Bookmarks.json

{
  "swagger": "2.0",
  "info": {
    "title": "Security Insights",
    "description": "API spec for Microsoft.SecurityInsights (Azure Security Insights) resource provider",
    "version": "2022-08-01-preview"
  },
  "host": "management.azure.com",
  "schemes": [
    "https"
  ],
  "consumes": [
    "application/json"
  ],
  "produces": [
    "application/json"
  ],
  "security": [
    {
      "azure_auth": [
        "user_impersonation"
      ]
    }
  ],
  "securityDefinitions": {
    "azure_auth": {
      "type": "oauth2",
      "authorizationUrl": "https://login.microsoftonline.com/common/oauth2/authorize",
      "flow": "implicit",
      "description": "Azure Active Directory OAuth2 Flow",
      "scopes": {
        "user_impersonation": "impersonate your user account"
      }
    }
  },
  "paths": {
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/bookmarks": {
      "get": {
        "x-ms-examples": {
          "Get all bookmarks.": {
            "$ref": "./examples/bookmarks/GetBookmarks.json"
          }
        },
        "tags": [
          "Bookmarks"
        ],
        "description": "Gets all bookmarks.",
        "operationId": "Bookmarks_List",
        "parameters": [
          {
            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ApiVersionParameter"
          },
          {
            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/SubscriptionIdParameter"
          },
          {
            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ResourceGroupNameParameter"
          },
          {
            "$ref": "../../../common/2.0/types.json#/parameters/WorkspaceName"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/BookmarkList"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "../../../common/2.0/types.json#/definitions/CloudError"
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/bookmarks/{bookmarkId}": {
      "get": {
        "x-ms-examples": {
          "Get a bookmark.": {
            "$ref": "./examples/bookmarks/GetBookmarkById.json"
          }
        },
        "tags": [
          "Bookmarks"
        ],
        "description": "Gets a bookmark.",
        "operationId": "Bookmarks_Get",
        "parameters": [
          {
            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ApiVersionParameter"
          },
          {
            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/SubscriptionIdParameter"
          },
          {
            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ResourceGroupNameParameter"
          },
          {
            "$ref": "../../../common/2.0/types.json#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/BookmarkId"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/Bookmark"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "../../../common/2.0/types.json#/definitions/CloudError"
            }
          }
        }
      },
      "put": {
        "x-ms-examples": {
          "Creates or updates a bookmark.": {
            "$ref": "./examples/bookmarks/CreateBookmark.json"
          }
        },
        "tags": [
          "Bookmarks"
        ],
        "description": "Creates or updates the bookmark.",
        "operationId": "Bookmarks_CreateOrUpdate",
        "parameters": [
          {
            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ApiVersionParameter"
          },
          {
            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/SubscriptionIdParameter"
          },
          {
            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ResourceGroupNameParameter"
          },
          {
            "$ref": "../../../common/2.0/types.json#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/BookmarkId"
          },
          {
            "$ref": "#/parameters/Bookmark"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/Bookmark"
            }
          },
          "201": {
            "description": "Created",
            "schema": {
              "$ref": "#/definitions/Bookmark"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "../../../common/2.0/types.json#/definitions/CloudError"
            }
          }
        }
      },
      "delete": {
        "x-ms-examples": {
          "Delete a bookmark.": {
            "$ref": "./examples/bookmarks/DeleteBookmark.json"
          }
        },
        "tags": [
          "Bookmarks"
        ],
        "description": "Delete the bookmark.",
        "operationId": "Bookmarks_Delete",
        "parameters": [
          {
            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ApiVersionParameter"
          },
          {
            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/SubscriptionIdParameter"
          },
          {
            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ResourceGroupNameParameter"
          },
          {
            "$ref": "../../../common/2.0/types.json#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/BookmarkId"
          }
        ],
        "responses": {
          "200": {
            "description": "OK"
          },
          "204": {
            "description": "No Content"
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "../../../common/2.0/types.json#/definitions/CloudError"
            }
          }
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/bookmarks/{bookmarkId}/relations": {
      "get": {
        "x-ms-examples": {
          "Get all bookmark relations.": {
            "$ref": "./examples/bookmarks/relations/GetAllBookmarkRelations.json"
          }
        },
        "tags": [
          "BookmarkRelations"
        ],
        "description": "Gets all bookmark relations.",
        "operationId": "BookmarkRelations_List",
        "parameters": [
          {
            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ApiVersionParameter"
          },
          {
            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/SubscriptionIdParameter"
          },
          {
            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ResourceGroupNameParameter"
          },
          {
            "$ref": "../../../common/2.0/types.json#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/BookmarkId"
          },
          {
            "$ref": "../../../common/2.0/types.json#/parameters/ODataFilter"
          },
          {
            "$ref": "../../../common/2.0/types.json#/parameters/ODataOrderBy"
          },
          {
            "$ref": "../../../common/2.0/types.json#/parameters/ODataTop"
          },
          {
            "$ref": "../../../common/2.0/types.json#/parameters/ODataSkipToken"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "./common/RelationTypes.json#/definitions/RelationList"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "../../../common/2.0/types.json#/definitions/CloudError"
            }
          }
        },
        "x-ms-odata": "./common/RelationTypes.json#/definitions/Relation",
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/bookmarks/{bookmarkId}/expand": {
      "post": {
        "x-ms-examples": {
          "Expand an bookmark": {
            "$ref": "./examples/bookmarks/expand/PostExpandBookmark.json"
          }
        },
        "description": "Expand an bookmark",
        "operationId": "Bookmark_Expand",
        "parameters": [
          {
            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ApiVersionParameter"
          },
          {
            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/SubscriptionIdParameter"
          },
          {
            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ResourceGroupNameParameter"
          },
          {
            "$ref": "../../../common/2.0/types.json#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/BookmarkId"
          },
          {
            "$ref": "#/parameters/BookmarkExpandRequestBody"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/BookmarkExpandResponse"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "../../../common/2.0/types.json#/definitions/CloudError"
            }
          }
        },
        "tags": [
          "Bookmark"
        ]
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/bookmarks/{bookmarkId}/relations/{relationName}": {
      "get": {
        "x-ms-examples": {
          "Get a bookmark relation.": {
            "$ref": "./examples/bookmarks/relations/GetBookmarkRelationByName.json"
          }
        },
        "tags": [
          "BookmarkRelations"
        ],
        "description": "Gets a bookmark relation.",
        "operationId": "BookmarkRelations_Get",
        "parameters": [
          {
            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ApiVersionParameter"
          },
          {
            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/SubscriptionIdParameter"
          },
          {
            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ResourceGroupNameParameter"
          },
          {
            "$ref": "../../../common/2.0/types.json#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/BookmarkId"
          },
          {
            "$ref": "./common/RelationTypes.json#/parameters/RelationName"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "./common/RelationTypes.json#/definitions/Relation"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "../../../common/2.0/types.json#/definitions/CloudError"
            }
          }
        }
      },
      "put": {
        "x-ms-examples": {
          "Creates or updates a bookmark relation.": {
            "$ref": "./examples/bookmarks/relations/CreateBookmarkRelation.json"
          }
        },
        "tags": [
          "BookmarkRelations"
        ],
        "description": "Creates the bookmark relation.",
        "operationId": "BookmarkRelations_CreateOrUpdate",
        "parameters": [
          {
            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ApiVersionParameter"
          },
          {
            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/SubscriptionIdParameter"
          },
          {
            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ResourceGroupNameParameter"
          },
          {
            "$ref": "../../../common/2.0/types.json#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/BookmarkId"
          },
          {
            "$ref": "./common/RelationTypes.json#/parameters/RelationName"
          },
          {
            "$ref": "./common/RelationTypes.json#/parameters/Relation"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "./common/RelationTypes.json#/definitions/Relation"
            }
          },
          "201": {
            "description": "Created",
            "schema": {
              "$ref": "./common/RelationTypes.json#/definitions/Relation"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "../../../common/2.0/types.json#/definitions/CloudError"
            }
          }
        }
      },
      "delete": {
        "x-ms-examples": {
          "Delete the bookmark relation.": {
            "$ref": "./examples/bookmarks/relations/DeleteBookmarkRelation.json"
          }
        },
        "tags": [
          "BookmarkRelations"
        ],
        "description": "Delete the bookmark relation.",
        "operationId": "BookmarkRelations_Delete",
        "parameters": [
          {
            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ApiVersionParameter"
          },
          {
            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/SubscriptionIdParameter"
          },
          {
            "$ref": "../../../../../common-types/resource-management/v3/types.json#/parameters/ResourceGroupNameParameter"
          },
          {
            "$ref": "../../../common/2.0/types.json#/parameters/WorkspaceName"
          },
          {
            "$ref": "#/parameters/BookmarkId"
          },
          {
            "$ref": "./common/RelationTypes.json#/parameters/RelationName"
          }
        ],
        "responses": {
          "200": {
            "description": "OK"
          },
          "204": {
            "description": "No Content"
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "../../../common/2.0/types.json#/definitions/CloudError"
            }
          }
        }
      }
    }
  },
  "parameters": {
    "Bookmark": {
      "description": "The bookmark",
      "in": "body",
      "name": "bookmark",
      "required": true,
      "schema": {
        "$ref": "#/definitions/Bookmark"
      },
      "x-ms-parameter-location": "method"
    },
    "BookmarkExpandRequestBody": {
      "description": "The parameters required to execute an expand operation on the given bookmark.",
      "in": "body",
      "name": "parameters",
      "required": true,
      "schema": {
        "$ref": "#/definitions/BookmarkExpandParameters"
      },
      "x-ms-parameter-location": "method"
    },
    "BookmarkId": {
      "description": "Bookmark ID",
      "in": "path",
      "name": "bookmarkId",
      "required": true,
      "type": "string",
      "x-ms-parameter-location": "method"
    }
  },
  "definitions": {
    "Bookmark": {
      "allOf": [
        {
          "$ref": "../../../common/2.0/types.json#/definitions/ResourceWithEtag"
        }
      ],
      "description": "Represents a bookmark in Azure Security Insights.",
      "properties": {
        "properties": {
          "$ref": "#/definitions/BookmarkProperties",
          "description": "Bookmark properties",
          "x-ms-client-flatten": true
        }
      },
      "type": "object"
    },
    "BookmarkExpandParameters": {
      "description": "The parameters required to execute an expand operation on the given bookmark.",
      "properties": {
        "endTime": {
          "description": "The end date filter, so the only expansion results returned are before this date.",
          "format": "date-time",
          "type": "string"
        },
        "expansionId": {
          "description": "The Id of the expansion to perform.",
          "format": "uuid",
          "type": "string"
        },
        "startTime": {
          "description": "The start date filter, so the only expansion results returned are after this date.",
          "format": "date-time",
          "type": "string"
        }
      },
      "type": "object"
    },
    "BookmarkExpandResponse": {
      "description": "The entity expansion result operation response.",
      "properties": {
        "metaData": {
          "$ref": "./common/EntityTypes.json#/definitions/ExpansionResultsMetadata",
          "description": "The metadata from the expansion operation results."
        },
        "value": {
          "description": "The expansion result values.",
          "properties": {
            "entities": {
              "description": "Array of the expansion result entities.",
              "items": {
                "$ref": "./common/EntityTypes.json#/definitions/Entity"
              },
              "type": "array"
            },
            "edges": {
              "description": "Array of expansion result connected entities",
              "items": {
                "$ref": "#/definitions/ConnectedEntity"
              },
              "type": "array"
            }
          },
          "type": "object"
        }
      },
      "type": "object"
    },
    "BookmarkList": {
      "description": "List all the bookmarks.",
      "properties": {
        "nextLink": {
          "description": "URL to fetch the next set of bookmarks.",
          "readOnly": true,
          "type": "string"
        },
        "value": {
          "description": "Array of bookmarks.",
          "items": {
            "$ref": "#/definitions/Bookmark"
          },
          "type": "array"
        }
      },
      "type": "object",
      "required": [
        "value"
      ]
    },
    "BookmarkProperties": {
      "description": "Describes bookmark properties",
      "properties": {
        "created": {
          "description": "The time the bookmark was created",
          "format": "date-time",
          "type": "string"
        },
        "createdBy": {
          "$ref": "../../../common/2.0/types.json#/definitions/UserInfo",
          "description": "Describes a user that created the bookmark",
          "type": "object"
        },
        "displayName": {
          "description": "The display name of the bookmark",
          "type": "string"
        },
        "labels": {
          "description": "List of labels relevant to this bookmark",
          "items": {
            "$ref": "../../../common/2.0/types.json#/definitions/Label"
          },
          "type": "array"
        },
        "notes": {
          "description": "The notes of the bookmark",
          "type": "string"
        },
        "query": {
          "description": "The query of the bookmark.",
          "type": "string"
        },
        "queryResult": {
          "description": "The query result of the bookmark.",
          "type": "string"
        },
        "updated": {
          "description": "The last time the bookmark was updated",
          "format": "date-time",
          "type": "string"
        },
        "updatedBy": {
          "$ref": "../../../common/2.0/types.json#/definitions/UserInfo",
          "description": "Describes a user that updated the bookmark",
          "type": "object"
        },
        "eventTime": {
          "description": "The bookmark event time",
          "format": "date-time",
          "type": "string"
        },
        "queryStartTime": {
          "description": "The start time for the query",
          "format": "date-time",
          "type": "string"
        },
        "queryEndTime": {
          "description": "The end time for the query",
          "format": "date-time",
          "type": "string"
        },
        "incidentInfo": {
          "$ref": "./common/IncidentTypes.json#/definitions/IncidentInfo",
          "description": "Describes an incident that relates to bookmark",
          "type": "object"
        },
        "entityMappings": {
          "$ref": "#/definitions/EntityMappingsList",
          "description": "Describes the entity mappings of the bookmark",
          "type": "object"
        },
        "tactics": {
          "items": {
            "$ref": "./common/AlertTypes.json#/definitions/AttackTactic"
          },
          "description": "A list of relevant mitre attacks",
          "type": "array"
        },
        "techniques": {
          "items": {
            "$ref": "#/definitions/AttackTechnique"
          },
          "description": "A list of relevant mitre techniques",
          "type": "array"
        }
      },
      "required": [
        "displayName",
        "query"
      ],
      "type": "object"
    },
    "ConnectedEntity": {
      "description": "Expansion result connected entities",
      "properties": {
        "targetEntityId": {
          "description": "Entity Id of the connected entity",
          "type": "string"
        },
        "additionalData": {
          "description": "key-value pairs for a connected entity mapping",
          "type": "object"
        }
      },
      "type": "object"
    },
    "EntityMappingsList": {
      "description": "Describes the entity mappings of the bookmark",
      "items": {
        "$ref": "#/definitions/BookmarkEntityMappings"
      },
      "x-ms-identifiers": [],
      "type": "array"
    },
    "BookmarkEntityMappings": {
      "description": "Describes the entity mappings of a single entity",
      "properties": {
        "entityType": {
          "description": "The entity type",
          "type": "string"
        },
        "fieldMappings": {
          "description": "Array of fields mapping for that entity type",
          "items": {
            "$ref": "#/definitions/EntityFieldMapping"
          },
          "x-ms-identifiers": [],
          "type": "array"
        }
      },
      "type": "object"
    },
    "EntityFieldMapping": {
      "description": "Map identifiers of a single entity",
      "properties": {
        "identifier": {
          "description": "Alert V3 identifier",
          "type": "string"
        },
        "value": {
          "description": "The value of the identifier",
          "type": "string"
        }
      },
      "type": "object"
    },
    "AttackTechnique": {
      "description": "Mitre technique (https://attack.mitre.org/matrices/enterprise/)",
      "type": "string"
    }
  }
}