openapi-directory/api/azure.com/security-automations.json

Building & bundling https://github.com/APIs-guru/openapi-directory for easy use from JS

{"openapi":"3.0.0","info":{"description":"API spec for Microsoft.Security (Azure Security Center) resource provider","title":"Security Center","version":"2019-01-01-preview","x-apisguru-categories":["cloud"],"x-logo":{"url":"https://assets.onestore.ms/cdnfiles/onestorerolling-1606-01000/shell/v3/images/logo/microsoft.png"},"x-origin":[{"format":"swagger","url":"https://raw.githubusercontent.com/Azure/azure-rest-api-specs/master/specification/security/resource-manager/Microsoft.Security/preview/2019-01-01-preview/automations.json","version":"2.0"}],"x-providerName":"azure.com","x-serviceName":"security-automations","x-tags":["Azure","Microsoft"]},"security":[{"azure_auth":["user_impersonation"]}],"paths":{"/subscriptions/{subscriptionId}/providers/Microsoft.Security/automations":{"get":{"description":"Lists all the security automations in the specified subscription. Use the 'nextLink' property in the response to get the next page of security automations for the specified subscription.","operationId":"Automations_List","parameters":[{"description":"API version for the operation","in":"query","name":"api-version","required":true,"schema":{"type":"string"},"examples":{"List all security automations of a specified subscription":{"value":"2019-01-01-preview"}}},{"description":"Azure subscription ID","in":"path","name":"subscriptionId","required":true,"schema":{"type":"string","pattern":"^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"},"examples":{"List all security automations of a specified subscription":{"value":"a5caac9c-5c04-49af-b3d0-e204f40345d5"}}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AutomationList"},"examples":{"List all security automations of a specified subscription":{"$ref":"#/components/examples/List_all_security_automations_of_a_specified_subscription"}}}}},"default":{"description":"Error response that describes why the operation failed.","content":{"application/json":{"schema":{"description":"Error response structure.","properties":{"error":{"description":"Error details.","properties":{"code":{"description":"An identifier for the error. Codes are invariant and are intended to be consumed programmatically.","readOnly":true,"type":"string"},"message":{"description":"A message describing the error, intended to be suitable for display in a user interface.","readOnly":true,"type":"string"}},"type":"object","x-ms-external":true}},"type":"object","x-ms-external":true}}}}},"tags":["Automations"],"x-ms-pageable":{"nextLinkName":"nextLink"}}},"/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/automations":{"get":{"description":"Lists all the security automations in the specified resource group. Use the 'nextLink' property in the response to get the next page of security automations for the specified resource group.","operationId":"Automations_ListByResourceGroup","parameters":[{"description":"API version for the operation","in":"query","name":"api-version","required":true,"schema":{"type":"string"},"examples":{"List all security automations of a specified resource group":{"value":"2019-01-01-preview"}}},{"description":"Azure subscription ID","in":"path","name":"subscriptionId","required":true,"schema":{"type":"string","pattern":"^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"},"examples":{"List all security automations of a specified resource group":{"value":"a5caac9c-5c04-49af-b3d0-e204f40345d5"}}},{"description":"The name of the resource group within the user's subscription. The name is case insensitive.","in":"path","name":"resourceGroupName","required":true,"x-ms-parameter-location":"method","schema":{"type":"string","minLength":1,"maxLength":90,"pattern":"^[-\\w\\._\\(\\)]+$"},"examples":{"List all security automations of a specified resource group":{"value":"exampleResourceGroup"}}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AutomationList"},"examples":{"List all security automations of a specified resource group":{"$ref":"#/components/examples/List_all_security_automations_of_a_specified_resource_group"}}}}},"default":{"description":"Error response that describes why the operation failed.","content":{"application/json":{"schema":{"description":"Error response structure.","properties":{"error":{"description":"Error details.","properties":{"code":{"description":"An identifier for the error. Codes are invariant and are intended to be consumed programmatically.","readOnly":true,"type":"string"},"message":{"description":"A message describing the error, intended to be suitable for display in a user interface.","readOnly":true,"type":"string"}},"type":"object","x-ms-external":true}},"type":"object","x-ms-external":true}}}}},"tags":["Automations"],"x-ms-pageable":{"nextLinkName":"nextLink"}}},"/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/automations/{automationName}":{"delete":{"description":"Deletes a security automation.","operationId":"Automations_Delete","parameters":[{"description":"API version for the operation","in":"query","name":"api-version","required":true,"schema":{"type":"string"},"examples":{"Delete a security automation":{"value":"2019-01-01-preview"}}},{"description":"Azure subscription ID","in":"path","name":"subscriptionId","required":true,"schema":{"type":"string","pattern":"^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"},"examples":{"Delete a security automation":{"value":"20ff7fc3-e762-44dd-bd96-b71116dcdc23"}}},{"description":"The name of the resource group within the user's subscription. The name is case insensitive.","in":"path","name":"resourceGroupName","required":true,"x-ms-parameter-location":"method","schema":{"type":"string","minLength":1,"maxLength":90,"pattern":"^[-\\w\\._\\(\\)]+$"},"examples":{"Delete a security automation":{"value":"myRg"}}},{"$ref":"#/components/parameters/AutomationName"}],"responses":{"204":{"description":"NoContent"},"default":{"description":"Error response that describes why the operation failed.","content":{"application/json":{"schema":{"description":"Error response structure.","properties":{"error":{"description":"Error details.","properties":{"code":{"description":"An identifier for the error. Codes are invariant and are intended to be consumed programmatically.","readOnly":true,"type":"string"},"message":{"description":"A message describing the error, intended to be suitable for display in a user interface.","readOnly":true,"type":"string"}},"type":"object","x-ms-external":true}},"type":"object","x-ms-external":true}}}}},"tags":["Automations"]},"get":{"description":"Retrieves information about the model of a security automation.","operationId":"Automations_Get","parameters":[{"description":"API version for the operation","in":"query","name":"api-version","required":true,"schema":{"type":"string"},"examples":{"Retrieve a security automation":{"value":"2019-01-01-preview"}}},{"description":"Azure subscription ID","in":"path","name":"subscriptionId","required":true,"schema":{"type":"string","pattern":"^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"},"examples":{"Retrieve a security automation":{"value":"a5caac9c-5c04-49af-b3d0-e204f40345d5"}}},{"description":"The name of the resource group within the user's subscription. The name is case insensitive.","in":"path","name":"resourceGroupName","required":true,"x-ms-parameter-location":"method","schema":{"type":"string","minLength":1,"maxLength":90,"pattern":"^[-\\w\\._\\(\\)]+$"},"examples":{"Retrieve a security automation":{"value":"exampleResourceGroup"}}},{"$ref":"#/components/parameters/AutomationName"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Automation"},"examples":{"Retrieve a security automation":{"$ref":"#/components/examples/Retrieve_a_security_automation"}}}}},"default":{"description":"Error response that describes why the operation failed.","content":{"application/json":{"schema":{"description":"Error response structure.","properties":{"error":{"description":"Error details.","properties":{"code":{"description":"An identifier for the error. Codes are invariant and are intended to be consumed programmatically.","readOnly":true,"type":"string"},"message":{"description":"A message describing the error, intended to be suitable for display in a user interface.","readOnly":true,"type":"string"}},"type":"object","x-ms-external":true}},"type":"object","x-ms-external":true}}}}},"tags":["Automations"]},"put":{"description":"Creates or updates a security automation. If a security automation is already created and a subsequent request is issued for the same automation id, then it will be updated.","operationId":"Automations_CreateOrUpdate","parameters":[{"description":"API version for the operation","in":"query","name":"api-version","required":true,"schema":{"type":"string"},"examples":{"Create or update a security automation":{"value":"2019-01-01-preview"},"Disable or enable a security automation":{"value":"2019-01-01-preview"}}},{"description":"Azure subscription ID","in":"path","name":"subscriptionId","required":true,"schema":{"type":"string","pattern":"^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"},"examples":{"Create or update a security automation":{"value":"a5caac9c-5c04-49af-b3d0-e204f40345d5"},"Disable or enable a security automation":{"value":"a5caac9c-5c04-49af-b3d0-e204f40345d5"}}},{"description":"The name of the resource group within the user's subscription. The name is case insensitive.","in":"path","name":"resourceGroupName","required":true,"x-ms-parameter-location":"method","schema":{"type":"string","minLength":1,"maxLength":90,"pattern":"^[-\\w\\._\\(\\)]+$"},"examples":{"Create or update a security automation":{"value":"exampleResourceGroup"},"Disable or enable a security automation":{"value":"exampleResourceGroup"}}},{"$ref":"#/components/parameters/AutomationName"}],"requestBody":{"$ref":"#/components/requestBodies/Automation"},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Automation"},"examples":{"Create or update a security automation":{"$ref":"#/components/examples/Create_or_update_a_security_automation"},"Disable or enable a security automation":{"$ref":"#/components/examples/Disable_or_enable_a_security_automation"}}}}},"201":{"description":"Created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Automation"},"examples":{"Create or update a security automation":{"$ref":"#/components/examples/Create_or_update_a_security_automation"},"Disable or enable a security automation":{"$ref":"#/components/examples/Disable_or_enable_a_security_automation"}}}}},"default":{"description":"Error response that describes why the operation failed.","content":{"application/json":{"schema":{"description":"Error response structure.","properties":{"error":{"description":"Error details.","properties":{"code":{"description":"An identifier for the error. Codes are invariant and are intended to be consumed programmatically.","readOnly":true,"type":"string"},"message":{"description":"A message describing the error, intended to be suitable for display in a user interface.","readOnly":true,"type":"string"}},"type":"object","x-ms-external":true}},"type":"object","x-ms-external":true}}}}},"tags":["Automations"]}},"/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/automations/{automationName}/validate":{"post":{"description":"Validates the security automation model before create or update. Any validation errors are returned to the client.","operationId":"Automations_Validate","parameters":[{"description":"API version for the operation","in":"query","name":"api-version","required":true,"schema":{"type":"string"},"examples":{"Validate the security automation model before create or update":{"value":"2019-01-01-preview"}}},{"description":"Azure subscription ID","in":"path","name":"subscriptionId","required":true,"schema":{"type":"string","pattern":"^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$"},"examples":{"Validate the security automation model before create or update":{"value":"a5caac9c-5c04-49af-b3d0-e204f40345d5"}}},{"description":"The name of the resource group within the user's subscription. The name is case insensitive.","in":"path","name":"resourceGroupName","required":true,"x-ms-parameter-location":"method","schema":{"type":"string","minLength":1,"maxLength":90,"pattern":"^[-\\w\\._\\(\\)]+$"},"examples":{"Validate the security automation model before create or update":{"value":"exampleResourceGroup"}}},{"$ref":"#/components/parameters/AutomationName"}],"requestBody":{"$ref":"#/components/requestBodies/Automation"},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AutomationValidationStatus"},"examples":{"Validate the security automation model before create or update":{"$ref":"#/components/examples/Validate_the_security_automation_model_before_create_or_update"}}}}},"default":{"description":"Error response that describes why the operation failed.","content":{"application/json":{"schema":{"description":"Error response structure.","properties":{"error":{"description":"Error details.","properties":{"code":{"description":"An identifier for the error. Codes are invariant and are intended to be consumed programmatically.","readOnly":true,"type":"string"},"message":{"description":"A message describing the error, intended to be suitable for display in a user interface.","readOnly":true,"type":"string"}},"type":"object","x-ms-external":true}},"type":"object","x-ms-external":true}}}}},"tags":["Automations"]}}},"servers":[{"url":"https://management.azure.com"}],"components":{"examples":{"List_all_security_automations_of_a_specified_subscription":{"value":{"value":[{"etag":"etag value","id":"/subscriptions/a5caac9c-5c04-49af-b3d0-e204f40345d5/resourceGroups/exampleResourceGroup/providers/Microsoft.Security/automations/exampleAutomation","location":"Central US","name":"exampleAutomation","properties":{"actions":[{"actionType":"LogicApp","logicAppResourceId":"/subscriptions/e54a4a18-5b94-4f90-9471-bd3decad8a2e/resourceGroups/sample/providers/Microsoft.Logic/workflows/MyTest1"}],"description":"An example of a security automation that triggers one LogicApp resource (myTest1) on any security assessment of type customAssessment","isEnabled":true,"scopes":[{"description":"A description that helps to identify this scope - for example: security assessments that relate to the resource group myResourceGroup within the subscription a5caac9c-5c04-49af-b3d0-e204f40345d5","scopePath":"/subscriptions/a5caac9c-5c04-49af-b3d0-e204f40345d5/resourceGroups/myResourceGroup"}],"sources":[{"eventSource":"Assessments","ruleSets":[{"rules":[{"expectedValue":"customAssessment","operator":"Equals","propertyJPath":"$.Entity.AssessmentType","propertyType":"String"}]}]}]},"tags":{},"type":"Microsoft.Security/automations"}]}},"List_all_security_automations_of_a_specified_resource_group":{"value":{"value":[{"etag":"etag value","id":"/subscriptions/e4272367-5645-4c4e-9c67-3b74b59a6982/resourceGroups/exampleResourceGroup/providers/Microsoft.Security/automations/exampleAutomation","location":"Central US","name":"exampleAutomation","properties":{"actions":[{"actionType":"LogicApp","logicAppResourceId":"/subscriptions/e54a4a18-5b94-4f90-9471-bd3decad8a2e/resourceGroups/sample/providers/Microsoft.Logic/workflows/MyTest1"}],"description":"An example of a security automation that triggers one LogicApp resource (myTest1) on any security assessment of type customAssessment","isEnabled":true,"scopes":[{"description":"A description that helps to identify this scope - for example: security assessments that relate to the resource group myResourceGroup within the subscription a5caac9c-5c04-49af-b3d0-e204f40345d5","scopePath":"/subscriptions/a5caac9c-5c04-49af-b3d0-e204f40345d5/resourceGroups/myResourceGroup"}],"sources":[{"eventSource":"Assessments","ruleSets":[{"rules":[{"expectedValue":"customAssessment","operator":"Equals","propertyJPath":"$.Entity.AssessmentType","propertyType":"String"}]}]}]},"tags":{},"type":"Microsoft.Security/automations"}]}},"Retrieve_a_security_automation":{"value":{"etag":"etag value","id":"/subscriptions/a5caac9c-5c04-49af-b3d0-e204f40345d5/resourceGroups/exampleResourceGroup/providers/Microsoft.Security/automations/exampleAutomation","location":"Central US","name":"exampleAutomation","properties":{"actions":[{"actionType":"LogicApp","logicAppResourceId":"/subscriptions/e54a4a18-5b94-4f90-9471-bd3decad8a2e/resourceGroups/sample/providers/Microsoft.Logic/workflows/MyTest1"}],"description":"An example of a security automation that triggers one LogicApp resource (myTest1) on any security assessment of type customAssessment","isEnabled":true,"scopes":[{"description":"A description that helps to identify this scope - for example: security assessments that relate to the resource group myResourceGroup within the subscription a5caac9c-5c04-49af-b3d0-e204f40345d5","scopePath":"/subscriptions/a5caac9c-5c04-49af-b3d0-e204f40345d5/resourceGroups/myResourceGroup"}],"sources":[{"eventSource":"Assessments","ruleSets":[{"rules":[{"expectedValue":"customAssessment","operator":"Equals","propertyJPath":"$.Entity.AssessmentType","propertyType":"String"}]}]}]},"tags":{},"type":"Microsoft.Security/automations"}},"Create_or_update_a_security_automation":{"value":{"etag":"new etag value","id":"/subscriptions/a5caac9c-5c04-49af-b3d0-e204f40345d5/resourceGroups/exampleResourceGroup/providers/Microsoft.Security/SecurityAutomations/exampleAutomation","location":"Central US","name":"exampleAutomation","properties":{"actions":[{"actionType":"LogicApp","logicAppResourceId":"/subscriptions/e54a4a18-5b94-4f90-9471-bd3decad8a2e/resourceGroups/sample/providers/Microsoft.Logic/workflows/MyTest1"}],"description":"An example of a security automation that triggers one LogicApp resource (myTest1) on any security assessment of type customAssessment","isEnabled":true,"scopes":[{"description":"A description that helps to identify this scope - for example: security assessments that relate to the resource group myResourceGroup within the subscription a5caac9c-5c04-49af-b3d0-e204f40345d5","scopePath":"/subscriptions/a5caac9c-5c04-49af-b3d0-e204f40345d5/resourceGroups/myResourceGroup"}],"sources":[{"eventSource":"Assessments","ruleSets":[{"rules":[{"expectedValue":"customAssessment","operator":"Equals","propertyJPath":"$.Entity.AssessmentType","propertyType":"String"}]}]}]},"tags":{},"type":"Microsoft.Security/SecurityAutomations"}},"Disable_or_enable_a_security_automation":{"value":{"etag":"new etag value","id":"/subscriptions/a5caac9c-5c04-49af-b3d0-e204f40345d5/resourceGroups/exampleResourceGroup/providers/Microsoft.Security/SecurityAutomations/exampleAutomation","location":"Central US","name":"exampleAutomation","properties":{"actions":[{"actionType":"LogicApp","logicAppResourceId":"/subscriptions/e54a4a18-5b94-4f90-9471-bd3decad8a2e/resourceGroups/sample/providers/Microsoft.Logic/workflows/MyTest1"}],"description":"An example of a security automation that triggers one LogicApp resource (myTest1) on any security assessment of type customAssessment","isEnabled":false,"scopes":[{"description":"A description that helps to identify this scope - for example: security assessments that relate to the resource group myResourceGroup within the subscription a5caac9c-5c04-49af-b3d0-e204f40345d5","scopePath":"/subscriptions/a5caac9c-5c04-49af-b3d0-e204f40345d5/resourceGroups/myResourceGroup"}],"sources":[{"eventSource":"Assessments","ruleSets":[{"rules":[{"expectedValue":"customAssessment","operator":"Equals","propertyJPath":"$.Entity.AssessmentType","propertyType":"String"}]}]}]},"tags":{},"type":"Microsoft.Security/SecurityAutomations"}},"Validate_the_security_automation_model_before_create_or_update":{"value":{"isValid":true,"message":"Validation Successful"}}},"parameters":{"AutomationName":{"description":"The security automation name.","in":"path","name":"automationName","required":true,"x-ms-parameter-location":"method","schema":{"type":"string"},"examples":{"Delete a security automation":{"value":"myAutomationName"},"Retrieve a security automation":{"value":"exampleAutomation"},"Create or update a security automation":{"value":"exampleAutomation"},"Disable or enable a security automation":{"value":"exampleAutomation"},"Validate the security automation model before create or update":{"value":"exampleAutomation"}}}},"requestBodies":{"Automation":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Automation"}}},"description":"The security automation resource","required":true,"x-ms-parameter-location":"method"}},"securitySchemes":{"azure_auth":{"description":"Azure Active Directory OAuth2 Flow","type":"oauth2","flows":{"implicit":{"authorizationUrl":"https://login.microsoftonline.com/common/oauth2/authorize","scopes":{"user_impersonation":"impersonate your user account"}}}}},"schemas":{"Automation":{"allOf":[{"allOf":[{"description":"Describes an Azure resource.","properties":{"id":{"description":"Resource Id","readOnly":true,"type":"string"},"name":{"description":"Resource name","readOnly":true,"type":"string"},"type":{"description":"Resource type","readOnly":true,"type":"string"}},"type":"object","x-ms-azure-resource":true},{"description":"Describes an Azure resource with location","properties":{"location":{"description":"Location where the resource is stored","readOnly":true,"type":"string"}},"type":"object"},{"description":"Describes an Azure resource with kind","properties":{"kind":{"description":"Kind of the resource","type":"string"}},"type":"object"},{"description":"Entity tag is used for comparing two or more entities from the same requested resource.","properties":{"etag":{"description":"Entity tag is used for comparing two or more entities from the same requested resource.","type":"string"}},"type":"object"},{"description":"A list of key value pairs that describe the resource.","properties":{"tags":{"additionalProperties":{"type":"string"},"description":"A list of key value pairs that describe the resource.","type":"object"}},"type":"object"}],"description":"Describes an Azure tracked resource.","type":"object"}],"description":"The security automation resource.","properties":{"properties":{"$ref":"#/components/schemas/AutomationProperties"}},"type":"object"},"AutomationAction":{"description":"The action that should be triggered.","discriminator":{"propertyName":"actionType"},"properties":{"actionType":{"description":"The type of the action that will be triggered by the Automation","enum":["LogicApp","EventHub","Workspace"],"type":"string","x-ms-enum":{"modelAsString":true,"name":"ActionType","values":[{"value":"LogicApp"},{"value":"EventHub"},{"value":"Workspace"}]}}},"required":["actionType"],"type":"object"},"AutomationActionEventHub":{"allOf":[{"$ref":"#/components/schemas/AutomationAction"}],"description":"The target Event Hub to which event data will be exported. To learn more about Security Center continuous export capabilities, visit https://aka.ms/ASCExportLearnMore","properties":{"connectionString":{"description":"The target Event Hub connection string (it will not be included in any response).","type":"string"},"eventHubResourceId":{"description":"The target Event Hub Azure Resource ID.","type":"string"},"sasPolicyName":{"description":"The target Event Hub SAS policy name.","readOnly":true,"type":"string"}},"type":"object","x-ms-discriminator-value":"EventHub"},"AutomationActionLogicApp":{"allOf":[{"$ref":"#/components/schemas/AutomationAction"}],"description":"The logic app action that should be triggered. To learn more about Security Center's Workflow Automation capabilities, visit https://aka.ms/ASCWorkflowAutomationLearnMore","properties":{"logicAppResourceId":{"description":"The triggered Logic App Azure Resource ID. This can also reside on other subscriptions, given that you have permissions to trigger the Logic App","type":"string"},"uri":{"description":"The Logic App trigger URI endpoint (it will not be included in any response).","format":"uri","type":"string"}},"type":"object","x-ms-discriminator-value":"LogicApp"},"AutomationActionWorkspace":{"allOf":[{"$ref":"#/components/schemas/AutomationAction"}],"description":"The Log Analytics Workspace to which event data will be exported. Security alerts data will reside in the 'SecurityAlert' table and the assessments data will reside in the 'SecurityRecommendation' table (under the 'Security'/'SecurityCenterFree' solutions). Note that in order to view the data in the workspace, the Security Center Log Analytics free/standard solution needs to be enabled on that workspace. To learn more about Security Center continuous export capabilities, visit https://aka.ms/ASCExportLearnMore","properties":{"workspaceResourceId":{"description":"The fully qualified Log Analytics Workspace Azure Resource ID.","type":"string"}},"type":"object","x-ms-discriminator-value":"Workspace"},"AutomationList":{"description":"List of security automations response.","properties":{"nextLink":{"description":"The URI to fetch the next page.","readOnly":true,"type":"string"},"value":{"description":"The list of security automations under the given scope.","items":{"$ref":"#/components/schemas/Automation"},"type":"array"}},"required":["value"]},"AutomationProperties":{"description":"A set of properties that defines the behavior of the automation configuration. To learn more about the supported security events data models schemas - please visit https://aka.ms/ASCAutomationSchemas.","properties":{"actions":{"description":"A collection of the actions which are triggered if all the configured rules evaluations, within at least one rule set, are true.","items":{"$ref":"#/components/schemas/AutomationAction"},"type":"array"},"description":{"description":"The security automation description.","type":"string"},"isEnabled":{"description":"Indicates whether the security automation is enabled.","type":"boolean"},"scopes":{"description":"A collection of scopes on which the security automations logic is applied. Supported scopes are the subscription itself or a resource group under that subscription. The automation will only apply on defined scopes.","items":{"$ref":"#/components/schemas/AutomationScope"},"type":"array"},"sources":{"description":"A collection of the source event types which evaluate the security automation set of rules.","items":{"$ref":"#/components/schemas/AutomationSource"},"type":"array"}},"type":"object"},"AutomationRuleSet":{"description":"A rule set which evaluates all its rules upon an event interception. Only when all the included rules in the rule set will be evaluated as 'true', will the event trigger the defined actions.","properties":{"rules":{"items":{"$ref":"#/components/schemas/AutomationTriggeringRule"},"type":"array"}},"type":"object"},"AutomationScope":{"description":"A single automation scope.","properties":{"description":{"description":"The resources scope description.","type":"string"},"scopePath":{"description":"The resources scope path. Can be the subscription on which the automation is defined on or a resource group under that subscription (fully qualified Azure resource IDs).","type":"string"}},"type":"object"},"AutomationSource":{"description":"The source event types which evaluate the security automation set of rules. For example - security alerts and security assessments. To learn more about the supported security events data models schemas - please visit https://aka.ms/ASCAutomationSchemas.","properties":{"eventSource":{"description":"A valid event source type.","enum":["Assessments","Alerts"],"type":"string","x-ms-enum":{"modelAsString":true,"name":"EventSource","values":[{"value":"Assessments"},{"value":"Alerts"}]}},"ruleSets":{"description":"A set of rules which evaluate upon event interception. A logical disjunction is applied between defined rule sets (logical 'or').","items":{"$ref":"#/components/schemas/AutomationRuleSet"},"type":"array"}},"type":"object"},"AutomationTriggeringRule":{"description":"A rule which is evaluated upon event interception. The rule is configured by comparing a specific value from the event model to an expected value. This comparison is done by using one of the supported operators set.","properties":{"expectedValue":{"description":"The expected value.","type":"string"},"operator":{"description":"A valid comparer operator to use. A case-insensitive comparison will be applied for String PropertyType.","enum":["Equals","GreaterThan","GreaterThanOrEqualTo","LesserThan","LesserThanOrEqualTo","NotEquals","Contains","StartsWith","EndsWith"],"type":"string","x-ms-enum":{"modelAsString":true,"name":"Operator","values":[{"value":"Equals"},{"value":"GreaterThan"},{"value":"GreaterThanOrEqualTo"},{"value":"LesserThan"},{"value":"LesserThanOrEqualTo"},{"value":"NotEquals"},{"value":"Contains"},{"value":"StartsWith"},{"value":"EndsWith"}]}},"propertyJPath":{"description":"The JPath of the entity model property that should be checked.","type":"string"},"propertyType":{"description":"The data type of the compared operands (string, integer, floating point number or a boolean [true/false]]","enum":["String","Integer","Number","Boolean"],"type":"string","x-ms-enum":{"modelAsString":true,"name":"PropertyType","values":[{"value":"String"},{"value":"Integer"},{"value":"Number"},{"value":"Boolean"}]}}},"type":"object"},"AutomationValidationStatus":{"description":"The security automation model state property bag.","properties":{"isValid":{"description":"Indicates whether the model is valid or not.","type":"boolean"},"message":{"description":"The validation message.","type":"string"}},"type":"object"}}}}