-
Notifications
You must be signed in to change notification settings - Fork 5.1k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[Hunts] Add hunts to Sentinel 2023-04-01-preview version (#23139)
* Add hunts files * Include update in 200 description and add defaults * Add back 201 * Update relation properties * Update example --------- Co-authored-by: Derrick Lee <[email protected]>
- Loading branch information
1 parent
8a0624b
commit ac6b0d6
Showing
14 changed files
with
1,455 additions
and
0 deletions.
There are no files selected for viewing
992 changes: 992 additions & 0 deletions
992
...nsights/resource-manager/Microsoft.SecurityInsights/preview/2023-04-01-preview/Hunts.json
Large diffs are not rendered by default.
Oops, something went wrong.
100 changes: 100 additions & 0 deletions
100
...ager/Microsoft.SecurityInsights/preview/2023-04-01-preview/examples/hunts/CreateHunt.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,100 @@ | ||
{ | ||
"parameters": { | ||
"api-version": "2023-04-01-preview", | ||
"subscriptionId": "bd794837-4d29-4647-9105-6339bfdb4e6a", | ||
"resourceGroupName": "myRg", | ||
"workspaceName": "myWorkspace", | ||
"operationalInsightsResourceProvider": "Microsoft.OperationalInsights", | ||
"huntId": "163e7b2a-a2ec-4041-aaba-d878a38f265f", | ||
"hunt": { | ||
"properties": { | ||
"displayName": "Log4J new hunt", | ||
"description": "Log4J Hunt Description", | ||
"status": "New", | ||
"hypothesisStatus": "Unknown", | ||
"attackTactics": [ | ||
"Reconnaissance" | ||
], | ||
"attackTechniques": [ | ||
"T1595" | ||
], | ||
"labels": [ | ||
"Label1", | ||
"Label2" | ||
], | ||
"owner": { | ||
"objectId": "873b5263-5d34-4149-b356-ad341b01e123" | ||
} | ||
} | ||
} | ||
}, | ||
"responses": { | ||
"200": { | ||
"body": { | ||
"id": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/hunts/163e7b2a-a2ec-4041-aaba-d878a38f265f", | ||
"name": "163e7b2a-a2ec-4041-aaba-d878a38f265f", | ||
"etag": "\"de00c408-0000-0c00-0000-62741e350000\"", | ||
"type": "Microsoft.SecurityInsights/hunts", | ||
"properties": { | ||
"displayName": "Log4J new hunt", | ||
"description": "Log4J Hunt Description", | ||
"status": "New", | ||
"hypothesisStatus": "Unknown", | ||
"attackTactics": [ | ||
"Reconnaissance" | ||
], | ||
"attackTechniques": [ | ||
"T1595" | ||
], | ||
"huntStartTimeUtc": "2022-03-11T09:47:15.438Z", | ||
"huntEndTimeUtc": "2022-03-12T09:47:15.438Z", | ||
"labels": [ | ||
"Label1", | ||
"Label2" | ||
], | ||
"owner": { | ||
"objectId": "873b5263-5d34-4149-b356-ad341b01e123", | ||
"email": "[email protected]", | ||
"assignedTo": null, | ||
"userPrincipalName": "John Doe", | ||
"ownerType": "User" | ||
} | ||
} | ||
} | ||
}, | ||
"201": { | ||
"body": { | ||
"id": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/hunts/163e7b2a-a2ec-4041-aaba-d878a38f265f", | ||
"name": "163e7b2a-a2ec-4041-aaba-d878a38f265f", | ||
"etag": "\"de00c408-0000-0c00-0000-62741e350000\"", | ||
"type": "Microsoft.SecurityInsights/hunts", | ||
"properties": { | ||
"displayName": "Log4J new hunt", | ||
"description": "Log4J Hunt Description", | ||
"status": "New", | ||
"hypothesisStatus": "Unknown", | ||
"attackTactics": [ | ||
"Reconnaissance" | ||
], | ||
"attackTechniques": [ | ||
"T1595" | ||
], | ||
"huntSequenceNumber": 0, | ||
"huntStartTimeUtc": "2022-03-11T09:47:15.438Z", | ||
"huntEndTimeUtc": "2022-03-12T09:47:15.438Z", | ||
"labels": [ | ||
"Label1", | ||
"Label2" | ||
], | ||
"owner": { | ||
"objectId": "873b5263-5d34-4149-b356-ad341b01e123", | ||
"email": "[email protected]", | ||
"assignedTo": null, | ||
"userPrincipalName": "John Doe", | ||
"ownerType": "User" | ||
} | ||
} | ||
} | ||
} | ||
} | ||
} |
56 changes: 56 additions & 0 deletions
56
...crosoft.SecurityInsights/preview/2023-04-01-preview/examples/hunts/CreateHuntComment.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,56 @@ | ||
{ | ||
"parameters": { | ||
"api-version": "2023-04-01-preview", | ||
"subscriptionId": "bd794837-4d29-4647-9105-6339bfdb4e6a", | ||
"resourceGroupName": "myRg", | ||
"workspaceName": "myWorkspace", | ||
"operationalInsightsResourceProvider": "Microsoft.OperationalInsights", | ||
"huntId": "163e7b2a-a2ec-4041-aaba-d878a38f265f", | ||
"huntCommentId": "2216d0e1-91e3-4902-89fd-d2df8c535096", | ||
"huntComment": { | ||
"properties": { | ||
"message": "This is a test comment." | ||
} | ||
} | ||
}, | ||
"responses": { | ||
"200": { | ||
"body": { | ||
"id": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/avdvirint/providers/Microsoft.SecurityInsights/hunts/163e7b2a-a2ec-4041-aaba-d878a38f265f/comments/2216d0e1-91e3-4902-89fd-d2df8c123456", | ||
"name": "2216d0e1-91e3-4902-89fd-d2df8c123456", | ||
"etag": "\"3102f74d-0000-0c00-0000-629e6e050000\"", | ||
"type": "Microsoft.SecurityInsights/hunts/comments", | ||
"systemData": { | ||
"createdAt": "2021-08-15T16:42:38.8709453Z", | ||
"createdBy": "[email protected]", | ||
"createdByType": "User", | ||
"lastModifiedAt": "2021-08-19T16:42:38.8709453Z", | ||
"lastModifiedBy": "[email protected]", | ||
"lastModifiedByType": "User" | ||
}, | ||
"properties": { | ||
"message": "This is a test comment." | ||
} | ||
} | ||
}, | ||
"201": { | ||
"body": { | ||
"id": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/avdvirint/providers/Microsoft.SecurityInsights/hunts/163e7b2a-a2ec-4041-aaba-d878a38f265f/comments/2216d0e1-91e3-4902-89fd-d2df8c123456", | ||
"name": "2216d0e1-91e3-4902-89fd-d2df8c123456", | ||
"etag": "\"3102f74d-0000-0c00-0000-629e6e050000\"", | ||
"type": "Microsoft.SecurityInsights/hunts/comments", | ||
"systemData": { | ||
"createdAt": "2021-08-15T16:42:38.8709453Z", | ||
"createdBy": "[email protected]", | ||
"createdByType": "User", | ||
"lastModifiedAt": "2021-08-19T16:42:38.8709453Z", | ||
"lastModifiedBy": "[email protected]", | ||
"lastModifiedByType": "User" | ||
}, | ||
"properties": { | ||
"message": "This is a test comment." | ||
} | ||
} | ||
} | ||
} | ||
} |
53 changes: 53 additions & 0 deletions
53
...rosoft.SecurityInsights/preview/2023-04-01-preview/examples/hunts/CreateHuntRelation.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,53 @@ | ||
{ | ||
"parameters": { | ||
"api-version": "2023-04-01-preview", | ||
"subscriptionId": "bd794837-4d29-4647-9105-6339bfdb4e6a", | ||
"resourceGroupName": "myRg", | ||
"workspaceName": "myWorkspace", | ||
"operationalInsightsResourceProvider": "Microsoft.OperationalInsights", | ||
"huntId": "163e7b2a-a2ec-4041-aaba-d878a38f265f", | ||
"huntRelationId": "2216d0e1-91e3-4902-89fd-d2df8c535096", | ||
"huntRelation": { | ||
"properties": { | ||
"relatedResourceId": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/avdvirint/providers/Microsoft.SecurityInsights/Bookmarks/2216d0e1-91e3-4902-89fd-d2df8c535096", | ||
"labels": [ | ||
"Test Label" | ||
] | ||
} | ||
} | ||
}, | ||
"responses": { | ||
"200": { | ||
"body": { | ||
"id": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/avdvirint/providers/Microsoft.SecurityInsights/hunts/163e7b2a-a2ec-4041-aaba-d878a38f265f/relations/2216d0e1-91e3-4902-89fd-d2df8c535096", | ||
"name": "2216d0e1-91e3-4902-89fd-d2df8c535096", | ||
"etag": "\"26012da2-0000-0c00-0000-627ad2760000\"", | ||
"type": "Microsoft.SecurityInsights/hunts/relations", | ||
"properties": { | ||
"relatedResourceId": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/avdvirint/providers/Microsoft.SecurityInsights/Bookmarks/2216d0e1-91e3-4902-89fd-d2df8c535096", | ||
"relatedResourceName": "2216d0e1-91e3-4902-89fd-d2df8c535096", | ||
"relatedResourceType": "Microsoft.SecurityInsights/Bookmarks", | ||
"labels": [ | ||
"Test Label" | ||
] | ||
} | ||
} | ||
}, | ||
"201": { | ||
"body": { | ||
"id": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/avdvirint/providers/Microsoft.SecurityInsights/hunts/163e7b2a-a2ec-4041-aaba-d878a38f265f/relations/2216d0e1-91e3-4902-89fd-d2df8c535096", | ||
"name": "2216d0e1-91e3-4902-89fd-d2df8c535096", | ||
"etag": "\"26012da2-0000-0c00-0000-627ad2760000\"", | ||
"type": "Microsoft.SecurityInsights/hunts/relations", | ||
"properties": { | ||
"relatedResourceId": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/avdvirint/providers/Microsoft.SecurityInsights/Bookmarks/2216d0e1-91e3-4902-89fd-d2df8c535096", | ||
"relatedResourceName": "2216d0e1-91e3-4902-89fd-d2df8c535096", | ||
"relatedResourceType": "Microsoft.SecurityInsights/Bookmarks", | ||
"labels": [ | ||
"Test Label" | ||
] | ||
} | ||
} | ||
} | ||
} | ||
} |
14 changes: 14 additions & 0 deletions
14
...ager/Microsoft.SecurityInsights/preview/2023-04-01-preview/examples/hunts/DeleteHunt.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,14 @@ | ||
{ | ||
"parameters": { | ||
"api-version": "2023-04-01-preview", | ||
"subscriptionId": "bd794837-4d29-4647-9105-6339bfdb4e6a", | ||
"resourceGroupName": "myRg", | ||
"workspaceName": "myWorkspace", | ||
"operationalInsightsResourceProvider": "Microsoft.OperationalInsights", | ||
"huntId": "163e7b2a-a2ec-4041-aaba-d878a38f265f" | ||
}, | ||
"responses": { | ||
"200": {}, | ||
"204": {} | ||
} | ||
} |
15 changes: 15 additions & 0 deletions
15
...crosoft.SecurityInsights/preview/2023-04-01-preview/examples/hunts/DeleteHuntComment.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,15 @@ | ||
{ | ||
"parameters": { | ||
"api-version": "2023-04-01-preview", | ||
"subscriptionId": "bd794837-4d29-4647-9105-6339bfdb4e6a", | ||
"resourceGroupName": "myRg", | ||
"workspaceName": "myWorkspace", | ||
"operationalInsightsResourceProvider": "Microsoft.OperationalInsights", | ||
"huntId": "163e7b2a-a2ec-4041-aaba-d878a38f265f", | ||
"huntCommentId": "2216d0e1-91e3-4902-89fd-d2df8c123456" | ||
}, | ||
"responses": { | ||
"200": {}, | ||
"204": {} | ||
} | ||
} |
15 changes: 15 additions & 0 deletions
15
...rosoft.SecurityInsights/preview/2023-04-01-preview/examples/hunts/DeleteHuntRelation.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,15 @@ | ||
{ | ||
"parameters": { | ||
"api-version": "2023-04-01-preview", | ||
"subscriptionId": "bd794837-4d29-4647-9105-6339bfdb4e6a", | ||
"resourceGroupName": "myRg", | ||
"workspaceName": "myWorkspace", | ||
"operationalInsightsResourceProvider": "Microsoft.OperationalInsights", | ||
"huntId": "163e7b2a-a2ec-4041-aaba-d878a38f265f", | ||
"huntRelationId": "2216d0e1-91e3-4902-89fd-d2df8c535096" | ||
}, | ||
"responses": { | ||
"200": {}, | ||
"204": {} | ||
} | ||
} |
43 changes: 43 additions & 0 deletions
43
...ger/Microsoft.SecurityInsights/preview/2023-04-01-preview/examples/hunts/GetHuntById.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,43 @@ | ||
{ | ||
"parameters": { | ||
"api-version": "2023-04-01-preview", | ||
"subscriptionId": "bd794837-4d29-4647-9105-6339bfdb4e6a", | ||
"resourceGroupName": "myRg", | ||
"workspaceName": "myWorkspace", | ||
"operationalInsightsResourceProvider": "Microsoft.OperationalInsights", | ||
"huntId": "163e7b2a-a2ec-4041-aaba-d878a38f265f" | ||
}, | ||
"responses": { | ||
"200": { | ||
"body": { | ||
"id": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/hunts/163e7b2a-a2ec-4041-aaba-d878a38f265f", | ||
"name": "163e7b2a-a2ec-4041-aaba-d878a38f265f", | ||
"etag": "\"de00c408-0000-0c00-0000-62741e350000\"", | ||
"type": "Microsoft.SecurityInsights/hunts", | ||
"properties": { | ||
"displayName": "Log4J new hunt ", | ||
"description": "Log4J Hunt Description", | ||
"status": "New", | ||
"hypothesisStatus": "Unknown", | ||
"attackTactics": [ | ||
"Reconnaissance" | ||
], | ||
"attackTechniques": [ | ||
"T1595" | ||
], | ||
"labels": [ | ||
"Label1", | ||
"Label2" | ||
], | ||
"owner": { | ||
"objectId": "873b5263-5d34-4149-b356-ad341b01e123", | ||
"email": "[email protected]", | ||
"assignedTo": null, | ||
"userPrincipalName": "John Doe", | ||
"ownerType": "User" | ||
} | ||
} | ||
} | ||
} | ||
} | ||
} |
32 changes: 32 additions & 0 deletions
32
...rosoft.SecurityInsights/preview/2023-04-01-preview/examples/hunts/GetHuntCommentById.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,32 @@ | ||
{ | ||
"parameters": { | ||
"api-version": "2023-04-01-preview", | ||
"subscriptionId": "bd794837-4d29-4647-9105-6339bfdb4e6a", | ||
"resourceGroupName": "myRg", | ||
"workspaceName": "myWorkspace", | ||
"operationalInsightsResourceProvider": "Microsoft.OperationalInsights", | ||
"huntId": "163e7b2a-a2ec-4041-aaba-d878a38f265f", | ||
"huntCommentId": "2216d0e1-91e3-4902-89fd-d2df8c535096" | ||
}, | ||
"responses": { | ||
"200": { | ||
"body": { | ||
"id": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/avdvirint/providers/Microsoft.SecurityInsights/hunts/163e7b2a-a2ec-4041-aaba-d878a38f265f/comments/2216d0e1-91e3-4902-89fd-d2df8c123456", | ||
"name": "2216d0e1-91e3-4902-89fd-d2df8c123456", | ||
"etag": "\"3102f74d-0000-0c00-0000-629e6e050000\"", | ||
"type": "Microsoft.SecurityInsights/hunts/comments", | ||
"systemData": { | ||
"createdAt": "2021-08-15T16:42:38.8709453Z", | ||
"createdBy": "[email protected]", | ||
"createdByType": "User", | ||
"lastModifiedAt": "2021-08-19T16:42:38.8709453Z", | ||
"lastModifiedBy": "[email protected]", | ||
"lastModifiedByType": "User" | ||
}, | ||
"properties": { | ||
"message": "This is a comment." | ||
} | ||
} | ||
} | ||
} | ||
} |
27 changes: 27 additions & 0 deletions
27
...Microsoft.SecurityInsights/preview/2023-04-01-preview/examples/hunts/GetHuntComments.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,27 @@ | ||
{ | ||
"parameters": { | ||
"api-version": "2023-04-01-preview", | ||
"subscriptionId": "bd794837-4d29-4647-9105-6339bfdb4e6a", | ||
"resourceGroupName": "myRg", | ||
"workspaceName": "myWorkspace", | ||
"operationalInsightsResourceProvider": "Microsoft.OperationalInsights", | ||
"huntId": "163e7b2a-a2ec-4041-aaba-d878a38f265f" | ||
}, | ||
"responses": { | ||
"200": { | ||
"body": { | ||
"value": [ | ||
{ | ||
"id": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/avdvirint/providers/Microsoft.SecurityInsights/hunts/163e7b2a-a2ec-4041-aaba-d878a38f265f/comments/2216d0e1-91e3-4902-89fd-d2df8c123456", | ||
"name": "2216d0e1-91e3-4902-89fd-d2df8c123456", | ||
"etag": "\"3102f74d-0000-0c00-0000-629e6e050000\"", | ||
"type": "Microsoft.SecurityInsights/hunts/comments", | ||
"properties": { | ||
"message": "This is a test comment." | ||
} | ||
} | ||
] | ||
} | ||
} | ||
} | ||
} |
29 changes: 29 additions & 0 deletions
29
...osoft.SecurityInsights/preview/2023-04-01-preview/examples/hunts/GetHuntRelationById.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,29 @@ | ||
{ | ||
"parameters": { | ||
"api-version": "2023-04-01-preview", | ||
"subscriptionId": "bd794837-4d29-4647-9105-6339bfdb4e6a", | ||
"resourceGroupName": "myRg", | ||
"workspaceName": "myWorkspace", | ||
"operationalInsightsResourceProvider": "Microsoft.OperationalInsights", | ||
"huntId": "163e7b2a-a2ec-4041-aaba-d878a38f265f", | ||
"huntRelationId": "2216d0e1-91e3-4902-89fd-d2df8c535096" | ||
}, | ||
"responses": { | ||
"200": { | ||
"body": { | ||
"id": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/avdvirint/providers/Microsoft.SecurityInsights/hunts/163e7b2a-a2ec-4041-aaba-d878a38f265f/relations/2216d0e1-91e3-4902-89fd-d2df8c535096", | ||
"name": "2216d0e1-91e3-4902-89fd-d2df8c535096", | ||
"etag": "\"26012da2-0000-0c00-0000-627ad2760000\"", | ||
"type": "Microsoft.SecurityInsights/hunts/relations", | ||
"properties": { | ||
"relatedResourceId": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/avdvirint/providers/Microsoft.SecurityInsights/Bookmarks/2216d0e1-91e3-4902-89fd-d2df8c535096", | ||
"relatedResourceName": "2216d0e1-91e3-4902-89fd-d2df8c535096", | ||
"relatedResourceType": "Microsoft.SecurityInsights/Bookmarks", | ||
"labels": [ | ||
"label1" | ||
] | ||
} | ||
} | ||
} | ||
} | ||
} |
Oops, something went wrong.