801f2b 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_microsoft_cloud_app_security.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_microsoft_cloud_app_security.py @@ -41,6 +41,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/CheckRequirementsMicrosoftCloudAppSecurity.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/CheckRequirementsMicrosoftCloudAppSecurity.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_microsoft_purview_information_protection.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_microsoft_purview_information_protection.py index 443e6a371a78..86581ea89370 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_microsoft_purview_information_protection.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_microsoft_purview_information_protection.py @@ -41,6 +41,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/CheckRequirementsMicrosoftPurviewInformationProtection.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/CheckRequirementsMicrosoftPurviewInformationProtection.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_microsoft_threat_intelligence.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_microsoft_threat_intelligence.py index 6fb2387583a1..4baf04128a36 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_microsoft_threat_intelligence.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_microsoft_threat_intelligence.py @@ -41,6 +41,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/CheckRequirementsMicrosoftThreatIntelligence.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/CheckRequirementsMicrosoftThreatIntelligence.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_microsoft_threat_protection.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_microsoft_threat_protection.py index 061049e623ba..df09b8347d89 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_microsoft_threat_protection.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_microsoft_threat_protection.py @@ -41,6 +41,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/CheckRequirementsMicrosoftThreatProtection.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/CheckRequirementsMicrosoftThreatProtection.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_office365_project.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_office365_project.py index c969d0a88f28..9056bed0a566 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_office365_project.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_office365_project.py @@ -41,6 +41,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/CheckRequirementsOffice365Project.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/CheckRequirementsOffice365Project.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_office_atp.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_office_atp.py index 596a2a81fa16..271b331042a0 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_office_atp.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_office_atp.py @@ -41,6 +41,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/CheckRequirementsOfficeATP.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/CheckRequirementsOfficeATP.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_office_irm.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_office_irm.py index fdcefb0ba4ce..a04a412d9a61 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_office_irm.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_office_irm.py @@ -41,6 +41,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/CheckRequirementsOfficeIRM.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/CheckRequirementsOfficeIRM.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_office_power_bi.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_office_power_bi.py index 7bd69e1d6c91..e22c8e7be7c8 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_office_power_bi.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_office_power_bi.py @@ -41,6 +41,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/CheckRequirementsOfficePowerBI.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/CheckRequirementsOfficePowerBI.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_purview_audit.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_purview_audit.py index a2f2c368c51a..5cc948a733d3 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_purview_audit.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_purview_audit.py @@ -41,6 +41,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/CheckRequirementsPurviewAudit.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/CheckRequirementsPurviewAudit.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_threat_intelligence.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_threat_intelligence.py index e0c720d8bd1f..27cf844d0041 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_threat_intelligence.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_threat_intelligence.py @@ -41,6 +41,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/CheckRequirementsThreatIntelligence.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/CheckRequirementsThreatIntelligence.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_threat_intelligence_taxii.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_threat_intelligence_taxii.py index 424ea57ad13b..f2f315e11006 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_threat_intelligence_taxii.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/check_requirements_threat_intelligence_taxii.py @@ -41,6 +41,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/CheckRequirementsThreatIntelligenceTaxii.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/CheckRequirementsThreatIntelligenceTaxii.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/collect_threat_intelligence_metrics.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/collect_threat_intelligence_metrics.py index 01de7880b110..54392a90c18e 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/collect_threat_intelligence_metrics.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/collect_threat_intelligence_metrics.py @@ -37,6 +37,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/threatintelligence/CollectThreatIntelligenceMetrics.json +# x-ms-original-file: 2025-10-01-preview/threatintelligence/CollectThreatIntelligenceMetrics.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/connect_api_polling.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/connect_api_polling.py index fd53604149c5..2df175890426 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/connect_api_polling.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/connect_api_polling.py @@ -49,6 +49,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/ConnectAPIPolling.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/ConnectAPIPolling.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/connect_api_polling_v2_logs.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/connect_api_polling_v2_logs.py index bfb5ff99c89c..c6cb601fddb6 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/connect_api_polling_v2_logs.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/connect_api_polling_v2_logs.py @@ -52,6 +52,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/ConnectAPIPollingV2Logs.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/ConnectAPIPollingV2Logs.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_action_of_alert_rule.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_action_of_alert_rule.py index 18ee8397814a..11dba4c17f8d 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_action_of_alert_rule.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_action_of_alert_rule.py @@ -47,6 +47,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/actions/CreateActionOfAlertRule.json +# x-ms-original-file: 2025-10-01-preview/actions/CreateActionOfAlertRule.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_anomaly_security_ml_analytics_setting.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_anomaly_security_ml_analytics_setting.py index 4c1e31b6ca2e..64ead18993ac 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_anomaly_security_ml_analytics_setting.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_anomaly_security_ml_analytics_setting.py @@ -94,6 +94,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/securityMLAnalyticsSettings/CreateAnomalySecurityMLAnalyticsSetting.json +# x-ms-original-file: 2025-10-01-preview/securityMLAnalyticsSettings/CreateAnomalySecurityMLAnalyticsSetting.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_api_polling.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_api_polling.py index ee70cc6508a0..a45bf3a964b7 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_api_polling.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_api_polling.py @@ -123,6 +123,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/CreateAPIPolling.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/CreateAPIPolling.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_bookmark.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_bookmark.py index 0d72b4559747..646e9c1829ce 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_bookmark.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_bookmark.py @@ -60,6 +60,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/bookmarks/CreateBookmark.json +# x-ms-original-file: 2025-10-01-preview/bookmarks/CreateBookmark.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_bookmark_relation.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_bookmark_relation.py index af00a5349372..871f6624a994 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_bookmark_relation.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_bookmark_relation.py @@ -45,6 +45,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/bookmarks/relations/CreateBookmarkRelation.json +# x-ms-original-file: 2025-10-01-preview/bookmarks/relations/CreateBookmarkRelation.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_customizable_data_connector_definition.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_customizable_data_connector_definition.py index ae9527e1ca32..ee56a0fc21f1 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_customizable_data_connector_definition.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_customizable_data_connector_definition.py @@ -106,6 +106,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectorDefinitions/CreateCustomizableDataConnectorDefinition.json +# x-ms-original-file: 2025-10-01-preview/dataConnectorDefinitions/CreateCustomizableDataConnectorDefinition.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_dynamics365_data_connetor.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_dynamics365_data_connetor.py index f225486e8896..360bc87397ef 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_dynamics365_data_connetor.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_dynamics365_data_connetor.py @@ -46,6 +46,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/CreateDynamics365DataConnetor.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/CreateDynamics365DataConnetor.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_entity_query_activity.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_entity_query_activity.py index 3c900baebf9c..b40ef7b206b9 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_entity_query_activity.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_entity_query_activity.py @@ -61,6 +61,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/entityQueries/CreateEntityQueryActivity.json +# x-ms-original-file: 2025-10-01-preview/entityQueries/CreateEntityQueryActivity.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_file_import.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_file_import.py index 6853720bbe0d..4b78da7fdf8e 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_file_import.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_file_import.py @@ -46,6 +46,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/fileImports/CreateFileImport.json +# x-ms-original-file: 2025-10-01-preview/fileImports/CreateFileImport.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_fusion_alert_rule.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_fusion_alert_rule.py index 6d9ce0ba4c60..fd3d735cc4d6 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_fusion_alert_rule.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_fusion_alert_rule.py @@ -175,6 +175,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/alertRules/CreateFusionAlertRule.json +# x-ms-original-file: 2025-10-01-preview/alertRules/CreateFusionAlertRule.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_fusion_alert_rule_with_fusion_scenario_exclusion.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_fusion_alert_rule_with_fusion_scenario_exclusion.py index 20021ca93289..794ea94a6875 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_fusion_alert_rule_with_fusion_scenario_exclusion.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_fusion_alert_rule_with_fusion_scenario_exclusion.py @@ -175,6 +175,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/alertRules/CreateFusionAlertRuleWithFusionScenarioExclusion.json +# x-ms-original-file: 2025-10-01-preview/alertRules/CreateFusionAlertRuleWithFusionScenarioExclusion.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_generic_ui.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_generic_ui.py index 8d91b797f896..379b301c705c 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_generic_ui.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_generic_ui.py @@ -158,6 +158,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/CreateGenericUI.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/CreateGenericUI.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_google_cloud_platform.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_google_cloud_platform.py index 51b7ebb23fd9..1ea9662f61ae 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_google_cloud_platform.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_google_cloud_platform.py @@ -57,6 +57,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/CreateGoogleCloudPlatform.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/CreateGoogleCloudPlatform.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_hunt.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_hunt.py index 33a3e62cf1b4..855f1d63c8fc 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_hunt.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_hunt.py @@ -50,6 +50,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/hunts/CreateHunt.json +# x-ms-original-file: 2025-10-01-preview/hunts/CreateHunt.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_hunt_comment.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_hunt_comment.py index 094b79b1db2e..56df072c189d 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_hunt_comment.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_hunt_comment.py @@ -40,6 +40,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/hunts/CreateHuntComment.json +# x-ms-original-file: 2025-10-01-preview/hunts/CreateHuntComment.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_hunt_relation.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_hunt_relation.py index 40f20e5f008d..cca4f47deb9f 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_hunt_relation.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_hunt_relation.py @@ -46,6 +46,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/hunts/CreateHuntRelation.json +# x-ms-original-file: 2025-10-01-preview/hunts/CreateHuntRelation.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_incident_relation.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_incident_relation.py index 6306e8770b8b..259feb3cd7bf 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_incident_relation.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_incident_relation.py @@ -45,6 +45,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/incidents/relations/CreateIncidentRelation.json +# x-ms-original-file: 2025-10-01-preview/incidents/relations/CreateIncidentRelation.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_job.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_job.py index 4f73ce1f2eed..d70f0987d730 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_job.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_job.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/workspaceManagerAssignments/CreateJob.json +# x-ms-original-file: 2025-10-01-preview/workspaceManagerAssignments/CreateJob.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_microsoft_purview_information_protection_data_connetor.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_microsoft_purview_information_protection_data_connetor.py index 808b8cc2eee7..5aa8561da7de 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_microsoft_purview_information_protection_data_connetor.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_microsoft_purview_information_protection_data_connetor.py @@ -46,6 +46,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/CreateMicrosoftPurviewInformationProtectionDataConnetor.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/CreateMicrosoftPurviewInformationProtectionDataConnetor.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_microsoft_security_incident_creation_alert_rule.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_microsoft_security_incident_creation_alert_rule.py index 8eb2c7e1b13b..ac59058dfc03 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_microsoft_security_incident_creation_alert_rule.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_microsoft_security_incident_creation_alert_rule.py @@ -47,6 +47,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/alertRules/CreateMicrosoftSecurityIncidentCreationAlertRule.json +# x-ms-original-file: 2025-10-01-preview/alertRules/CreateMicrosoftSecurityIncidentCreationAlertRule.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_microsoft_threat_intelligence_data_connector.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_microsoft_threat_intelligence_data_connector.py index 1f3de33341a4..34f8d5f26ec8 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_microsoft_threat_intelligence_data_connector.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_microsoft_threat_intelligence_data_connector.py @@ -47,6 +47,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/CreateMicrosoftThreatIntelligenceDataConnector.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/CreateMicrosoftThreatIntelligenceDataConnector.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_microsoft_threat_protection_data_connetor.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_microsoft_threat_protection_data_connetor.py index 21a5f620ba99..f07d1a11c72e 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_microsoft_threat_protection_data_connetor.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_microsoft_threat_protection_data_connetor.py @@ -47,6 +47,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/CreateMicrosoftThreatProtectionDataConnetor.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/CreateMicrosoftThreatProtectionDataConnetor.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_nrt_alert_rule.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_nrt_alert_rule.py index 2cf1919132eb..9ae3ae119d47 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_nrt_alert_rule.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_nrt_alert_rule.py @@ -65,6 +65,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/alertRules/CreateNrtAlertRule.json +# x-ms-original-file: 2025-10-01-preview/alertRules/CreateNrtAlertRule.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_office365_project_data_connetor.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_office365_project_data_connetor.py index c8724265a393..3f3642bc3d3e 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_office365_project_data_connetor.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_office365_project_data_connetor.py @@ -46,6 +46,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/CreateOffice365ProjectDataConnetor.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/CreateOffice365ProjectDataConnetor.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_office_data_connetor.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_office_data_connetor.py index 8dafa9957a2c..27eba6b88232 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_office_data_connetor.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_office_data_connetor.py @@ -50,6 +50,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/CreateOfficeDataConnetor.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/CreateOfficeDataConnetor.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_office_power_bi_data_connector.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_office_power_bi_data_connector.py index 92ae99ee710a..7b21ac0e3995 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_office_power_bi_data_connector.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_office_power_bi_data_connector.py @@ -46,6 +46,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/CreateOfficePowerBIDataConnector.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/CreateOfficePowerBIDataConnector.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_or_update_workspace_manager_assignment.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_or_update_workspace_manager_assignment.py index 879eca8647c9..198862b60ff0 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_or_update_workspace_manager_assignment.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_or_update_workspace_manager_assignment.py @@ -52,6 +52,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/workspaceManagerAssignments/CreateOrUpdateWorkspaceManagerAssignment.json +# x-ms-original-file: 2025-10-01-preview/workspaceManagerAssignments/CreateOrUpdateWorkspaceManagerAssignment.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_or_update_workspace_manager_configuration.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_or_update_workspace_manager_configuration.py index 980a1f6a9a9f..7b1f487c194c 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_or_update_workspace_manager_configuration.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_or_update_workspace_manager_configuration.py @@ -39,6 +39,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/workspaceManagerConfigurations/CreateOrUpdateWorkspaceManagerConfiguration.json +# x-ms-original-file: 2025-10-01-preview/workspaceManagerConfigurations/CreateOrUpdateWorkspaceManagerConfiguration.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_or_update_workspace_manager_group.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_or_update_workspace_manager_group.py index 37d9321d6545..40a9f74bfdb8 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_or_update_workspace_manager_group.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_or_update_workspace_manager_group.py @@ -45,6 +45,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/workspaceManagerGroups/CreateOrUpdateWorkspaceManagerGroup.json +# x-ms-original-file: 2025-10-01-preview/workspaceManagerGroups/CreateOrUpdateWorkspaceManagerGroup.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_or_update_workspace_manager_member.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_or_update_workspace_manager_member.py index e58f5f628c57..3957fa79f244 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_or_update_workspace_manager_member.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_or_update_workspace_manager_member.py @@ -45,6 +45,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/workspaceManagerMembers/CreateOrUpdateWorkspaceManagerMember.json +# x-ms-original-file: 2025-10-01-preview/workspaceManagerMembers/CreateOrUpdateWorkspaceManagerMember.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_premium_microsoft_defender_for_threat_intelligence_data_connector.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_premium_microsoft_defender_for_threat_intelligence_data_connector.py index d46c9e068788..6e9baaea704f 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_premium_microsoft_defender_for_threat_intelligence_data_connector.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_premium_microsoft_defender_for_threat_intelligence_data_connector.py @@ -47,6 +47,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/CreatePremiumMicrosoftDefenderForThreatIntelligenceDataConnector.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/CreatePremiumMicrosoftDefenderForThreatIntelligenceDataConnector.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_purview_audit_data_connector.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_purview_audit_data_connector.py index 851589399a48..8a580a3e89ba 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_purview_audit_data_connector.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_purview_audit_data_connector.py @@ -54,6 +54,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/CreatePurviewAuditDataConnector.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/CreatePurviewAuditDataConnector.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_scheduled_alert_rule.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_scheduled_alert_rule.py index dee1c5cd3f91..e00eb82efb81 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_scheduled_alert_rule.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_scheduled_alert_rule.py @@ -85,6 +85,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/alertRules/CreateScheduledAlertRule.json +# x-ms-original-file: 2025-10-01-preview/alertRules/CreateScheduledAlertRule.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_sentinel_onboarding_state.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_sentinel_onboarding_state.py index e74aafbe6e31..4b5886210bbd 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_sentinel_onboarding_state.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_sentinel_onboarding_state.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/onboardingStates/CreateSentinelOnboardingState.json +# x-ms-original-file: 2025-10-01-preview/onboardingStates/CreateSentinelOnboardingState.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_source_control.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_source_control.py index 186d2dad2df8..015c69e08cad 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_source_control.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_source_control.py @@ -58,6 +58,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/sourcecontrols/CreateSourceControl.json +# x-ms-original-file: 2025-10-01-preview/sourcecontrols/CreateSourceControl.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_threat_intelligence.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_threat_intelligence.py index f086f1fe9cfb..85f8fed5110e 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_threat_intelligence.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_threat_intelligence.py @@ -59,6 +59,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/threatintelligence/CreateThreatIntelligence.json +# x-ms-original-file: 2025-10-01-preview/threatintelligence/CreateThreatIntelligence.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_threat_intelligence_data_connector.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_threat_intelligence_data_connector.py index 57db760a38a3..7a03165f450c 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_threat_intelligence_data_connector.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_threat_intelligence_data_connector.py @@ -46,6 +46,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/CreateThreatIntelligenceDataConnector.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/CreateThreatIntelligenceDataConnector.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_threat_intelligence_taxii_data_connector.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_threat_intelligence_taxii_data_connector.py index 0224b02aae5b..689a13372d77 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_threat_intelligence_taxii_data_connector.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_threat_intelligence_taxii_data_connector.py @@ -54,6 +54,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/CreateThreatIntelligenceTaxiiDataConnector.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/CreateThreatIntelligenceTaxiiDataConnector.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_watchlist.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_watchlist.py index 5e6bb0fc476b..c21337f17f47 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_watchlist.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_watchlist.py @@ -49,6 +49,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/watchlists/CreateWatchlist.json +# x-ms-original-file: 2025-10-01-preview/watchlists/CreateWatchlist.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_watchlist_and_watchlist_items.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_watchlist_and_watchlist_items.py index 56e468bffe73..d66903e58abf 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_watchlist_and_watchlist_items.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_watchlist_and_watchlist_items.py @@ -52,6 +52,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/watchlists/CreateWatchlistAndWatchlistItems.json +# x-ms-original-file: 2025-10-01-preview/watchlists/CreateWatchlistAndWatchlistItems.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_watchlist_item.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_watchlist_item.py index 0436134c84d4..7c9d2f9f50b0 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_watchlist_item.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/create_watchlist_item.py @@ -52,6 +52,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/watchlists/CreateWatchlistItem.json +# x-ms-original-file: 2025-10-01-preview/watchlists/CreateWatchlistItem.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_action_of_alert_rule.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_action_of_alert_rule.py index 0f3d86ac775b..eeeffb2b9122 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_action_of_alert_rule.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_action_of_alert_rule.py @@ -38,6 +38,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/actions/DeleteActionOfAlertRule.json +# x-ms-original-file: 2025-10-01-preview/actions/DeleteActionOfAlertRule.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_alert_rule.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_alert_rule.py index 75d377e3636a..808d48fe9ba9 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_alert_rule.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_alert_rule.py @@ -37,6 +37,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/alertRules/DeleteAlertRule.json +# x-ms-original-file: 2025-10-01-preview/alertRules/DeleteAlertRule.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_api_polling.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_api_polling.py index c3e66c47be41..98239c688a9b 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_api_polling.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_api_polling.py @@ -37,6 +37,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/DeleteAPIPolling.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/DeleteAPIPolling.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_bookmark.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_bookmark.py index c207f785f267..afab804e4c9a 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_bookmark.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_bookmark.py @@ -37,6 +37,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/bookmarks/DeleteBookmark.json +# x-ms-original-file: 2025-10-01-preview/bookmarks/DeleteBookmark.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_bookmark_relation.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_bookmark_relation.py index 8fcb58466d95..0f93274c5cb9 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_bookmark_relation.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_bookmark_relation.py @@ -38,6 +38,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/bookmarks/relations/DeleteBookmarkRelation.json +# x-ms-original-file: 2025-10-01-preview/bookmarks/relations/DeleteBookmarkRelation.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_data_connector_definition_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_data_connector_definition_by_id.py index 8d8cddd02df0..922ef608244b 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_data_connector_definition_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_data_connector_definition_by_id.py @@ -37,6 +37,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/dataConnectorDefinitions/DeleteDataConnectorDefinitionById.json +# x-ms-original-file: 2025-10-01-preview/dataConnectorDefinitions/DeleteDataConnectorDefinitionById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_entity_query.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_entity_query.py index 507e6386d20d..4a554a504d77 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_entity_query.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_entity_query.py @@ -37,6 +37,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/entityQueries/DeleteEntityQuery.json +# x-ms-original-file: 2025-10-01-preview/entityQueries/DeleteEntityQuery.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_eyes_on_setting.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_eyes_on_setting.py index f9af2d38d9af..654b846fd928 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_eyes_on_setting.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_eyes_on_setting.py @@ -37,6 +37,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/settings/DeleteEyesOnSetting.json +# x-ms-original-file: 2025-10-01-preview/settings/DeleteEyesOnSetting.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_file_import.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_file_import.py index f548c399d416..b4c0ebc1ec11 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_file_import.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_file_import.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/fileImports/DeleteFileImport.json +# x-ms-original-file: 2025-10-01-preview/fileImports/DeleteFileImport.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_generic_ui.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_generic_ui.py index 2e868eb3137c..085a18857caa 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_generic_ui.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_generic_ui.py @@ -37,6 +37,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/DeleteGenericUI.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/DeleteGenericUI.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_google_cloud_platform.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_google_cloud_platform.py index e6e77edd60cf..5aba059c03a0 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_google_cloud_platform.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_google_cloud_platform.py @@ -37,6 +37,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/DeleteGoogleCloudPlatform.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/DeleteGoogleCloudPlatform.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_hunt.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_hunt.py index b2fd6e86d0ba..69d7dc1458f3 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_hunt.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_hunt.py @@ -37,6 +37,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/hunts/DeleteHunt.json +# x-ms-original-file: 2025-10-01-preview/hunts/DeleteHunt.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_hunt_comment.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_hunt_comment.py index cb318af1bdb5..34f188f03835 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_hunt_comment.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_hunt_comment.py @@ -38,6 +38,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/hunts/DeleteHuntComment.json +# x-ms-original-file: 2025-10-01-preview/hunts/DeleteHuntComment.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_hunt_relation.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_hunt_relation.py index 37727670ff06..350bc5cb8b6b 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_hunt_relation.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_hunt_relation.py @@ -38,6 +38,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/hunts/DeleteHuntRelation.json +# x-ms-original-file: 2025-10-01-preview/hunts/DeleteHuntRelation.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_incident_relation.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_incident_relation.py index bada9b24d216..b622aa4cc42e 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_incident_relation.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_incident_relation.py @@ -38,6 +38,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/incidents/relations/DeleteIncidentRelation.json +# x-ms-original-file: 2025-10-01-preview/incidents/relations/DeleteIncidentRelation.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_job.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_job.py index 5ee8357cff98..991039ef0225 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_job.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_job.py @@ -38,6 +38,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/workspaceManagerAssignments/DeleteJob.json +# x-ms-original-file: 2025-10-01-preview/workspaceManagerAssignments/DeleteJob.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_metadata.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_metadata.py index e5e874a96ecb..308484ae3597 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_metadata.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_metadata.py @@ -37,6 +37,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/metadata/DeleteMetadata.json +# x-ms-original-file: 2025-10-01-preview/metadata/DeleteMetadata.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_microsoft_purview_information_protection_data_connetor.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_microsoft_purview_information_protection_data_connetor.py index 5772c76f8d6f..ca9e6f585e83 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_microsoft_purview_information_protection_data_connetor.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_microsoft_purview_information_protection_data_connetor.py @@ -37,6 +37,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/DeleteMicrosoftPurviewInformationProtectionDataConnetor.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/DeleteMicrosoftPurviewInformationProtectionDataConnetor.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_microsoft_threat_intelligence_data_connector.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_microsoft_threat_intelligence_data_connector.py index f49c4c1a6145..9c7770b4b673 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_microsoft_threat_intelligence_data_connector.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_microsoft_threat_intelligence_data_connector.py @@ -37,6 +37,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/DeleteMicrosoftThreatIntelligenceDataConnector.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/DeleteMicrosoftThreatIntelligenceDataConnector.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_office365_project_data_connetor.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_office365_project_data_connetor.py index acfe29af0188..6e4d5e268425 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_office365_project_data_connetor.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_office365_project_data_connetor.py @@ -37,6 +37,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/DeleteOffice365ProjectDataConnetor.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/DeleteOffice365ProjectDataConnetor.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_office_consents.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_office_consents.py index f37ac81d54e2..58a8e069be75 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_office_consents.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_office_consents.py @@ -37,6 +37,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/officeConsents/DeleteOfficeConsents.json +# x-ms-original-file: 2025-10-01-preview/officeConsents/DeleteOfficeConsents.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_office_data_connetor.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_office_data_connetor.py index fbc66ff7bfaf..166524399e7f 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_office_data_connetor.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_office_data_connetor.py @@ -37,6 +37,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/DeleteOfficeDataConnetor.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/DeleteOfficeDataConnetor.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_office_power_bi_data_connetor.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_office_power_bi_data_connetor.py index 7eade452c9ba..a2e4c0537eef 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_office_power_bi_data_connetor.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_office_power_bi_data_connetor.py @@ -37,6 +37,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/DeleteOfficePowerBIDataConnetor.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/DeleteOfficePowerBIDataConnetor.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_premium_microsoft_defender_for_threat_intelligence_data_connector.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_premium_microsoft_defender_for_threat_intelligence_data_connector.py index 3c04fae2df58..ed7bef03781b 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_premium_microsoft_defender_for_threat_intelligence_data_connector.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_premium_microsoft_defender_for_threat_intelligence_data_connector.py @@ -38,6 +38,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/DeletePremiumMicrosoftDefenderForThreatIntelligenceDataConnector.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/DeletePremiumMicrosoftDefenderForThreatIntelligenceDataConnector.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_purview_audit_data_connector.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_purview_audit_data_connector.py index a5cc2e9174f2..97a15db835c4 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_purview_audit_data_connector.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_purview_audit_data_connector.py @@ -37,6 +37,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/DeletePurviewAuditDataConnector.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/DeletePurviewAuditDataConnector.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_security_ml_analytics_setting.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_security_ml_analytics_setting.py index 6e110310c11b..94fcefdaabd4 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_security_ml_analytics_setting.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_security_ml_analytics_setting.py @@ -37,6 +37,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/securityMLAnalyticsSettings/DeleteSecurityMLAnalyticsSetting.json +# x-ms-original-file: 2025-10-01-preview/securityMLAnalyticsSettings/DeleteSecurityMLAnalyticsSetting.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_sentinel_onboarding_state.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_sentinel_onboarding_state.py index 2b210793992f..894d0531e355 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_sentinel_onboarding_state.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_sentinel_onboarding_state.py @@ -37,6 +37,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/onboardingStates/DeleteSentinelOnboardingState.json +# x-ms-original-file: 2025-10-01-preview/onboardingStates/DeleteSentinelOnboardingState.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_source_control.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_source_control.py index c77754acca05..87021ab5ee7f 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_source_control.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_source_control.py @@ -48,6 +48,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/sourcecontrols/DeleteSourceControl.json +# x-ms-original-file: 2025-10-01-preview/sourcecontrols/DeleteSourceControl.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_template.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_template.py index e820baa0bd84..66c4ad884ab0 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_template.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_template.py @@ -37,6 +37,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/contentTemplates/DeleteTemplate.json +# x-ms-original-file: 2025-10-01-preview/contentTemplates/DeleteTemplate.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_threat_intelligence.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_threat_intelligence.py index 02d1b80039d5..d422d27db40a 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_threat_intelligence.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_threat_intelligence.py @@ -37,6 +37,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/threatintelligence/DeleteThreatIntelligence.json +# x-ms-original-file: 2025-10-01-preview/threatintelligence/DeleteThreatIntelligence.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_watchlist.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_watchlist.py index a726a47297ec..6a80c6f20f75 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_watchlist.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_watchlist.py @@ -30,13 +30,14 @@ def main(): subscription_id="SUBSCRIPTION_ID", ) - client.watchlists.begin_delete( + response = client.watchlists.begin_delete( resource_group_name="myRg", workspace_name="myWorkspace", watchlist_alias="highValueAsset", ).result() + print(response) -# x-ms-original-file: 2025-07-01-preview/watchlists/DeleteWatchlist.json +# x-ms-original-file: 2025-10-01-preview/watchlists/DeleteWatchlist.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_watchlist_item.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_watchlist_item.py index 65798a9c8cc3..3b990461bce3 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_watchlist_item.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_watchlist_item.py @@ -38,6 +38,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/watchlists/DeleteWatchlistItem.json +# x-ms-original-file: 2025-10-01-preview/watchlists/DeleteWatchlistItem.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_workspace_manager_assignment.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_workspace_manager_assignment.py index c8f672bbf815..e164f5b4f408 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_workspace_manager_assignment.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_workspace_manager_assignment.py @@ -37,6 +37,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/workspaceManagerAssignments/DeleteWorkspaceManagerAssignment.json +# x-ms-original-file: 2025-10-01-preview/workspaceManagerAssignments/DeleteWorkspaceManagerAssignment.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_workspace_manager_configuration.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_workspace_manager_configuration.py index 0f38c594c166..1ffd1aa53b28 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_workspace_manager_configuration.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_workspace_manager_configuration.py @@ -37,6 +37,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/workspaceManagerConfigurations/DeleteWorkspaceManagerConfiguration.json +# x-ms-original-file: 2025-10-01-preview/workspaceManagerConfigurations/DeleteWorkspaceManagerConfiguration.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_workspace_manager_group.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_workspace_manager_group.py index 7174954be60b..69829d127525 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_workspace_manager_group.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_workspace_manager_group.py @@ -37,6 +37,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/workspaceManagerGroups/DeleteWorkspaceManagerGroup.json +# x-ms-original-file: 2025-10-01-preview/workspaceManagerGroups/DeleteWorkspaceManagerGroup.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_workspace_manager_member.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_workspace_manager_member.py index e374ee6ec8c9..20cd94510d83 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_workspace_manager_member.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/delete_workspace_manager_member.py @@ -37,6 +37,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/workspaceManagerMembers/DeleteWorkspaceManagerMember.json +# x-ms-original-file: 2025-10-01-preview/workspaceManagerMembers/DeleteWorkspaceManagerMember.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/disconnect_api_polling.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/disconnect_api_polling.py index eac853ff52cf..b33c156260cf 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/disconnect_api_polling.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/disconnect_api_polling.py @@ -37,6 +37,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/DisconnectAPIPolling.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/DisconnectAPIPolling.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/entities_run_playbook.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/entities_run_playbook.py index 1e0cb2eac7e4..02204b84d496 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/entities_run_playbook.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/entities_run_playbook.py @@ -37,6 +37,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/manualTrigger/Entities_RunPlaybook.json +# x-ms-original-file: 2025-10-01-preview/manualTrigger/Entities_RunPlaybook.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_account_entity_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_account_entity_by_id.py index 3991353775b7..739c74880762 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_account_entity_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_account_entity_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/entities/GetAccountEntityById.json +# x-ms-original-file: 2025-10-01-preview/entities/GetAccountEntityById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_action_of_alert_rule_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_action_of_alert_rule_by_id.py index 9e6ae4c29ff9..49cf80edb608 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_action_of_alert_rule_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_action_of_alert_rule_by_id.py @@ -39,6 +39,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/actions/GetActionOfAlertRuleById.json +# x-ms-original-file: 2025-10-01-preview/actions/GetActionOfAlertRuleById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_activity_entity_query_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_activity_entity_query_by_id.py index 6ca9a8997137..81347ecdc577 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_activity_entity_query_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_activity_entity_query_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/entityQueries/GetActivityEntityQueryById.json +# x-ms-original-file: 2025-10-01-preview/entityQueries/GetActivityEntityQueryById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_activity_entity_query_template_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_activity_entity_query_template_by_id.py index e55217ce9ca1..2731c506e608 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_activity_entity_query_template_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_activity_entity_query_template_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/entityQueryTemplates/GetActivityEntityQueryTemplateById.json +# x-ms-original-file: 2025-10-01-preview/entityQueryTemplates/GetActivityEntityQueryTemplateById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_alert_rule_template_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_alert_rule_template_by_id.py index bf8948ac274d..618c4cae0d48 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_alert_rule_template_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_alert_rule_template_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/alertRuleTemplates/GetAlertRuleTemplateById.json +# x-ms-original-file: 2025-10-01-preview/alertRuleTemplates/GetAlertRuleTemplateById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_alert_rule_templates.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_alert_rule_templates.py index f79ab696b005..f6a20489445b 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_alert_rule_templates.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_alert_rule_templates.py @@ -38,6 +38,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/alertRuleTemplates/GetAlertRuleTemplates.json +# x-ms-original-file: 2025-10-01-preview/alertRuleTemplates/GetAlertRuleTemplates.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_actions_by_alert_rule.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_actions_by_alert_rule.py index aeabfe9293ef..112f8a9a18d8 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_actions_by_alert_rule.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_actions_by_alert_rule.py @@ -39,6 +39,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/actions/GetAllActionsByAlertRule.json +# x-ms-original-file: 2025-10-01-preview/actions/GetAllActionsByAlertRule.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_alert_rules.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_alert_rules.py index 593557129259..07ae553ca724 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_alert_rules.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_alert_rules.py @@ -38,6 +38,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/alertRules/GetAllAlertRules.json +# x-ms-original-file: 2025-10-01-preview/alertRules/GetAllAlertRules.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_billing_statistics.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_billing_statistics.py index 0454b0fecf44..a436623e5eff 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_billing_statistics.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_billing_statistics.py @@ -38,6 +38,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/billingStatistics/GetAllBillingStatistics.json +# x-ms-original-file: 2025-10-01-preview/billingStatistics/GetAllBillingStatistics.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_bookmark_relations.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_bookmark_relations.py index c0256ec916a1..38d9e277c821 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_bookmark_relations.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_bookmark_relations.py @@ -39,6 +39,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/bookmarks/relations/GetAllBookmarkRelations.json +# x-ms-original-file: 2025-10-01-preview/bookmarks/relations/GetAllBookmarkRelations.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_entity_relations.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_entity_relations.py index 462b667d881c..d2cb61d0c987 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_entity_relations.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_entity_relations.py @@ -39,6 +39,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/entities/relations/GetAllEntityRelations.json +# x-ms-original-file: 2025-10-01-preview/entities/relations/GetAllEntityRelations.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_incident_relations.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_incident_relations.py index 87efa2fe8697..86b645155918 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_incident_relations.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_incident_relations.py @@ -39,6 +39,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/incidents/relations/GetAllIncidentRelations.json +# x-ms-original-file: 2025-10-01-preview/incidents/relations/GetAllIncidentRelations.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_jobs.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_jobs.py index 9774587927f3..c2d877634958 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_jobs.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_jobs.py @@ -39,6 +39,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/workspaceManagerAssignments/GetAllJobs.json +# x-ms-original-file: 2025-10-01-preview/workspaceManagerAssignments/GetAllJobs.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_metadata.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_metadata.py index 45a8726f2654..dd6e8b16590d 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_metadata.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_metadata.py @@ -38,6 +38,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/metadata/GetAllMetadata.json +# x-ms-original-file: 2025-10-01-preview/metadata/GetAllMetadata.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_metadata_odata.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_metadata_odata.py index 6f9c7217394a..91598ad43977 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_metadata_odata.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_metadata_odata.py @@ -38,6 +38,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/metadata/GetAllMetadataOData.json +# x-ms-original-file: 2025-10-01-preview/metadata/GetAllMetadataOData.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_security_ml_analytics_settings.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_security_ml_analytics_settings.py index 699e90bdc0a6..aaefdb169847 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_security_ml_analytics_settings.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_security_ml_analytics_settings.py @@ -38,6 +38,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/securityMLAnalyticsSettings/GetAllSecurityMLAnalyticsSettings.json +# x-ms-original-file: 2025-10-01-preview/securityMLAnalyticsSettings/GetAllSecurityMLAnalyticsSettings.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_sentinel_onboarding_states.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_sentinel_onboarding_states.py index a31a58bb6a45..58eb60610bb2 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_sentinel_onboarding_states.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_sentinel_onboarding_states.py @@ -37,6 +37,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/onboardingStates/GetAllSentinelOnboardingStates.json +# x-ms-original-file: 2025-10-01-preview/onboardingStates/GetAllSentinelOnboardingStates.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_settings.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_settings.py index 9ebc0914cdad..b3527b3f54f7 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_settings.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_settings.py @@ -38,6 +38,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/settings/GetAllSettings.json +# x-ms-original-file: 2025-10-01-preview/settings/GetAllSettings.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_workspace_manager_assignments.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_workspace_manager_assignments.py index f52e52550868..ea3d4060a659 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_workspace_manager_assignments.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_workspace_manager_assignments.py @@ -38,6 +38,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/workspaceManagerAssignments/GetAllWorkspaceManagerAssignments.json +# x-ms-original-file: 2025-10-01-preview/workspaceManagerAssignments/GetAllWorkspaceManagerAssignments.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_workspace_manager_configurations.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_workspace_manager_configurations.py index b6654a3542de..7fcf9df48a73 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_workspace_manager_configurations.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_workspace_manager_configurations.py @@ -38,6 +38,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/workspaceManagerConfigurations/GetAllWorkspaceManagerConfigurations.json +# x-ms-original-file: 2025-10-01-preview/workspaceManagerConfigurations/GetAllWorkspaceManagerConfigurations.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_workspace_manager_groups.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_workspace_manager_groups.py index f47a8b6446f5..927b3ab5eb3d 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_workspace_manager_groups.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_workspace_manager_groups.py @@ -38,6 +38,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/workspaceManagerGroups/GetAllWorkspaceManagerGroups.json +# x-ms-original-file: 2025-10-01-preview/workspaceManagerGroups/GetAllWorkspaceManagerGroups.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_workspace_manager_members.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_workspace_manager_members.py index baa829e856e7..071400c101fd 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_workspace_manager_members.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_all_workspace_manager_members.py @@ -38,6 +38,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/workspaceManagerMembers/GetAllWorkspaceManagerMembers.json +# x-ms-original-file: 2025-10-01-preview/workspaceManagerMembers/GetAllWorkspaceManagerMembers.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_amazon_web_services_cloud_trail_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_amazon_web_services_cloud_trail_by_id.py index eed991125f05..ef645ea0a711 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_amazon_web_services_cloud_trail_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_amazon_web_services_cloud_trail_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/GetAmazonWebServicesCloudTrailById.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/GetAmazonWebServicesCloudTrailById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_amazon_web_services_s3_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_amazon_web_services_s3_by_id.py index 6ceeb070dde9..71a5d84f5db0 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_amazon_web_services_s3_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_amazon_web_services_s3_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/GetAmazonWebServicesS3ById.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/GetAmazonWebServicesS3ById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_anomaly_security_ml_analytics_setting.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_anomaly_security_ml_analytics_setting.py index 9460300a5f87..ca6f688d3865 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_anomaly_security_ml_analytics_setting.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_anomaly_security_ml_analytics_setting.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/securityMLAnalyticsSettings/GetAnomalySecurityMLAnalyticsSetting.json +# x-ms-original-file: 2025-10-01-preview/securityMLAnalyticsSettings/GetAnomalySecurityMLAnalyticsSetting.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_api_polling.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_api_polling.py index b98a5b235490..d7ec878e73e2 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_api_polling.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_api_polling.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/GetAPIPolling.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/GetAPIPolling.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_azure_active_directory_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_azure_active_directory_by_id.py index 9434d4a61bd0..17fbf6aac794 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_azure_active_directory_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_azure_active_directory_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/GetAzureActiveDirectoryById.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/GetAzureActiveDirectoryById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_azure_advanced_threat_protection_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_azure_advanced_threat_protection_by_id.py index 140f6806b2d7..7186fc90ef39 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_azure_advanced_threat_protection_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_azure_advanced_threat_protection_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/GetAzureAdvancedThreatProtectionById.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/GetAzureAdvancedThreatProtectionById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_azure_resource_entity_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_azure_resource_entity_by_id.py index 833cffeabbf0..ed7af655e3db 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_azure_resource_entity_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_azure_resource_entity_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/entities/GetAzureResourceEntityById.json +# x-ms-original-file: 2025-10-01-preview/entities/GetAzureResourceEntityById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_azure_security_center_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_azure_security_center_by_id.py index c9210ff5ec36..2b42d4ab957b 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_azure_security_center_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_azure_security_center_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/GetAzureSecurityCenterById.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/GetAzureSecurityCenterById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_billing_statistic.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_billing_statistic.py index 82bd21d1102f..93a27d04fa57 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_billing_statistic.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_billing_statistic.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/billingStatistics/GetBillingStatistic.json +# x-ms-original-file: 2025-10-01-preview/billingStatistics/GetBillingStatistic.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_bookmark_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_bookmark_by_id.py index 89d7024c25cf..ec1268827c9c 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_bookmark_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_bookmark_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/bookmarks/GetBookmarkById.json +# x-ms-original-file: 2025-10-01-preview/bookmarks/GetBookmarkById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_bookmark_relation_by_name.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_bookmark_relation_by_name.py index cd689bf60792..1a9356a3345e 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_bookmark_relation_by_name.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_bookmark_relation_by_name.py @@ -39,6 +39,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/bookmarks/relations/GetBookmarkRelationByName.json +# x-ms-original-file: 2025-10-01-preview/bookmarks/relations/GetBookmarkRelationByName.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_bookmarks.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_bookmarks.py index 4e91ecbae16b..6157f36ef814 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_bookmarks.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_bookmarks.py @@ -38,6 +38,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/bookmarks/GetBookmarks.json +# x-ms-original-file: 2025-10-01-preview/bookmarks/GetBookmarks.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_cloud_application_entity_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_cloud_application_entity_by_id.py index 54c0e2bc0393..3311dedeb68b 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_cloud_application_entity_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_cloud_application_entity_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/entities/GetCloudApplicationEntityById.json +# x-ms-original-file: 2025-10-01-preview/entities/GetCloudApplicationEntityById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_customizable_data_connector_definition_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_customizable_data_connector_definition_by_id.py index 44dd5be40a16..6438435a46ab 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_customizable_data_connector_definition_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_customizable_data_connector_definition_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectorDefinitions/GetCustomizableDataConnectorDefinitionById.json +# x-ms-original-file: 2025-10-01-preview/dataConnectorDefinitions/GetCustomizableDataConnectorDefinitionById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_data_connector_definitions.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_data_connector_definitions.py index b174a9b1197d..8fc2cbd27f5e 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_data_connector_definitions.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_data_connector_definitions.py @@ -38,6 +38,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/dataConnectorDefinitions/GetDataConnectorDefinitions.json +# x-ms-original-file: 2025-10-01-preview/dataConnectorDefinitions/GetDataConnectorDefinitions.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_data_connectors.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_data_connectors.py index 44bb6661801b..24b149216450 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_data_connectors.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_data_connectors.py @@ -38,6 +38,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/GetDataConnectors.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/GetDataConnectors.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_dns_entity_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_dns_entity_by_id.py index 136128ee8f5a..d4f27abe344a 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_dns_entity_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_dns_entity_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/entities/GetDnsEntityById.json +# x-ms-original-file: 2025-10-01-preview/entities/GetDnsEntityById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_dynamics365_data_connector_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_dynamics365_data_connector_by_id.py index 6dd91d1cc658..6aec3bc170d3 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_dynamics365_data_connector_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_dynamics365_data_connector_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/GetDynamics365DataConnectorById.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/GetDynamics365DataConnectorById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_entities.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_entities.py index d352459b6076..b4b18973365c 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_entities.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_entities.py @@ -38,6 +38,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/entities/GetEntities.json +# x-ms-original-file: 2025-10-01-preview/entities/GetEntities.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_entity_queries.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_entity_queries.py index e6af139d9aee..92e01d627204 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_entity_queries.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_entity_queries.py @@ -38,6 +38,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/entityQueries/GetEntityQueries.json +# x-ms-original-file: 2025-10-01-preview/entityQueries/GetEntityQueries.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_entity_query_templates.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_entity_query_templates.py index c96403d3fe4c..6dd082036960 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_entity_query_templates.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_entity_query_templates.py @@ -38,6 +38,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/entityQueryTemplates/GetEntityQueryTemplates.json +# x-ms-original-file: 2025-10-01-preview/entityQueryTemplates/GetEntityQueryTemplates.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_entity_relation_by_name.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_entity_relation_by_name.py index 6a34760f61ef..8f3788303bf4 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_entity_relation_by_name.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_entity_relation_by_name.py @@ -39,6 +39,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/entities/relations/GetEntityRelationByName.json +# x-ms-original-file: 2025-10-01-preview/entities/relations/GetEntityRelationByName.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_expansion_entity_query_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_expansion_entity_query_by_id.py index ab469ba035fa..a9cfba7e23ff 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_expansion_entity_query_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_expansion_entity_query_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/entityQueries/GetExpansionEntityQueryById.json +# x-ms-original-file: 2025-10-01-preview/entityQueries/GetExpansionEntityQueryById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_eyes_on_setting.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_eyes_on_setting.py index 84c794aa3176..54248cf023a2 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_eyes_on_setting.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_eyes_on_setting.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/settings/GetEyesOnSetting.json +# x-ms-original-file: 2025-10-01-preview/settings/GetEyesOnSetting.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_file_entity_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_file_entity_by_id.py index 6873b4de5df2..f0a703c49e90 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_file_entity_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_file_entity_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/entities/GetFileEntityById.json +# x-ms-original-file: 2025-10-01-preview/entities/GetFileEntityById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_file_hash_entity_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_file_hash_entity_by_id.py index dbd57c5a139c..87f1b4759c0c 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_file_hash_entity_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_file_hash_entity_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/entities/GetFileHashEntityById.json +# x-ms-original-file: 2025-10-01-preview/entities/GetFileHashEntityById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_file_import_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_file_import_by_id.py index b11db9c71d87..888f916abbb8 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_file_import_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_file_import_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/fileImports/GetFileImportById.json +# x-ms-original-file: 2025-10-01-preview/fileImports/GetFileImportById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_file_imports.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_file_imports.py index c0cdafd08a1f..339d1079f7e8 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_file_imports.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_file_imports.py @@ -38,6 +38,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/fileImports/GetFileImports.json +# x-ms-original-file: 2025-10-01-preview/fileImports/GetFileImports.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_fusion_alert_rule.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_fusion_alert_rule.py index 02e6c7f1d34c..c83a8161e3d4 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_fusion_alert_rule.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_fusion_alert_rule.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/alertRules/GetFusionAlertRule.json +# x-ms-original-file: 2025-10-01-preview/alertRules/GetFusionAlertRule.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_generic_ui.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_generic_ui.py index 8eb7172ccc8f..9845113a32d0 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_generic_ui.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_generic_ui.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/GetGenericUI.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/GetGenericUI.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_geodata_with_workspace_by_ip.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_geodata_with_workspace_by_ip.py index 5c8b706650b5..cf8f401b0f2a 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_geodata_with_workspace_by_ip.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_geodata_with_workspace_by_ip.py @@ -39,6 +39,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/enrichment/GetGeodataWithWorkspaceByIp.json +# x-ms-original-file: 2025-10-01-preview/enrichment/GetGeodataWithWorkspaceByIp.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_google_cloud_platform_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_google_cloud_platform_by_id.py index 902f9ba5d09c..07bd442a0bb2 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_google_cloud_platform_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_google_cloud_platform_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/GetGoogleCloudPlatformById.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/GetGoogleCloudPlatformById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_host_entity_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_host_entity_by_id.py index 170c15ce96da..bba428a42218 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_host_entity_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_host_entity_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/entities/GetHostEntityById.json +# x-ms-original-file: 2025-10-01-preview/entities/GetHostEntityById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_hunt_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_hunt_by_id.py index 598646fc6f46..9de9d26be308 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_hunt_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_hunt_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/hunts/GetHuntById.json +# x-ms-original-file: 2025-10-01-preview/hunts/GetHuntById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_hunt_comment_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_hunt_comment_by_id.py index ca779736b730..8e9d9a6f5365 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_hunt_comment_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_hunt_comment_by_id.py @@ -39,6 +39,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/hunts/GetHuntCommentById.json +# x-ms-original-file: 2025-10-01-preview/hunts/GetHuntCommentById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_hunt_comments.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_hunt_comments.py index 67259696541b..ed2c3a9438f9 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_hunt_comments.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_hunt_comments.py @@ -39,6 +39,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/hunts/GetHuntComments.json +# x-ms-original-file: 2025-10-01-preview/hunts/GetHuntComments.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_hunt_relation_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_hunt_relation_by_id.py index b37e05c089f9..bacd1fc9e84f 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_hunt_relation_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_hunt_relation_by_id.py @@ -39,6 +39,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/hunts/GetHuntRelationById.json +# x-ms-original-file: 2025-10-01-preview/hunts/GetHuntRelationById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_hunt_relations.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_hunt_relations.py index 68c8819b4c7f..135644780dcd 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_hunt_relations.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_hunt_relations.py @@ -39,6 +39,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/hunts/GetHuntRelations.json +# x-ms-original-file: 2025-10-01-preview/hunts/GetHuntRelations.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_hunts.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_hunts.py index 2f22468162a9..bfbd452593b0 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_hunts.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_hunts.py @@ -38,6 +38,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/hunts/GetHunts.json +# x-ms-original-file: 2025-10-01-preview/hunts/GetHunts.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_incident_relation_by_name.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_incident_relation_by_name.py index 93e4afcbdbd2..73647855904a 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_incident_relation_by_name.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_incident_relation_by_name.py @@ -39,6 +39,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/incidents/relations/GetIncidentRelationByName.json +# x-ms-original-file: 2025-10-01-preview/incidents/relations/GetIncidentRelationByName.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_io_tby_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_io_tby_id.py index 60e486583fdc..5aaa1e806b70 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_io_tby_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_io_tby_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/GetIoTById.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/GetIoTById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_io_tdevice_entity_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_io_tdevice_entity_by_id.py index b4389b42da8d..65dc5e8b60d9 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_io_tdevice_entity_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_io_tdevice_entity_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/entities/GetIoTDeviceEntityById.json +# x-ms-original-file: 2025-10-01-preview/entities/GetIoTDeviceEntityById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_ip_entity_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_ip_entity_by_id.py index 910287bc337f..e3cab93cf567 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_ip_entity_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_ip_entity_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/entities/GetIpEntityById.json +# x-ms-original-file: 2025-10-01-preview/entities/GetIpEntityById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_job.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_job.py index ab59c15a3e1a..b5fac7d338a3 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_job.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_job.py @@ -39,6 +39,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/workspaceManagerAssignments/GetJob.json +# x-ms-original-file: 2025-10-01-preview/workspaceManagerAssignments/GetJob.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_mail_cluster_entity_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_mail_cluster_entity_by_id.py index cf198a76ad36..ca7d68ff2623 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_mail_cluster_entity_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_mail_cluster_entity_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/entities/GetMailClusterEntityById.json +# x-ms-original-file: 2025-10-01-preview/entities/GetMailClusterEntityById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_mail_message_entity_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_mail_message_entity_by_id.py index 2f6c0b31895e..ac3e3727323c 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_mail_message_entity_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_mail_message_entity_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/entities/GetMailMessageEntityById.json +# x-ms-original-file: 2025-10-01-preview/entities/GetMailMessageEntityById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_mailbox_entity_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_mailbox_entity_by_id.py index ece85f139d12..cb97684abc6f 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_mailbox_entity_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_mailbox_entity_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/entities/GetMailboxEntityById.json +# x-ms-original-file: 2025-10-01-preview/entities/GetMailboxEntityById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_malware_entity_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_malware_entity_by_id.py index 4f8742aa758f..9e4c2a7366df 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_malware_entity_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_malware_entity_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/entities/GetMalwareEntityById.json +# x-ms-original-file: 2025-10-01-preview/entities/GetMalwareEntityById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_metadata.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_metadata.py index 8a9654c1bcd0..b7f73402150d 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_metadata.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_metadata.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/metadata/GetMetadata.json +# x-ms-original-file: 2025-10-01-preview/metadata/GetMetadata.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_microsoft_cloud_app_security_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_microsoft_cloud_app_security_by_id.py index 4d983ae5215c..6d77e2fcf94d 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_microsoft_cloud_app_security_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_microsoft_cloud_app_security_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/GetMicrosoftCloudAppSecurityById.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/GetMicrosoftCloudAppSecurityById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_microsoft_defender_advanced_threat_protection_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_microsoft_defender_advanced_threat_protection_by_id.py index 64469a2fcb80..d1aa3692655a 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_microsoft_defender_advanced_threat_protection_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_microsoft_defender_advanced_threat_protection_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/GetMicrosoftDefenderAdvancedThreatProtectionById.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/GetMicrosoftDefenderAdvancedThreatProtectionById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_microsoft_insider_risk_management_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_microsoft_insider_risk_management_by_id.py index 50be48d72090..d8d760e2ab27 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_microsoft_insider_risk_management_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_microsoft_insider_risk_management_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/GetMicrosoftInsiderRiskManagementById.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/GetMicrosoftInsiderRiskManagementById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_microsoft_purview_information_protection_data_connetor_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_microsoft_purview_information_protection_data_connetor_by_id.py index 1e55a08bb5dc..792236d1132d 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_microsoft_purview_information_protection_data_connetor_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_microsoft_purview_information_protection_data_connetor_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/GetMicrosoftPurviewInformationProtectionDataConnetorById.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/GetMicrosoftPurviewInformationProtectionDataConnetorById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_microsoft_security_incident_creation_alert_rule.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_microsoft_security_incident_creation_alert_rule.py index c50820b55a8d..8edad7bcbbaa 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_microsoft_security_incident_creation_alert_rule.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_microsoft_security_incident_creation_alert_rule.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/alertRules/GetMicrosoftSecurityIncidentCreationAlertRule.json +# x-ms-original-file: 2025-10-01-preview/alertRules/GetMicrosoftSecurityIncidentCreationAlertRule.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_microsoft_threat_intelligence_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_microsoft_threat_intelligence_by_id.py index 3fb9e295ad53..9ef95a556f11 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_microsoft_threat_intelligence_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_microsoft_threat_intelligence_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/GetMicrosoftThreatIntelligenceById.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/GetMicrosoftThreatIntelligenceById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_microsoft_threat_protection_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_microsoft_threat_protection_by_id.py index e9a7ba5b2e0d..4258123287c9 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_microsoft_threat_protection_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_microsoft_threat_protection_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/GetMicrosoftThreatProtectionById.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/GetMicrosoftThreatProtectionById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_nrt_alert_rule.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_nrt_alert_rule.py index 9d3ad87df1bb..d11fabc0eff8 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_nrt_alert_rule.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_nrt_alert_rule.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/alertRules/GetNrtAlertRule.json +# x-ms-original-file: 2025-10-01-preview/alertRules/GetNrtAlertRule.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_office365_advanced_threat_protection_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_office365_advanced_threat_protection_by_id.py index 8c37a705d83a..b1db900208f7 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_office365_advanced_threat_protection_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_office365_advanced_threat_protection_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/GetOffice365AdvancedThreatProtectionById.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/GetOffice365AdvancedThreatProtectionById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_office365_project_data_connetor_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_office365_project_data_connetor_by_id.py index 159a9ca9e0b4..7f1e10a74c87 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_office365_project_data_connetor_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_office365_project_data_connetor_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/GetOffice365ProjectDataConnetorById.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/GetOffice365ProjectDataConnetorById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_office_consents.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_office_consents.py index f2dc92a0f84a..5202fd678714 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_office_consents.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_office_consents.py @@ -38,6 +38,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/officeConsents/GetOfficeConsents.json +# x-ms-original-file: 2025-10-01-preview/officeConsents/GetOfficeConsents.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_office_consents_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_office_consents_by_id.py index 8644ac7b539a..5686d0f9aa9e 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_office_consents_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_office_consents_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/officeConsents/GetOfficeConsentsById.json +# x-ms-original-file: 2025-10-01-preview/officeConsents/GetOfficeConsentsById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_office_data_connetor_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_office_data_connetor_by_id.py index ea66567094fe..ae21a6288cce 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_office_data_connetor_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_office_data_connetor_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/GetOfficeDataConnetorById.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/GetOfficeDataConnetorById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_office_power_bi_data_connetor_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_office_power_bi_data_connetor_by_id.py index 2f7842d7ae62..020d25ee0d2d 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_office_power_bi_data_connetor_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_office_power_bi_data_connetor_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/GetOfficePowerBIDataConnetorById.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/GetOfficePowerBIDataConnetorById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_package_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_package_by_id.py index 564ce94bef0c..4a2f3d93245f 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_package_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_package_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/contentPackages/GetPackageById.json +# x-ms-original-file: 2025-10-01-preview/contentPackages/GetPackageById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_packages.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_packages.py index b7a52fd4c09b..4e0974d157f4 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_packages.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_packages.py @@ -38,6 +38,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/contentPackages/GetPackages.json +# x-ms-original-file: 2025-10-01-preview/contentPackages/GetPackages.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_premium_microsoft_defender_for_threat_intelligence_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_premium_microsoft_defender_for_threat_intelligence_by_id.py index e09afa46af98..88283aaf325f 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_premium_microsoft_defender_for_threat_intelligence_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_premium_microsoft_defender_for_threat_intelligence_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/GetPremiumMicrosoftDefenderForThreatIntelligenceById.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/GetPremiumMicrosoftDefenderForThreatIntelligenceById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_process_entity_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_process_entity_by_id.py index 04185e434374..284e411d082f 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_process_entity_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_process_entity_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/entities/GetProcessEntityById.json +# x-ms-original-file: 2025-10-01-preview/entities/GetProcessEntityById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_product_package_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_product_package_by_id.py index 7457e3dfbfbb..677a79985c7a 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_product_package_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_product_package_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/contentPackages/GetProductPackageById.json +# x-ms-original-file: 2025-10-01-preview/contentPackages/GetProductPackageById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_product_packages.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_product_packages.py index 242ec9aec4d3..de84b88141f3 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_product_packages.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_product_packages.py @@ -38,6 +38,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/contentPackages/GetProductPackages.json +# x-ms-original-file: 2025-10-01-preview/contentPackages/GetProductPackages.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_product_template_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_product_template_by_id.py index 5e96877e1d46..b9b875968629 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_product_template_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_product_template_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/contentTemplates/GetProductTemplateById.json +# x-ms-original-file: 2025-10-01-preview/contentTemplates/GetProductTemplateById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_product_templates.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_product_templates.py index 717add5bba28..6e414a800c7d 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_product_templates.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_product_templates.py @@ -38,6 +38,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/contentTemplates/GetProductTemplates.json +# x-ms-original-file: 2025-10-01-preview/contentTemplates/GetProductTemplates.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_purview_audit_data_connector_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_purview_audit_data_connector_by_id.py index 49c32cd4bb9b..125908301eec 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_purview_audit_data_connector_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_purview_audit_data_connector_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/GetPurviewAuditDataConnectorById.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/GetPurviewAuditDataConnectorById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_queries.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_queries.py index 0c60ec6ee1ca..1fbe7052b3e4 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_queries.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_queries.py @@ -40,6 +40,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/entities/GetQueries.json +# x-ms-original-file: 2025-10-01-preview/entities/GetQueries.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_recommendation.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_recommendation.py index 4e3510fcb554..657eec0055b9 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_recommendation.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_recommendation.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/recommendations/GetRecommendation.json +# x-ms-original-file: 2025-10-01-preview/recommendations/GetRecommendation.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_recommendations.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_recommendations.py index 40556b811dbb..9a852100b982 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_recommendations.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_recommendations.py @@ -38,6 +38,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/recommendations/GetRecommendations.json +# x-ms-original-file: 2025-10-01-preview/recommendations/GetRecommendations.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_registry_key_entity_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_registry_key_entity_by_id.py index 78ac6efcf349..2181751726bf 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_registry_key_entity_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_registry_key_entity_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/entities/GetRegistryKeyEntityById.json +# x-ms-original-file: 2025-10-01-preview/entities/GetRegistryKeyEntityById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_registry_value_entity_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_registry_value_entity_by_id.py index d324f9845875..7b39a4d863f7 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_registry_value_entity_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_registry_value_entity_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/entities/GetRegistryValueEntityById.json +# x-ms-original-file: 2025-10-01-preview/entities/GetRegistryValueEntityById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_repositories.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_repositories.py index 67123cfb3e71..86689f9614e9 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_repositories.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_repositories.py @@ -49,6 +49,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/repositories/GetRepositories.json +# x-ms-original-file: 2025-10-01-preview/repositories/GetRepositories.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_rest_api_poller_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_rest_api_poller_by_id.py index fe30e83c4fbf..005dd3731df8 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_rest_api_poller_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_rest_api_poller_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/GetRestApiPollerById.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/GetRestApiPollerById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_scheduled_alert_rule.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_scheduled_alert_rule.py index 22205f67ad3c..e191ddbece7f 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_scheduled_alert_rule.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_scheduled_alert_rule.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/alertRules/GetScheduledAlertRule.json +# x-ms-original-file: 2025-10-01-preview/alertRules/GetScheduledAlertRule.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_security_alert_entity_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_security_alert_entity_by_id.py index 8d118f2c585c..86673a7ec77a 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_security_alert_entity_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_security_alert_entity_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/entities/GetSecurityAlertEntityById.json +# x-ms-original-file: 2025-10-01-preview/entities/GetSecurityAlertEntityById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_security_group_entity_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_security_group_entity_by_id.py index 6298bc27fff3..72635f902fc6 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_security_group_entity_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_security_group_entity_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/entities/GetSecurityGroupEntityById.json +# x-ms-original-file: 2025-10-01-preview/entities/GetSecurityGroupEntityById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_sentinel_onboarding_state.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_sentinel_onboarding_state.py index 7f839c1ed1be..335ec2f1b989 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_sentinel_onboarding_state.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_sentinel_onboarding_state.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/onboardingStates/GetSentinelOnboardingState.json +# x-ms-original-file: 2025-10-01-preview/onboardingStates/GetSentinelOnboardingState.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_source_control_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_source_control_by_id.py index 54dd83b5d02e..936272aec41f 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_source_control_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_source_control_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/sourcecontrols/GetSourceControlById.json +# x-ms-original-file: 2025-10-01-preview/sourcecontrols/GetSourceControlById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_source_controls.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_source_controls.py index eff110593fc8..14f3ec0c3add 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_source_controls.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_source_controls.py @@ -38,6 +38,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/sourcecontrols/GetSourceControls.json +# x-ms-original-file: 2025-10-01-preview/sourcecontrols/GetSourceControls.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_submission_mail_entity_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_submission_mail_entity_by_id.py index d165b7ea4543..1c8d28e11218 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_submission_mail_entity_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_submission_mail_entity_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/entities/GetSubmissionMailEntityById.json +# x-ms-original-file: 2025-10-01-preview/entities/GetSubmissionMailEntityById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_template_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_template_by_id.py index ab647996cb65..a61ee2112352 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_template_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_template_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/contentTemplates/GetTemplateById.json +# x-ms-original-file: 2025-10-01-preview/contentTemplates/GetTemplateById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_templates.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_templates.py index 7fb405eccc26..ad618fef632d 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_templates.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_templates.py @@ -38,6 +38,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/contentTemplates/GetTemplates.json +# x-ms-original-file: 2025-10-01-preview/contentTemplates/GetTemplates.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_threat_intelligence.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_threat_intelligence.py index dd4bdb9596a6..ab0e0fe2c5cf 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_threat_intelligence.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_threat_intelligence.py @@ -38,6 +38,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/threatintelligence/GetThreatIntelligence.json +# x-ms-original-file: 2025-10-01-preview/threatintelligence/GetThreatIntelligence.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_threat_intelligence_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_threat_intelligence_by_id.py index 5aaad67e25f3..a46b385c8392 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_threat_intelligence_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_threat_intelligence_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/threatintelligence/GetThreatIntelligenceById.json +# x-ms-original-file: 2025-10-01-preview/threatintelligence/GetThreatIntelligenceById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_threat_intelligence_taxii_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_threat_intelligence_taxii_by_id.py index 106aabe13a0e..51e6bd6ef82d 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_threat_intelligence_taxii_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_threat_intelligence_taxii_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/dataConnectors/GetThreatIntelligenceTaxiiById.json +# x-ms-original-file: 2025-10-01-preview/dataConnectors/GetThreatIntelligenceTaxiiById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_url_entity_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_url_entity_by_id.py index 599a57831f67..4a68f07d7ff4 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_url_entity_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_url_entity_by_id.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/entities/GetUrlEntityById.json +# x-ms-original-file: 2025-10-01-preview/entities/GetUrlEntityById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_watchlist_by_alias.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_watchlist_by_alias.py index 5c4c4a7a4c26..163c750601d1 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_watchlist_by_alias.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_watchlist_by_alias.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/watchlists/GetWatchlistByAlias.json +# x-ms-original-file: 2025-10-01-preview/watchlists/GetWatchlistByAlias.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_watchlist_item_by_id.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_watchlist_item_by_id.py index 503392ffb189..535d40f47bc1 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_watchlist_item_by_id.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_watchlist_item_by_id.py @@ -39,6 +39,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/watchlists/GetWatchlistItemById.json +# x-ms-original-file: 2025-10-01-preview/watchlists/GetWatchlistItemById.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_watchlist_items.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_watchlist_items.py index 6cecf124a046..9bcba4b99a82 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_watchlist_items.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_watchlist_items.py @@ -39,6 +39,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/watchlists/GetWatchlistItems.json +# x-ms-original-file: 2025-10-01-preview/watchlists/GetWatchlistItems.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_watchlists.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_watchlists.py index bcca215b40c0..64cf9922e35e 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_watchlists.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_watchlists.py @@ -38,6 +38,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/watchlists/GetWatchlists.json +# x-ms-original-file: 2025-10-01-preview/watchlists/GetWatchlists.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_whois_with_workspace_by_domain_name.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_whois_with_workspace_by_domain_name.py index 4a74f6bb23b3..2a7800f43e65 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_whois_with_workspace_by_domain_name.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_whois_with_workspace_by_domain_name.py @@ -39,6 +39,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/enrichment/GetWhoisWithWorkspaceByDomainName.json +# x-ms-original-file: 2025-10-01-preview/enrichment/GetWhoisWithWorkspaceByDomainName.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_workspace_manager_assignment.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_workspace_manager_assignment.py index 1f716312c114..2e88891b78a9 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_workspace_manager_assignment.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_workspace_manager_assignment.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/workspaceManagerAssignments/GetWorkspaceManagerAssignment.json +# x-ms-original-file: 2025-10-01-preview/workspaceManagerAssignments/GetWorkspaceManagerAssignment.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_workspace_manager_configuration.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_workspace_manager_configuration.py index 166e868afde3..d58c8fe0cf17 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_workspace_manager_configuration.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_workspace_manager_configuration.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/workspaceManagerConfigurations/GetWorkspaceManagerConfiguration.json +# x-ms-original-file: 2025-10-01-preview/workspaceManagerConfigurations/GetWorkspaceManagerConfiguration.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_workspace_manager_group.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_workspace_manager_group.py index b389f5f7728a..8e04e93d80bd 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_workspace_manager_group.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_workspace_manager_group.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/workspaceManagerGroups/GetWorkspaceManagerGroup.json +# x-ms-original-file: 2025-10-01-preview/workspaceManagerGroups/GetWorkspaceManagerGroup.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_workspace_manager_member.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_workspace_manager_member.py index a34a432ea670..5f112f71fa52 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_workspace_manager_member.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/get_workspace_manager_member.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/workspaceManagerMembers/GetWorkspaceManagerMember.json +# x-ms-original-file: 2025-10-01-preview/workspaceManagerMembers/GetWorkspaceManagerMember.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incident_comments_create_or_update.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incident_comments_create_or_update.py index 587d5ad70616..fe999479cb22 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incident_comments_create_or_update.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incident_comments_create_or_update.py @@ -40,6 +40,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/incidents/IncidentComments/IncidentComments_CreateOrUpdate.json +# x-ms-original-file: 2025-10-01-preview/incidents/IncidentComments/IncidentComments_CreateOrUpdate.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incident_comments_delete.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incident_comments_delete.py index bef00f6d0e93..fd7008800c12 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incident_comments_delete.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incident_comments_delete.py @@ -38,6 +38,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/incidents/IncidentComments/IncidentComments_Delete.json +# x-ms-original-file: 2025-10-01-preview/incidents/IncidentComments/IncidentComments_Delete.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incident_comments_get.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incident_comments_get.py index 1f6053973e71..b281b7679bbc 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incident_comments_get.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incident_comments_get.py @@ -39,6 +39,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/incidents/IncidentComments/IncidentComments_Get.json +# x-ms-original-file: 2025-10-01-preview/incidents/IncidentComments/IncidentComments_Get.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incident_comments_list.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incident_comments_list.py index 894298e18285..fcf674ff6cf4 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incident_comments_list.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incident_comments_list.py @@ -39,6 +39,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/incidents/IncidentComments/IncidentComments_List.json +# x-ms-original-file: 2025-10-01-preview/incidents/IncidentComments/IncidentComments_List.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incident_tasks_create_or_update.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incident_tasks_create_or_update.py index 234ff1292f56..f76636e5c760 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incident_tasks_create_or_update.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incident_tasks_create_or_update.py @@ -40,6 +40,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/incidents/IncidentTasks/IncidentTasks_CreateOrUpdate.json +# x-ms-original-file: 2025-10-01-preview/incidents/IncidentTasks/IncidentTasks_CreateOrUpdate.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incident_tasks_delete.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incident_tasks_delete.py index 51f46ff80a01..02822ce3fa56 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incident_tasks_delete.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incident_tasks_delete.py @@ -38,6 +38,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/incidents/IncidentTasks/IncidentTasks_Delete.json +# x-ms-original-file: 2025-10-01-preview/incidents/IncidentTasks/IncidentTasks_Delete.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incident_tasks_get.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incident_tasks_get.py index 0cdde5b06ed4..2a46913faee5 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incident_tasks_get.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incident_tasks_get.py @@ -39,6 +39,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/incidents/IncidentTasks/IncidentTasks_Get.json +# x-ms-original-file: 2025-10-01-preview/incidents/IncidentTasks/IncidentTasks_Get.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incident_tasks_list.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incident_tasks_list.py index c09323ec7b00..eb39867c3873 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incident_tasks_list.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incident_tasks_list.py @@ -39,6 +39,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/incidents/IncidentTasks/IncidentTasks_List.json +# x-ms-original-file: 2025-10-01-preview/incidents/IncidentTasks/IncidentTasks_List.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incidents_create_or_update.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incidents_create_or_update.py index 2f14ed5a93ac..e9f3ef4b7bbb 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incidents_create_or_update.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incidents_create_or_update.py @@ -59,6 +59,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/incidents/Incidents_CreateOrUpdate.json +# x-ms-original-file: 2025-10-01-preview/incidents/Incidents_CreateOrUpdate.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incidents_delete.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incidents_delete.py index 4ceb439a15cf..67956149e956 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incidents_delete.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incidents_delete.py @@ -37,6 +37,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/incidents/Incidents_Delete.json +# x-ms-original-file: 2025-10-01-preview/incidents/Incidents_Delete.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incidents_get.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incidents_get.py index d2ba3f40c53c..53da4ee079c9 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incidents_get.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incidents_get.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/incidents/Incidents_Get.json +# x-ms-original-file: 2025-10-01-preview/incidents/Incidents_Get.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incidents_list.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incidents_list.py index acca6abb6afc..4895b9d85c79 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incidents_list.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incidents_list.py @@ -38,6 +38,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/incidents/Incidents_List.json +# x-ms-original-file: 2025-10-01-preview/incidents/Incidents_List.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incidents_list_alerts.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incidents_list_alerts.py index bd884d76b033..ac50ff83eb70 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incidents_list_alerts.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incidents_list_alerts.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/incidents/IncidentAlerts/Incidents_ListAlerts.json +# x-ms-original-file: 2025-10-01-preview/incidents/IncidentAlerts/Incidents_ListAlerts.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incidents_list_bookmarks.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incidents_list_bookmarks.py index ff8dd24c8fce..bebc5fd47e74 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incidents_list_bookmarks.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incidents_list_bookmarks.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/incidents/IncidentBookmarks/Incidents_ListBookmarks.json +# x-ms-original-file: 2025-10-01-preview/incidents/IncidentBookmarks/Incidents_ListBookmarks.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incidents_list_entities.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incidents_list_entities.py index a1a4d3683b97..3fb1c234375c 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incidents_list_entities.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incidents_list_entities.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/incidents/IncidentEntities/Incidents_ListEntities.json +# x-ms-original-file: 2025-10-01-preview/incidents/IncidentEntities/Incidents_ListEntities.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incidents_run_playbook.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incidents_run_playbook.py index 2e766b1d401f..d0c77fd3b62d 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incidents_run_playbook.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/incidents_run_playbook.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/manualTrigger/Incidents_RunPlaybook.json +# x-ms-original-file: 2025-10-01-preview/manualTrigger/Incidents_RunPlaybook.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/install_package.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/install_package.py index 9ab2548d7280..4c3b41dbee8f 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/install_package.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/install_package.py @@ -48,6 +48,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/contentPackages/InstallPackage.json +# x-ms-original-file: 2025-10-01-preview/contentPackages/InstallPackage.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/install_template.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/install_template.py index 04606df67fed..4c794845544f 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/install_template.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/install_template.py @@ -112,6 +112,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/contentTemplates/InstallTemplate.json +# x-ms-original-file: 2025-10-01-preview/contentTemplates/InstallTemplate.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/list_operations.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/list_operations.py index b5e7ff3bee28..f58392dfcfc7 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/list_operations.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/list_operations.py @@ -35,6 +35,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/operations/ListOperations.json +# x-ms-original-file: 2025-10-01-preview/operations/ListOperations.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/patch_metadata.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/patch_metadata.py index c1f32c53613f..8fd473655c62 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/patch_metadata.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/patch_metadata.py @@ -39,6 +39,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/metadata/PatchMetadata.json +# x-ms-original-file: 2025-10-01-preview/metadata/PatchMetadata.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/patch_recommendation.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/patch_recommendation.py index 31943456e315..b6840dad0179 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/patch_recommendation.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/patch_recommendation.py @@ -39,6 +39,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/recommendations/PatchRecommendation.json +# x-ms-original-file: 2025-10-01-preview/recommendations/PatchRecommendation.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/post_expand_bookmark.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/post_expand_bookmark.py index 050570d714ef..73b5cd483a07 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/post_expand_bookmark.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/post_expand_bookmark.py @@ -43,6 +43,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/bookmarks/expand/PostExpandBookmark.json +# x-ms-original-file: 2025-10-01-preview/bookmarks/expand/PostExpandBookmark.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/post_expand_entity.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/post_expand_entity.py index 62406c6054f1..5790f16e2e11 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/post_expand_entity.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/post_expand_entity.py @@ -43,6 +43,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/entities/expand/PostExpandEntity.json +# x-ms-original-file: 2025-10-01-preview/entities/expand/PostExpandEntity.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/post_get_insights.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/post_get_insights.py index 677563f1a079..436305380254 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/post_get_insights.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/post_get_insights.py @@ -44,6 +44,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/entities/insights/PostGetInsights.json +# x-ms-original-file: 2025-10-01-preview/entities/insights/PostGetInsights.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/post_threat_intelligence_count.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/post_threat_intelligence_count.py index 8cfd04929ff6..7460ffb9c5e5 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/post_threat_intelligence_count.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/post_threat_intelligence_count.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/threatintelligence/PostThreatIntelligenceCount.json +# x-ms-original-file: 2025-10-01-preview/threatintelligence/PostThreatIntelligenceCount.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/post_threat_intelligence_query.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/post_threat_intelligence_query.py index 6cf060c05b30..d1358807bd22 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/post_threat_intelligence_query.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/post_threat_intelligence_query.py @@ -39,6 +39,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/threatintelligence/PostThreatIntelligenceQuery.json +# x-ms-original-file: 2025-10-01-preview/threatintelligence/PostThreatIntelligenceQuery.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/post_timeline_entity.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/post_timeline_entity.py index 857fc5023b14..f45c343f2b1c 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/post_timeline_entity.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/post_timeline_entity.py @@ -43,6 +43,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/entities/timeline/PostTimelineEntity.json +# x-ms-original-file: 2025-10-01-preview/entities/timeline/PostTimelineEntity.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/put_metadata.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/put_metadata.py index 6056e9aad169..91557f11284b 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/put_metadata.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/put_metadata.py @@ -92,6 +92,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/metadata/PutMetadata.json +# x-ms-original-file: 2025-10-01-preview/metadata/PutMetadata.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/put_metadata_minimal.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/put_metadata_minimal.py index 01c14e108b31..a0f33e915e99 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/put_metadata_minimal.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/put_metadata_minimal.py @@ -46,6 +46,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/metadata/PutMetadataMinimal.json +# x-ms-original-file: 2025-10-01-preview/metadata/PutMetadataMinimal.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/query_threat_intelligence.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/query_threat_intelligence.py index d6765d72fcf5..f9b0c80bdb54 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/query_threat_intelligence.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/query_threat_intelligence.py @@ -47,6 +47,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/threatintelligence/QueryThreatIntelligence.json +# x-ms-original-file: 2025-10-01-preview/threatintelligence/QueryThreatIntelligence.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/reevaluate_recommendation.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/reevaluate_recommendation.py index 2be9cc1a77ae..e07d5f084833 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/reevaluate_recommendation.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/reevaluate_recommendation.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/recommendations/ReevaluateRecommendation.json +# x-ms-original-file: 2025-10-01-preview/recommendations/ReevaluateRecommendation.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/replace_tags_threat_intelligence.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/replace_tags_threat_intelligence.py index 625ab92d840f..713050b25539 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/replace_tags_threat_intelligence.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/replace_tags_threat_intelligence.py @@ -43,6 +43,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/threatintelligence/ReplaceTagsThreatIntelligence.json +# x-ms-original-file: 2025-10-01-preview/threatintelligence/ReplaceTagsThreatIntelligence.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/trigger_rule_run_post.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/trigger_rule_run_post.py index 6fb6b059be0d..29ed0beb8ee7 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/trigger_rule_run_post.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/trigger_rule_run_post.py @@ -30,15 +30,14 @@ def main(): subscription_id="SUBSCRIPTION_ID", ) - response = client.alert_rule.begin_trigger_rule_run( + client.alert_rule.begin_trigger_rule_run( resource_group_name="myRg", workspace_name="myWorkspace", rule_id="65360bb0-8986-4ade-a89d-af3cf44d28aa", analytics_rule_run_trigger_parameter={"properties": {"executionTimeUtc": "2022-12-22T15:37:03.074Z"}}, ).result() - print(response) -# x-ms-original-file: 2025-07-01-preview/triggeredAnalyticsRuleRuns/triggerRuleRun_Post.json +# x-ms-original-file: 2025-10-01-preview/triggeredAnalyticsRuleRuns/triggerRuleRun_Post.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/triggered_analytics_rule_run_get.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/triggered_analytics_rule_run_get.py index 59976fb1524a..68a9a7bb9bc0 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/triggered_analytics_rule_run_get.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/triggered_analytics_rule_run_get.py @@ -38,6 +38,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/triggeredAnalyticsRuleRuns/triggeredAnalyticsRuleRun_Get.json +# x-ms-original-file: 2025-10-01-preview/triggeredAnalyticsRuleRuns/triggeredAnalyticsRuleRun_Get.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/triggered_analytics_rule_runs_get.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/triggered_analytics_rule_runs_get.py index 4f0659eb5cee..c94287ebff63 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/triggered_analytics_rule_runs_get.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/triggered_analytics_rule_runs_get.py @@ -38,6 +38,6 @@ def main(): print(item) -# x-ms-original-file: 2025-07-01-preview/triggeredAnalyticsRuleRuns/triggeredAnalyticsRuleRuns_Get.json +# x-ms-original-file: 2025-10-01-preview/triggeredAnalyticsRuleRuns/triggeredAnalyticsRuleRuns_Get.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/uninstall_package.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/uninstall_package.py index 91cd2b0cf308..44b978b1be27 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/uninstall_package.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/uninstall_package.py @@ -37,6 +37,6 @@ def main(): ) -# x-ms-original-file: 2025-07-01-preview/contentPackages/UninstallPackage.json +# x-ms-original-file: 2025-10-01-preview/contentPackages/UninstallPackage.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/update_eyes_on_setting.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/update_eyes_on_setting.py index b5a6a8ac5f2f..df9a038cb2a0 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/update_eyes_on_setting.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/update_eyes_on_setting.py @@ -39,6 +39,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/settings/UpdateEyesOnSetting.json +# x-ms-original-file: 2025-10-01-preview/settings/UpdateEyesOnSetting.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/update_threat_intelligence.py b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/update_threat_intelligence.py index 051fb682c42f..153554c28464 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/update_threat_intelligence.py +++ b/sdk/securityinsight/azure-mgmt-securityinsight/generated_samples/update_threat_intelligence.py @@ -60,6 +60,6 @@ def main(): print(response) -# x-ms-original-file: 2025-07-01-preview/threatintelligence/UpdateThreatIntelligence.json +# x-ms-original-file: 2025-10-01-preview/threatintelligence/UpdateThreatIntelligence.json if __name__ == "__main__": main() diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/pyproject.toml b/sdk/securityinsight/azure-mgmt-securityinsight/pyproject.toml index c859db2e6916..9b8862d06499 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/pyproject.toml +++ b/sdk/securityinsight/azure-mgmt-securityinsight/pyproject.toml @@ -21,6 +21,7 @@ classifiers = [ "Programming Language :: Python :: 3.11", "Programming Language :: Python :: 3.12", "Programming Language :: Python :: 3.13", + "Programming Language :: Python :: 3.14", ] requires-python = ">=3.10" keywords = [ diff --git a/sdk/securityinsight/azure-mgmt-securityinsight/tsp-location.yaml b/sdk/securityinsight/azure-mgmt-securityinsight/tsp-location.yaml index 2dad58a08ef0..48250aa6b129 100644 --- a/sdk/securityinsight/azure-mgmt-securityinsight/tsp-location.yaml +++ b/sdk/securityinsight/azure-mgmt-securityinsight/tsp-location.yaml @@ -1,4 +1,4 @@ directory: specification/securityinsights/resource-manager/Microsoft.SecurityInsights/SecurityInsights -commit: da8db6e593df9f3ddc13139c39930fdad54d12f7 +commit: d7da39437a8330fabdc4151f75aebab8e5ca3a64 repo: Azure/azure-rest-api-specs additionalDirectories: