Get Recommendations - List

Reference

Service:: Sentinel

API Version:: 2024-10-01-preview

Gets a list of all recommendations.

GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/recommendations?api-version=2024-10-01-preview

URI Parameters

Name	In	Required	Type	Description
resourceGroupName	path	True	string	The name of the resource group. The name is case insensitive.
subscriptionId	path	True	string uuid	The ID of the target subscription. The value must be an UUID.
workspaceName	path	True	string	The name of the workspace. Regex pattern: `^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$`
api-version	query	True	string	The API version to use for this operation.

Responses

Name	Type	Description
200 OK	RecommendationList	OK
Other Status Codes	CloudError	Error response describing why the operation failed.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	impersonate your user account

Examples

Get Recommendations list.

Sample request

HTTP

GET https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/recommendations?api-version=2024-10-01-preview

Sample response

Status code:: 200

{
  "value": [
    {
      "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/Recommendations/ceea048e-923e-4eeb-8fcb-6cb0c06b101f",
      "name": "ceea048e-923e-4eeb-8fcb-6cb0c06b101f",
      "type": "Microsoft.SecurityInsights/Recommendations",
      "properties": {
        "recommendationTypeId": "ThreatIntelligence_Example",
        "state": "CompletedBySystem",
        "title": "someText",
        "description": "someText",
        "creationTimeUtc": "2022-02-19T03:09:03.4888396+00:00",
        "lastEvaluatedTimeUtc": "2022-02-19T03:09:03.4888396+00:00",
        "lastModifiedTimeUtc": "2022-02-19T03:57:31.7964447+00:00",
        "suggestions": [
          {
            "suggestionTypeId": "ThreatIntelligence_Example_Suggestion_Example",
            "title": "someText",
            "description": "someText",
            "action": "someText",
            "additionalProperties": {
              "someKey": "someValue"
            }
          }
        ],
        "resourceId": "someId",
        "additionalProperties": {
          "someKey": "someValue"
        }
      }
    }
  ]
}

Definitions

Name	Description
CloudError	Error response structure.
CloudErrorBody	Error details.
createdByType	The type of identity that created the resource.
Recommendation	Recommendation object.
RecommendationList	A list of recommendations
RecommendedSuggestion	What suggestions should be taken to complete the recommendation.
State	State of the recommendation.
systemData	Metadata pertaining to creation and last modification of the resource.

CloudError

Error response structure.

Name	Type	Description
error	CloudErrorBody	Error data

CloudErrorBody

Error details.

Name	Type	Description
code	string	An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
message	string	A message describing the error, intended to be suitable for display in a user interface.

createdByType

The type of identity that created the resource.

Name	Type	Description
Application	string
Key	string
ManagedIdentity	string
User	string

Recommendation

Recommendation object.

Name	Type	Description
etag	string	Etag of the azure resource
id	string	Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
name	string	The name of the resource
properties.additionalProperties	object	Collection of additional properties for the recommendation.
properties.creationTimeUtc	string	The time stamp (UTC) when the recommendation was created.
properties.description	string	Description of the recommendation.
properties.lastEvaluatedTimeUtc	string	The time stamp (UTC) when the recommendation was last evaluated.
properties.lastModifiedTimeUtc	string	The time stamp (UTC) when the recommendation was last modified.
properties.recommendationTypeId	string	Id of the recommendation type.
properties.resourceId	string	Id of the resource this recommendation refers to.
properties.state	State	State of the recommendation.
properties.suggestions	RecommendedSuggestion[]	List of suggestions to take for this recommendation.
properties.title	string	Title of the recommendation.
systemData	systemData	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

RecommendationList

A list of recommendations

Name	Type	Description
nextLink	string	Link to next page of resources.
value	Recommendation[]	An list of recommendations

RecommendedSuggestion

What suggestions should be taken to complete the recommendation.

Name	Type	Description
action	string	Action of the suggestion.
additionalProperties	object	Collection of additional properties for the suggestion.
description	string	Description of the suggestion.
suggestionTypeId	string	Id of the suggestion type.
title	string	Title of the suggestion.

State

State of the recommendation.

Name	Type	Description
Active	string	Recommendation is active.
CompletedBySystem	string	Recommendation has been completed by the system.
CompletedByUser	string	Recommendation has been completed by user.
Dismissed	string	Recommendation has been dismissed.
InProgress	string	Recommendation is in progress.

systemData

Metadata pertaining to creation and last modification of the resource.

Name	Type	Description
createdAt	string	The timestamp of resource creation (UTC).
createdBy	string	The identity that created the resource.
createdByType	createdByType	The type of identity that created the resource.
lastModifiedAt	string	The timestamp of resource last modification (UTC)
lastModifiedBy	string	The identity that last modified the resource.
lastModifiedByType	createdByType	The type of identity that last modified the resource.

Share via