diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/Metadata.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/Metadata.json
new file mode 100644
index 000000000000..9b735e4bfc08
--- /dev/null
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/Metadata.json
@@ -0,0 +1,777 @@
+{
+  "swagger": "2.0",
+  "info": {
+    "title": "Security Insights",
+    "description": "API spec for Microsoft.SecurityInsights (Azure Security Insights) resource provider",
+    "version": "2021-03-01-preview"
+  },
+  "host": "management.azure.com",
+  "schemes": [
+    "https"
+  ],
+  "consumes": [
+    "application/json"
+  ],
+  "produces": [
+    "application/json"
+  ],
+  "security": [
+    {
+      "azure_auth": [
+        "user_impersonation"
+      ]
+    }
+  ],
+  "securityDefinitions": {
+    "azure_auth": {
+      "type": "oauth2",
+      "authorizationUrl": "https://login.microsoftonline.com/common/oauth2/authorize",
+      "flow": "implicit",
+      "description": "Azure Active Directory OAuth2 Flow",
+      "scopes": {
+        "user_impersonation": "impersonate your user account"
+      }
+    }
+  },
+  "paths": {
+    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/metadata": {
+      "get": {
+        "x-ms-examples": {
+          "Get all metadata.": {
+            "$ref": "./examples/metadata/GetAllMetadata.json"
+          },
+          "Get all metadata with OData filter/orderby/skip/top": {
+            "$ref": "./examples/metadata/GetAllMetadataOData.json"
+          }
+        },
+        "tags": [
+          "Metadata"
+        ],
+        "description": "List of all metadata",
+        "operationId": "Metadata_List",
+        "parameters": [
+          {
+            "$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
+          },
+          {
+            "$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/SubscriptionIdParameter"
+          },
+          {
+            "$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ResourceGroupNameParameter"
+          },
+          {
+            "$ref": "../../../common/1.0/types.json#/parameters/OperationalInsightsResourceProvider"
+          },
+          {
+            "$ref": "../../../common/1.0/types.json#/parameters/WorkspaceName"
+          },
+          {
+            "$ref": "#/parameters/ODataFilter"
+          },
+          {
+            "$ref": "#/parameters/ODataOrderBy"
+          },
+          {
+            "$ref": "#/parameters/ODataTop"
+          },
+          {
+            "$ref": "#/parameters/ODataSkip"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK",
+            "schema": {
+              "$ref": "#/definitions/MetadataList"
+            }
+          },
+          "default": {
+            "description": "Error response describing why the operation failed.",
+            "schema": {
+              "$ref": "../../../common/1.0/types.json#/definitions/CloudError"
+            }
+          }
+        },
+        "x-ms-pageable": {
+          "nextLinkName": "nextLink"
+        }
+      }
+    },
+    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{operationalInsightsResourceProvider}/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/metadata/{metadataName}": {
+      "get": {
+        "x-ms-examples": {
+          "Get single metadata by name": {
+            "$ref": "./examples/metadata/GetMetadata.json"
+          }
+        },
+        "tags": [
+          "Metadata"
+        ],
+        "description": "Get a Metadata.",
+        "operationId": "Metadata_Get",
+        "parameters": [
+          {
+            "$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
+          },
+          {
+            "$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/SubscriptionIdParameter"
+          },
+          {
+            "$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ResourceGroupNameParameter"
+          },
+          {
+            "$ref": "../../../common/1.0/types.json#/parameters/OperationalInsightsResourceProvider"
+          },
+          {
+            "$ref": "../../../common/1.0/types.json#/parameters/WorkspaceName"
+          },
+          {
+            "$ref": "#/parameters/MetadataName"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK",
+            "schema": {
+              "$ref": "#/definitions/MetadataModel"
+            }
+          },
+          "default": {
+            "description": "Error response describing why the operation failed.",
+            "schema": {
+              "$ref": "../../../common/1.0/types.json#/definitions/CloudError"
+            }
+          }
+        }
+      },
+      "delete": {
+        "x-ms-examples": {
+          "Delete metadata.": {
+            "$ref": "./examples/metadata/DeleteMetadata.json"
+          }
+        },
+        "tags": [
+          "Metadata"
+        ],
+        "description": "Delete a Metadata.",
+        "operationId": "Metadata_Delete",
+        "parameters": [
+          {
+            "$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
+          },
+          {
+            "$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/SubscriptionIdParameter"
+          },
+          {
+            "$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ResourceGroupNameParameter"
+          },
+          {
+            "$ref": "../../../common/1.0/types.json#/parameters/OperationalInsightsResourceProvider"
+          },
+          {
+            "$ref": "../../../common/1.0/types.json#/parameters/WorkspaceName"
+          },
+          {
+            "$ref": "#/parameters/MetadataName"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK"
+          },
+          "204": {
+            "description": "No Content"
+          },
+          "default": {
+            "description": "Error response describing why the operation failed.",
+            "schema": {
+              "$ref": "../../../common/1.0/types.json#/definitions/CloudError"
+            }
+          }
+        }
+      },
+      "put": {
+        "x-ms-examples": {
+          "Create/update full metadata.": {
+            "$ref": "./examples/metadata/PutMetadata.json"
+          },
+          "Create/update minimal metadata.": {
+            "$ref": "./examples/metadata/PutMetadataMinimal.json"
+          }
+        },
+        "tags": [
+          "Metadata"
+        ],
+        "description": "Create a Metadata.",
+        "operationId": "Metadata_Create",
+        "parameters": [
+          {
+            "$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
+          },
+          {
+            "$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/SubscriptionIdParameter"
+          },
+          {
+            "$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ResourceGroupNameParameter"
+          },
+          {
+            "$ref": "../../../common/1.0/types.json#/parameters/OperationalInsightsResourceProvider"
+          },
+          {
+            "$ref": "../../../common/1.0/types.json#/parameters/WorkspaceName"
+          },
+          {
+            "$ref": "#/parameters/MetadataName"
+          },
+          {
+            "$ref": "#/parameters/Metadata"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK, Operation successfully completed",
+            "schema": {
+              "$ref": "#/definitions/MetadataModel"
+            }
+          },
+          "201": {
+            "description": "Created",
+            "schema": {
+              "$ref": "#/definitions/MetadataModel"
+            }
+          },
+          "default": {
+            "description": "Error response describing why the operation failed.",
+            "schema": {
+              "$ref": "../../../common/1.0/types.json#/definitions/CloudError"
+            }
+          }
+        }
+      },
+      "patch": {
+        "x-ms-examples": {
+          "Update metadata.": {
+            "$ref": "./examples/metadata/PatchMetadata.json"
+          }
+        },
+        "tags": [
+          "Metadata"
+        ],
+        "description": "Update an existing Metadata.",
+        "operationId": "Metadata_Update",
+        "parameters": [
+          {
+            "$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter"
+          },
+          {
+            "$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/SubscriptionIdParameter"
+          },
+          {
+            "$ref": "../../../../../common-types/resource-management/v2/types.json#/parameters/ResourceGroupNameParameter"
+          },
+          {
+            "$ref": "../../../common/1.0/types.json#/parameters/OperationalInsightsResourceProvider"
+          },
+          {
+            "$ref": "../../../common/1.0/types.json#/parameters/WorkspaceName"
+          },
+          {
+            "$ref": "#/parameters/MetadataName"
+          },
+          {
+            "$ref": "#/parameters/MetadataPatch"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK",
+            "schema": {
+              "$ref": "#/definitions/MetadataModel"
+            }
+          },
+          "default": {
+            "description": "Error response describing why the operation failed.",
+            "schema": {
+              "$ref": "../../../common/1.0/types.json#/definitions/CloudError"
+            }
+          }
+        }
+      }
+    }
+  },
+  "definitions": {
+    "MetadataList": {
+      "description": "List of all the metadata.",
+      "type": "object",
+      "properties": {
+        "value": {
+          "description": "Array of metadata.",
+          "items": {
+            "$ref": "#/definitions/MetadataModel"
+          },
+          "type": "array"
+        },
+        "nextLink": {
+          "description": "URL to fetch the next page of metadata.",
+          "readOnly": true,
+          "type": "string"
+        }
+      },
+      "required": [
+        "value"
+      ]
+    },
+    "MetadataModel": {
+      "type": "object",
+      "allOf": [
+        {
+          "$ref": "../../../common/1.0/types.json#/definitions/ResourceWithEtag"
+        }
+      ],
+      "description": "Metadata resource definition.",
+      "properties": {
+        "properties": {
+          "$ref": "#/definitions/metadataProperties",
+          "description": "Metadata properties",
+          "x-ms-client-flatten": true
+        }
+      }
+    },
+    "metadataPatch": {
+      "allOf": [
+        {
+          "$ref": "../../../common/1.0/types.json#/definitions/ResourceWithEtag"
+        }
+      ],
+      "description": "Metadata patch request body.",
+      "type": "object",
+      "properties": {
+        "properties": {
+          "$ref": "#/definitions/metadataPropertiesPatch",
+          "description": "Metadata patch request body",
+          "x-ms-client-flatten": true
+        }
+      }
+    },
+    "metadataContentId": {
+      "description": "Static ID for the content.  Used to identify dependencies and content from solutions or community.  Hard-coded/static for out of the box content and solutions. Dynamic for user-created.  This is the resource name",
+      "type": "string"
+    },
+    "metadataParentId": {
+      "description": "Full parent resource ID of the content item the metadata is for.  This is the full resource ID including the scope (subscription and resource group)",
+      "type": "string"
+    },
+    "metadataVersion": {
+      "description": "Version of the content.  Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM template best practices.  Can also be any string, but then we cannot guarantee any version checks",
+      "type": "string"
+    },
+    "metadataKind": {
+      "type": "string",
+      "description": "The kind of content the metadata is for.",
+      "enum": [
+        "dataConnector",
+        "dataType",
+        "workbook",
+        "workbookTemplate",
+        "playbook",
+        "playbookTemplate",
+        "analyticRuleTemplate",
+        "analyticRule",
+        "huntingQuery",
+        "investigationQuery",
+        "parser",
+        "watchlist",
+        "watchlistTemplate",
+        "solution"
+      ],
+      "x-ms-enum": {
+        "modelAsString": true,
+        "name": "kind",
+        "values": [
+          {
+            "value": "dataConnector"
+          },
+          {
+            "value": "dataType"
+          },
+          {
+            "value": "workbook"
+          },
+          {
+            "value": "workbookTemplate"
+          },
+          {
+            "value": "playbook"
+          },
+          {
+            "value": "playbookTemplate"
+          },
+          {
+            "value": "analyticRuleTemplate"
+          },
+          {
+            "value": "analyticRule"
+          },
+          {
+            "value": "huntingQuery"
+          },
+          {
+            "value": "investigationQuery"
+          },
+          {
+            "value": "parser"
+          },
+          {
+            "value": "watchlist"
+          },
+          {
+            "value": "watchlistTemplate"
+          },
+          {
+            "value": "solution"
+          }
+        ]
+      }
+    },
+    "metadataSource": {
+      "description": "The original source of the content item, where it comes from.",
+      "type": "object",
+      "required": [
+        "kind"
+      ],
+      "properties": {
+        "kind": {
+          "description": "Source type of the content",
+          "type": "string",
+          "enum": [
+            "localWorkspace",
+            "community",
+            "solution",
+            "sourceRepository"
+          ],
+          "x-ms-enum": {
+            "modelAsString": true,
+            "name": "sourceKind",
+            "values": [
+              {
+                "value": "localWorkspace"
+              },
+              {
+                "value": "community"
+              },
+              {
+                "value": "solution"
+              },
+              {
+                "value": "sourceRepository"
+              }
+            ]
+          }
+        },
+        "name": {
+          "description": "Name of the content source.  The repo name, solution name, LA workspace name etc.",
+          "type": "string"
+        },
+        "sourceId": {
+          "description": "ID of the content source.  The solution ID, workspace ID, etc",
+          "type": "string"
+        }
+      }
+    },
+    "metadataAuthor": {
+      "type": "object",
+      "description": "Publisher or creator of the content item.",
+      "properties": {
+        "name": {
+          "description": "Name of the author. Company or person.",
+          "type": "string"
+        },
+        "email": {
+          "description": "Email of author contact",
+          "type": "string"
+        },
+        "link": {
+          "description": "Link for author/vendor page",
+          "type": "string"
+        }
+      }
+    },
+    "metadataSupport": {
+      "type": "object",
+      "description": "Support information for the content item.",
+      "required": [
+        "tier"
+      ],
+      "properties": {
+        "tier": {
+          "description": "Type of support for content item",
+          "type": "string",
+          "enum": [
+            "microsoft",
+            "developer",
+            "community"
+          ],
+          "x-ms-enum": {
+            "modelAsString": true,
+            "name": "supportTier",
+            "values": [
+              {
+                "value": "microsoft"
+              },
+              {
+                "value": "developer"
+              },
+              {
+                "value": "community"
+              }
+            ]
+          }
+        },
+        "name": {
+          "description": "Name of the support contact. Company or person.",
+          "type": "string"
+        },
+        "email": {
+          "description": "Email of support contact",
+          "type": "string"
+        },
+        "link": {
+          "description": "Link for support help, like to support page to open a ticket etc.",
+          "type": "string"
+        }
+      }
+    },
+    "metadataDependencies": {
+      "description": "Dependencies for the content item, what other content items it requires to work.  Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex dependencies.",
+      "type": "object",
+      "properties": {
+        "contentId": {
+          "description": "Id of the content item we depend on",
+          "$ref": "#/definitions/metadataContentId"
+        },
+        "kind": {
+          "description": "Type of the content item we depend on",
+          "$ref": "#/definitions/metadataKind"
+        },
+        "version": {
+          "description": "Version of the the content item we depend on.  Can be blank, * or missing to indicate any version fulfills the dependency.  If version does not match our defined numeric format then an exact match is required.",
+          "$ref": "#/definitions/metadataVersion"
+        },
+        "name": {
+          "description": "Name of the content item",
+          "type": "string"
+        },
+        "operator": {
+          "description": "Operator used for list of dependencies in criteria array.",
+          "type": "string",
+          "enum": [
+            "AND",
+            "OR"
+          ],
+          "x-ms-enum": {
+            "modelAsString": true,
+            "name": "operator",
+            "values": [
+              {
+                "value": "AND"
+              },
+              {
+                "value": "OR"
+              }
+            ]
+          }
+        },
+        "criteria": {
+          "description": "This is the list of dependencies we must fulfill, according to the AND/OR operator",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/metadataDependencies",
+            "description": "Dependencies for the content item, what other content items it requires to work.  Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats."
+          }
+        }
+      }
+    },
+    "metadataProperties": {
+      "description": "Metadata property bag.",
+      "required": [
+        "contentId",
+        "parentId",
+        "kind"
+      ],
+      "type": "object",
+      "properties": {
+        "contentId": {
+          "$ref": "#/definitions/metadataContentId",
+          "description": "Static ID for the content.  Used to identify dependencies and content from solutions or community.  Hard-coded/static for out of the box content and solutions. Dynamic for user-created.  This is the resource name"
+        },
+        "parentId": {
+          "$ref": "#/definitions/metadataParentId",
+          "description": "Full parent resource ID of the content item the metadata is for.  This is the full resource ID including the scope (subscription and resource group)"
+        },
+        "version": {
+          "$ref": "#/definitions/metadataVersion",
+          "description": "Version of the content.  Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM template best practices.  Can also be any string, but then we cannot guarantee any version checks"
+        },
+        "kind": {
+          "$ref": "#/definitions/metadataKind",
+          "description": "The kind of content the metadata is for."
+        },
+        "source": {
+          "$ref": "#/definitions/metadataSource",
+          "description": "Source of the content.  This is where/how it was created."
+        },
+        "author": {
+          "$ref": "#/definitions/metadataAuthor",
+          "description": "The creator of the content item."
+        },
+        "support": {
+          "$ref": "#/definitions/metadataSupport",
+          "description": "Support information for the metadata - type, name, contact information"
+        },
+        "dependencies": {
+          "$ref": "#/definitions/metadataDependencies",
+          "description": "Dependencies for the content item, what other content items it requires to work.  Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats."
+        }
+      }
+    },
+    "metadataPropertiesPatch": {
+      "description": "Metadata property bag for patch requests.  This is the same as the MetadataProperties, but with nothing required",
+      "type": "object",
+      "properties": {
+        "contentId": {
+          "$ref": "#/definitions/metadataContentId",
+          "description": "Static ID for the content.  Used to identify dependencies and content from solutions or community.  Hard-coded/static for out of the box content and solutions. Dynamic for user-created.  This is the resource name"
+        },
+        "parentId": {
+          "$ref": "#/definitions/metadataParentId",
+          "description": "Full parent resource ID of the content item the metadata is for.  This is the full resource ID including the scope (subscription and resource group)"
+        },
+        "version": {
+          "$ref": "#/definitions/metadataVersion",
+          "description": "Version of the content.  Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM template best practices.  Can also be any string, but then we cannot guarantee any version checks"
+        },
+        "kind": {
+          "$ref": "#/definitions/metadataKind",
+          "description": "The kind of content the metadata is for."
+        },
+        "source": {
+          "$ref": "#/definitions/metadataSource",
+          "description": "Source of the content.  This is where/how it was created."
+        },
+        "author": {
+          "$ref": "#/definitions/metadataAuthor",
+          "description": "The creator of the content item."
+        },
+        "support": {
+          "$ref": "#/definitions/metadataSupport",
+          "description": "Support information for the metadata - type, name, contact information"
+        },
+        "dependencies": {
+          "$ref": "#/definitions/metadataDependencies",
+          "description": "Dependencies for the content item, what other content items it requires to work.  Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats."
+        }
+      }
+    }
+  },
+  "parameters": {
+    "Metadata": {
+      "description": "Metadata resource.",
+      "in": "body",
+      "name": "metadata",
+      "required": true,
+      "schema": {
+        "$ref": "#/definitions/MetadataModel"
+      },
+      "x-ms-parameter-location": "method"
+    },
+    "MetadataPatch": {
+      "description": "Partial metadata request.",
+      "in": "body",
+      "name": "metadataPatch",
+      "required": true,
+      "schema": {
+        "$ref": "#/definitions/metadataPatch"
+      },
+      "x-ms-parameter-location": "method"
+    },
+    "MetadataName": {
+      "description": "The Metadata name.",
+      "in": "path",
+      "name": "metadataName",
+      "required": true,
+      "type": "string",
+      "x-ms-parameter-location": "method"
+    },
+    "SubscriptionId": {
+      "description": "Azure subscription ID",
+      "in": "path",
+      "name": "subscriptionId",
+      "pattern": "^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$",
+      "required": true,
+      "type": "string"
+    },
+    "ResourceGroupName": {
+      "description": "The name of the resource group within the user's subscription. The name is case insensitive.",
+      "in": "path",
+      "maxLength": 90,
+      "minLength": 1,
+      "name": "resourceGroupName",
+      "pattern": "^[-\\w\\._\\(\\)]+$",
+      "required": true,
+      "type": "string",
+      "x-ms-parameter-location": "method"
+    },
+    "WorkspaceName": {
+      "description": "The name of the workspace.",
+      "in": "path",
+      "name": "workspaceName",
+      "maxLength": 90,
+      "minLength": 1,
+      "required": true,
+      "type": "string",
+      "x-ms-parameter-location": "method"
+    },
+    "OperationalInsightsResourceProvider": {
+      "description": "The namespace of workspaces resource provider- Microsoft.OperationalInsights.",
+      "in": "path",
+      "name": "operationalInsightsResourceProvider",
+      "required": true,
+      "type": "string",
+      "x-ms-parameter-location": "method"
+    },
+    "ODataFilter": {
+      "description": "Filters the results, based on a Boolean condition. Optional.",
+      "in": "query",
+      "name": "$filter",
+      "required": false,
+      "type": "string",
+      "x-ms-parameter-location": "method"
+    },
+    "ODataOrderBy": {
+      "description": "Sorts the results. Optional.",
+      "in": "query",
+      "name": "$orderby",
+      "required": false,
+      "type": "string",
+      "x-ms-parameter-location": "method"
+    },
+    "ODataSkip": {
+      "description": "Used to skip n elements in the OData query (offset). Returns a nextLink to the next page of results if there are any left.",
+      "in": "query",
+      "name": "$skip",
+      "required": false,
+      "type": "integer",
+      "format": "int32",
+      "x-ms-parameter-location": "method"
+    },
+    "ODataTop": {
+      "description": "Returns only the first n results. Optional.",
+      "in": "query",
+      "name": "$top",
+      "required": false,
+      "type": "integer",
+      "format": "int32",
+      "x-ms-parameter-location": "method"
+    }
+  }
+}
diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/metadata/DeleteMetadata.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/metadata/DeleteMetadata.json
new file mode 100644
index 000000000000..6aa141539b2b
--- /dev/null
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/metadata/DeleteMetadata.json
@@ -0,0 +1,14 @@
+{
+  "parameters": {
+    "api-version": "2021-03-01-preview",
+    "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+    "resourceGroupName": "myRg",
+    "workspaceName": "myWorkspace",
+    "operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
+    "metadataName": "metadataName"
+  },
+  "responses": {
+    "200": {},
+    "204": {}
+  }
+}
diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/metadata/GetAllMetadata.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/metadata/GetAllMetadata.json
new file mode 100644
index 000000000000..6007e6681da4
--- /dev/null
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/metadata/GetAllMetadata.json
@@ -0,0 +1,65 @@
+{
+  "parameters": {
+    "api-version": "2021-03-01-preview",
+    "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+    "resourceGroupName": "myRg",
+    "workspaceName": "myWorkspace",
+    "operationalInsightsResourceProvider": "Microsoft.OperationalInsights"
+  },
+  "responses": {
+    "200": {
+      "body": {
+        "value": [
+          {
+            "id": "/subscriptions/2e1dc338-d04d-4443-b721-037eff4fdcac/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/metadata/metadataName1",
+            "name": "metadataName1",
+            "type": "Microsoft.SecurityInsights/metadata",
+            "properties": {
+              "contentId": "c00ee137-7475-47c8-9cce-ec6f0f1bedd0",
+              "version": "1.0.0.0",
+              "kind": "analyticRule",
+              "parentId": "/subscriptions/2e1dc338-d04d-4443-b721-037eff4fdcac/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/ruleName",
+              "source": {
+                "kind": "solution",
+                "name": "Contoso Solution 1.0",
+                "sourceId": "b688a130-76f4-4a07-bf57-762222a3cadf"
+              }
+            }
+          },
+          {
+            "id": "/subscriptions/2e1dc338-d04d-4443-b721-037eff4fdcac/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/metadata/metadataName2",
+            "name": "metadataName2",
+            "type": "Microsoft.SecurityInsights/metadata",
+            "properties": {
+              "contentId": "f5160682-0e10-4e23-8fcf-df3df49c5522",
+              "version": "1.0.0.0",
+              "kind": "analyticRule",
+              "parentId": "/subscriptions/2e1dc338-d04d-4443-b721-037eff4fdcac/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/ruleName2",
+              "source": {
+                "kind": "solution",
+                "name": "Contoso Solution 1.0",
+                "sourceId": "b688a130-76f4-4a07-bf57-762222a3cadf"
+              }
+            }
+          },
+          {
+            "id": "/subscriptions/2e1dc338-d04d-4443-b721-037eff4fdcac/resourceGroups/myRg/providers/Microsoft.Insights/workbooks/myWorkspace/providers/Microsoft.SecurityInsights/metadata/metadataName3",
+            "name": "metadataName3",
+            "type": "Microsoft.SecurityInsights/metadata",
+            "properties": {
+              "contentId": "f593501d-ec01-4057-8146-a1de35c461ef",
+              "version": "1.0.0.0",
+              "kind": "workbook",
+              "parentId": "/subscriptions/2e1dc338-d04d-4443-b721-037eff4fdcac/resourceGroups/myRg/providers/Microsoft.Insights/workbooks/workbookName",
+              "source": {
+                "kind": "solution",
+                "name": "Contoso Solution 1.0",
+                "sourceId": "b688a130-76f4-4a07-bf57-762222a3cadf"
+              }
+            }
+          }
+        ]
+      }
+    }
+  }
+}
diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/metadata/GetAllMetadataOData.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/metadata/GetAllMetadataOData.json
new file mode 100644
index 000000000000..eead11bcca11
--- /dev/null
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/metadata/GetAllMetadataOData.json
@@ -0,0 +1,53 @@
+{
+  "parameters": {
+    "api-version": "2021-03-01-preview",
+    "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+    "resourceGroupName": "myRg",
+    "workspaceName": "myWorkspace",
+    "operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
+    "ODataFilter": "properties/kind eq 'analyticRule'",
+    "ODataOrderBy": "properties/parentId desc",
+    "ODataSkip": "2",
+    "ODataTop": "2"
+  },
+  "responses": {
+    "200": {
+      "body": {
+        "value": [
+          {
+            "id": "/subscriptions/2e1dc338-d04d-4443-b721-037eff4fdcac/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/metadata/metadataName1",
+            "name": "metadataName1",
+            "type": "Microsoft.SecurityInsights/metadata",
+            "properties": {
+              "contentId": "c00ee137-7475-47c8-9cce-ec6f0f1bedd0",
+              "version": "1.0.0.0",
+              "kind": "analyticRule",
+              "parentId": "/subscriptions/2e1dc338-d04d-4443-b721-037eff4fdcac/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/ruleName1",
+              "source": {
+                "kind": "solution",
+                "name": "Contoso Solution 1.0",
+                "sourceId": "b688a130-76f4-4a07-bf57-762222a3cadf"
+              }
+            }
+          },
+          {
+            "id": "/subscriptions/2e1dc338-d04d-4443-b721-037eff4fdcac/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/metadata/metadataName2",
+            "name": "metadataName2",
+            "type": "Microsoft.SecurityInsights/metadata",
+            "properties": {
+              "contentId": "f5160682-0e10-4e23-8fcf-df3df49c5522",
+              "version": "1.0.0.0",
+              "kind": "analyticRule",
+              "parentId": "/subscriptions/2e1dc338-d04d-4443-b721-037eff4fdcac/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/ruleName2",
+              "source": {
+                "kind": "solution",
+                "name": "Contoso Solution 1.0",
+                "sourceId": "b688a130-76f4-4a07-bf57-762222a3cadf"
+              }
+            }
+          }
+        ]
+      }
+    }
+  }
+}
diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/metadata/GetMetadata.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/metadata/GetMetadata.json
new file mode 100644
index 000000000000..8d01ae218bca
--- /dev/null
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/metadata/GetMetadata.json
@@ -0,0 +1,72 @@
+{
+  "parameters": {
+    "api-version": "2021-03-01-preview",
+    "subscriptionId": "2e1dc338-d04d-4443-b721-037eff4fdcac",
+    "resourceGroupName": "myRg",
+    "workspaceName": "myWorkspace",
+    "operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
+    "metadataName": "metadataName"
+  },
+  "responses": {
+    "200": {
+      "body": {
+        "id": "/subscriptions/2e1dc338-d04d-4443-b721-037eff4fdcac/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/metadata/metadataName",
+        "name": "metadataName",
+        "type": "Microsoft.SecurityInsights/metadata",
+        "properties": {
+          "contentId": "c00ee137-7475-47c8-9cce-ec6f0f1bedd0",
+          "version": "1.0.0.0",
+          "kind": "analyticRule",
+          "parentId": "/subscriptions/2e1dc338-d04d-4443-b721-037eff4fdcac/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/ruleName",
+          "source": {
+            "kind": "solution",
+            "name": "Contoso Solution 1.0",
+            "sourceId": "b688a130-76f4-4a07-bf57-762222a3cadf"
+          },
+          "author": {
+            "name": "User Name",
+            "email": "email@microsoft.com"
+          },
+          "support": {
+            "name": "Microsoft",
+            "email": "support@microsoft.com",
+            "link": "https://support.microsoft.com/",
+            "tier": "developer"
+          },
+          "dependencies": {
+            "operator": "AND",
+            "criteria": [
+              {
+                "operator": "OR",
+                "criteria": [
+                  {
+                    "contentId": "045d06d0-ee72-4794-aba4-cf5646e4c756",
+                    "kind": "dataConnector"
+                  },
+                  {
+                    "contentId": "dbfcb2cc-d782-40ef-8d94-fe7af58a6f2d",
+                    "kind": "dataConnector"
+                  },
+                  {
+                    "contentId": "de4dca9b-eb37-47d6-a56f-b8b06b261593",
+                    "kind": "dataConnector",
+                    "version": "2.0"
+                  }
+                ]
+              },
+              {
+                "kind": "playbook",
+                "contentId": "31ee11cc-9989-4de8-b176-5e0ef5c4dbab",
+                "version": "1.0"
+              },
+              {
+                "kind": "parser",
+                "contentId": "21ba424a-9438-4444-953a-7059539a7a1b"
+              }
+            ]
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/metadata/PatchMetadata.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/metadata/PatchMetadata.json
new file mode 100644
index 000000000000..5b41f54be96b
--- /dev/null
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/metadata/PatchMetadata.json
@@ -0,0 +1,36 @@
+{
+  "parameters": {
+    "api-version": "2021-03-01-preview",
+    "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+    "resourceGroupName": "myRg",
+    "workspaceName": "myWorkspace",
+    "operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
+    "metadataName": "metadataName",
+    "metadataPatch": {
+      "properties": {
+        "author": {
+          "name": "User Name",
+          "email": "email@microsoft.com"
+        }
+      }
+    }
+  },
+  "responses": {
+    "200": {
+      "body": {
+        "id": "/subscriptions/2e1dc338-d04d-4443-b721-037eff4fdcac/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/metadata/metadataName",
+        "name": "metadataName",
+        "type": "Microsoft.SecurityInsights/metadata",
+        "properties": {
+          "contentId": "c00ee137-7475-47c8-9cce-ec6f0f1bedd0",
+          "kind": "analyticRule",
+          "parentId": "/subscriptions/2e1dc338-d04d-4443-b721-037eff4fdcac/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/ruleName",
+          "author": {
+            "name": "User Name",
+            "email": "email@microsoft.com"
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/metadata/PutMetadata.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/metadata/PutMetadata.json
new file mode 100644
index 000000000000..1cf87ee0e38e
--- /dev/null
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/metadata/PutMetadata.json
@@ -0,0 +1,188 @@
+{
+  "parameters": {
+    "api-version": "2021-03-01-preview",
+    "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+    "resourceGroupName": "myRg",
+    "workspaceName": "myWorkspace",
+    "operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
+    "metadataName": "metadataName",
+    "metadata": {
+      "properties": {
+        "contentId": "c00ee137-7475-47c8-9cce-ec6f0f1bedd0",
+        "version": "1.0.0.0",
+        "kind": "analyticRule",
+        "parentId": "/subscriptions/2e1dc338-d04d-4443-b721-037eff4fdcac/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/ruleName",
+        "source": {
+          "kind": "solution",
+          "name": "Contoso Solution 1.0",
+          "sourceId": "b688a130-76f4-4a07-bf57-762222a3cadf"
+        },
+        "author": {
+          "name": "User Name",
+          "email": "email@microsoft.com"
+        },
+        "support": {
+          "name": "Microsoft",
+          "email": "support@microsoft.com",
+          "link": "https://support.microsoft.com/",
+          "tier": "developer"
+        },
+        "dependencies": {
+          "operator": "AND",
+          "criteria": [
+            {
+              "operator": "OR",
+              "criteria": [
+                {
+                  "contentId": "045d06d0-ee72-4794-aba4-cf5646e4c756",
+                  "kind": "dataConnector",
+                  "name": "Microsoft Defender for Endpoint"
+                },
+                {
+                  "contentId": "dbfcb2cc-d782-40ef-8d94-fe7af58a6f2d",
+                  "kind": "dataConnector"
+                },
+                {
+                  "contentId": "de4dca9b-eb37-47d6-a56f-b8b06b261593",
+                  "kind": "dataConnector",
+                  "version": "2.0"
+                }
+              ]
+            },
+            {
+              "kind": "playbook",
+              "contentId": "31ee11cc-9989-4de8-b176-5e0ef5c4dbab",
+              "version": "1.0"
+            },
+            {
+              "kind": "parser",
+              "contentId": "21ba424a-9438-4444-953a-7059539a7a1b"
+            }
+          ]
+        }
+      }
+    }
+  },
+  "responses": {
+    "201": {
+      "body": {
+        "id": "/subscriptions/2e1dc338-d04d-4443-b721-037eff4fdcac/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/metadata/metadataName",
+        "name": "metadataName",
+        "type": "Microsoft.SecurityInsights/metadata",
+        "properties": {
+          "contentId": "c00ee137-7475-47c8-9cce-ec6f0f1bedd0",
+          "version": "1.0.0.0",
+          "kind": "analyticRule",
+          "parentId": "/subscriptions/2e1dc338-d04d-4443-b721-037eff4fdcac/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/ruleName",
+          "source": {
+            "kind": "solution",
+            "name": "Contoso Solution 1.0",
+            "sourceId": "b688a130-76f4-4a07-bf57-762222a3cadf"
+          },
+          "author": {
+            "name": "User Name",
+            "email": "email@microsoft.com"
+          },
+          "support": {
+            "name": "Microsoft",
+            "email": "support@microsoft.com",
+            "link": "https://support.microsoft.com/",
+            "tier": "developer"
+          },
+          "dependencies": {
+            "operator": "AND",
+            "criteria": [
+              {
+                "operator": "OR",
+                "criteria": [
+                  {
+                    "contentId": "045d06d0-ee72-4794-aba4-cf5646e4c756",
+                    "kind": "dataConnector"
+                  },
+                  {
+                    "contentId": "dbfcb2cc-d782-40ef-8d94-fe7af58a6f2d",
+                    "kind": "dataConnector"
+                  },
+                  {
+                    "contentId": "de4dca9b-eb37-47d6-a56f-b8b06b261593",
+                    "kind": "dataConnector",
+                    "version": "2.0"
+                  }
+                ]
+              },
+              {
+                "kind": "playbook",
+                "contentId": "31ee11cc-9989-4de8-b176-5e0ef5c4dbab",
+                "version": "1.0"
+              },
+              {
+                "kind": "parser",
+                "contentId": "21ba424a-9438-4444-953a-7059539a7a1b"
+              }
+            ]
+          }
+        }
+      }
+    },
+    "200": {
+      "body": {
+        "id": "/subscriptions/2e1dc338-d04d-4443-b721-037eff4fdcac/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/metadata/metadataName",
+        "name": "metadataName",
+        "type": "Microsoft.SecurityInsights/metadata",
+        "properties": {
+          "contentId": "c00ee137-7475-47c8-9cce-ec6f0f1bedd0",
+          "version": "1.0.0.0",
+          "kind": "analyticRule",
+          "parentId": "/subscriptions/2e1dc338-d04d-4443-b721-037eff4fdcac/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/ruleName",
+          "source": {
+            "kind": "solution",
+            "name": "Contoso Solution 1.0",
+            "sourceId": "b688a130-76f4-4a07-bf57-762222a3cadf"
+          },
+          "author": {
+            "name": "User Name",
+            "email": "email@microsoft.com"
+          },
+          "support": {
+            "name": "Microsoft",
+            "email": "support@microsoft.com",
+            "link": "https://support.microsoft.com/",
+            "tier": "developer"
+          },
+          "dependencies": {
+            "operator": "AND",
+            "criteria": [
+              {
+                "operator": "OR",
+                "criteria": [
+                  {
+                    "contentId": "045d06d0-ee72-4794-aba4-cf5646e4c756",
+                    "kind": "dataConnector"
+                  },
+                  {
+                    "contentId": "dbfcb2cc-d782-40ef-8d94-fe7af58a6f2d",
+                    "kind": "dataConnector"
+                  },
+                  {
+                    "contentId": "de4dca9b-eb37-47d6-a56f-b8b06b261593",
+                    "kind": "dataConnector",
+                    "version": "2.0"
+                  }
+                ]
+              },
+              {
+                "kind": "playbook",
+                "contentId": "31ee11cc-9989-4de8-b176-5e0ef5c4dbab",
+                "version": "1.0"
+              },
+              {
+                "kind": "parser",
+                "contentId": "21ba424a-9438-4444-953a-7059539a7a1b"
+              }
+            ]
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/metadata/PutMetadataMinimal.json b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/metadata/PutMetadataMinimal.json
new file mode 100644
index 000000000000..1d916bf7c02e
--- /dev/null
+++ b/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/metadata/PutMetadataMinimal.json
@@ -0,0 +1,43 @@
+{
+  "parameters": {
+    "api-version": "2021-03-01-preview",
+    "subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
+    "resourceGroupName": "myRg",
+    "workspaceName": "myWorkspace",
+    "operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
+    "metadataName": "metadataName",
+    "metadata": {
+      "properties": {
+        "contentId": "c00ee137-7475-47c8-9cce-ec6f0f1bedd0",
+        "kind": "analyticRule",
+        "parentId": "/subscriptions/2e1dc338-d04d-4443-b721-037eff4fdcac/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/ruleName"
+      }
+    }
+  },
+  "responses": {
+    "201": {
+      "body": {
+        "id": "/subscriptions/2e1dc338-d04d-4443-b721-037eff4fdcac/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/metadata/metadataName",
+        "name": "metadataName",
+        "type": "Microsoft.SecurityInsights/metadata",
+        "properties": {
+          "contentId": "c00ee137-7475-47c8-9cce-ec6f0f1bedd0",
+          "kind": "analyticRule",
+          "parentId": "/subscriptions/2e1dc338-d04d-4443-b721-037eff4fdcac/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/ruleName"
+        }
+      }
+    },
+    "200": {
+      "body": {
+        "id": "/subscriptions/2e1dc338-d04d-4443-b721-037eff4fdcac/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/metadata/metadataName",
+        "name": "metadataName",
+        "type": "Microsoft.SecurityInsights/metadata",
+        "properties": {
+          "contentId": "c00ee137-7475-47c8-9cce-ec6f0f1bedd0",
+          "kind": "analyticRule",
+          "parentId": "/subscriptions/2e1dc338-d04d-4443-b721-037eff4fdcac/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRules/ruleName"
+        }
+      }
+    }
+  }
+}
diff --git a/specification/securityinsights/resource-manager/readme.md b/specification/securityinsights/resource-manager/readme.md
index abe1bb10ddaf..e4d3d5647cd4 100644
--- a/specification/securityinsights/resource-manager/readme.md
+++ b/specification/securityinsights/resource-manager/readme.md
@@ -56,6 +56,7 @@ input-file:
 - Microsoft.SecurityInsights/preview/2021-03-01-preview/operations.json
 - Microsoft.SecurityInsights/preview/2021-03-01-preview/dataConnectors.json
 - Microsoft.SecurityInsights/preview/2021-03-01-preview/Watchlists.json
+- Microsoft.SecurityInsights/preview/2021-03-01-preview/Metadata.json
 directive:
   - suppress: R4017
     from: Microsoft.SecurityInsights/preview/2021-03-01-preview/Settings.json
@@ -73,6 +74,10 @@ directive:
     from: Microsoft.SecurityInsights/preview/2021-03-01-preview/OnboardingStates.json
     where: $.definitions.SentinelOnboardingState
     reason: The SentinelOnboardingState does not support list by subscription. It's not a top-level resource. To get the SentinelOnboardingState, we should have a subscription as well as a resource group and Log Analytics workspace.
+  - suppress: R4017
+    from: Microsoft.SecurityInsights/preview/2021-03-01-preview/Metadata.json
+    where: $.definitions.MetadataModel
+    reason: Metadata does not support list by subscription. It's not a top-level resource. To get a Metadata list, we should have a subscription as well as a resource group and Log Analytics workspace.
 ```
 
 ---