Data Connectors - Get

Serviço:

Sentinel

Versão da API:

2024-01-01-preview

Obtém um conector de dados.

GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors/{dataConnectorId}?api-version=2024-01-01-preview

Parâmetros de URI

Nome	Em	Obrigatório	Tipo	Description
dataConnectorId	path	True	string	ID do conector
resourceGroupName	path	True	string	O nome do grupo de recursos. O nome não diferencia maiúsculas de minúsculas.
subscriptionId	path	True	string	A ID da assinatura de destino.
workspaceName	path	True	string	O nome do workspace. Padrão Regex: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
api-version	query	True	string	A versão da API a ser usada para esta operação.

Respostas

Nome	Tipo	Description
200 OK	DataConnector: AADDataConnector MSTIDataConnector MTPDataConnector AATPDataConnector ASCDataConnector AwsCloudTrailDataConnector AwsS3DataConnector RestApiPollerDataConnector GCPDataConnector MCASDataConnector Dynamics365DataConnector OfficeATPDataConnector MicrosoftPurviewInformationProtectionDataConnector Office365ProjectDataConnector OfficePowerBIDataConnector OfficeIRMDataConnector MDATPDataConnector OfficeDataConnector TIDataConnector TiTaxiiDataConnector IoTDataConnector CodelessUiDataConnector CodelessApiPollingDataConnector	OK, operação concluída com êxito
Other Status Codes	CloudError	Resposta de erro que descreve por que a operação falhou.

Segurança

azure_auth

Fluxo OAuth2 do Azure Active Directory

Tipo: oauth2
Flow: implicit
URL de Autorização: https://login.microsoftonline.com/common/oauth2/authorize

Escopos

Nome	Description
user_impersonation	representar sua conta de usuário

Exemplos

Get a APIPolling data connector

Get a ASC data connector

Get a Dynamics365 data connector

Get a GCP data connector

Get a GenericUI data connector

Get a IoT data connector

Get a MCAS data connector

Get a MDATP data connector

Get a MicrosoftPurviewInformationProtection data connector

Get a MicrosoftThreatIntelligence data connector

Get a MicrosoftThreatProtection data connector

Get a RestApiPoller data connector

Get a TI data connector

Get a TI Taxii data connector.

Get an AADIP (Azure Active Directory Identity Protection) data connector

Get an AATP data connector

Get an Aws S3 data connector

Get an AwsCloudTrail data connector

Get an Office ATP data connector

Get an Office IRM data connector

Get an Office365 data connector.

Get an Office365 PowerBI data connector

Get an Office365 Project data connector

Get a APIPolling data connector

Solicitação de exemplo

HTTP

GET https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/316ec55e-7138-4d63-ab18-90c8a60fd1c8?api-version=2024-01-01-preview

dotnet

using Azure;
using Azure.ResourceManager;
using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.SecurityInsights.Models;
using Azure.ResourceManager.SecurityInsights;

// Generated from example definition: specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2024-01-01-preview/examples/dataConnectors/GetAPIPolling.json
// this example is just showing the usage of "DataConnectors_Get" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this OperationalInsightsWorkspaceSecurityInsightsResource created on azure
// for more information of creating OperationalInsightsWorkspaceSecurityInsightsResource, please refer to the document of OperationalInsightsWorkspaceSecurityInsightsResource
string subscriptionId = "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0";
string resourceGroupName = "myRg";
string workspaceName = "myWorkspace";
ResourceIdentifier operationalInsightsWorkspaceSecurityInsightsResourceId = OperationalInsightsWorkspaceSecurityInsightsResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, workspaceName);
OperationalInsightsWorkspaceSecurityInsightsResource operationalInsightsWorkspaceSecurityInsights = client.GetOperationalInsightsWorkspaceSecurityInsightsResource(operationalInsightsWorkspaceSecurityInsightsResourceId);

// get the collection of this SecurityInsightsDataConnectorResource
SecurityInsightsDataConnectorCollection collection = operationalInsightsWorkspaceSecurityInsights.GetSecurityInsightsDataConnectors();

// invoke the operation
string dataConnectorId = "316ec55e-7138-4d63-ab18-90c8a60fd1c8";
NullableResponse<SecurityInsightsDataConnectorResource> response = await collection.GetIfExistsAsync(dataConnectorId);
SecurityInsightsDataConnectorResource result = response.HasValue ? response.Value : null;

if (result == null)
{
    Console.WriteLine($"Succeeded with null as result");
}
else
{
    // the variable result is a resource, you could call other operations on this instance as well
    // but just for demo, we get its data from this resource instance
    SecurityInsightsDataConnectorData resourceData = result.Data;
    // for demo we just print out the id
    Console.WriteLine($"Succeeded on id: {resourceData.Id}");
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Resposta de exemplo

Código de status:

200

{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/316ec55e-7138-4d63-ab18-90c8a60fd1c8",
  "name": "316ec55e-7138-4d63-ab18-90c8a60fd1c8",
  "etag": "\"1a00b074-0000-0100-0000-606ef5bd0000\"",
  "type": "Microsoft.SecurityInsights/dataConnectors",
  "kind": "APIPolling",
  "properties": {
    "connectorUiConfig": {
      "title": "GitHub Enterprise Audit Log",
      "publisher": "GitHub",
      "descriptionMarkdown": "The GitHub audit log connector provides the capability to ingest GitHub logs into Azure Sentinel. By connecting GitHub audit logs into Azure Sentinel, you can view this data in workbooks, use it to create custom alerts, and improve your investigation process.",
      "customImage": "The image connector content",
      "graphQueriesTableName": "GitHubAuditLogPolling_CL",
      "graphQueries": [
        {
          "metricName": "Total events received",
          "legend": "GitHub audit log events",
          "baseQuery": "{{graphQueriesTableName}}"
        }
      ],
      "sampleQueries": [
        {
          "description": "All logs",
          "query": "{{graphQueriesTableName}}\n | take 10 <change>"
        }
      ],
      "dataTypes": [
        {
          "name": "{{graphQueriesTableName}}",
          "lastDataReceivedQuery": "{{graphQueriesTableName}}\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "SentinelKindsV2",
          "value": []
        }
      ],
      "availability": {
        "status": 1,
        "isPreview": true
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "read and write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": true
            }
          }
        ],
        "customs": [
          {
            "name": "GitHub API personal token Key",
            "description": "You need access to GitHub personal token, the key should have 'admin:org' scope"
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "Connect GitHub Enterprise Audit Log to Azure Sentinel",
          "description": "Enable GitHub audit Logs. \n Follow [this](https://docs.github.com/en/github/authenticating-to-github/keeping-your-account-and-data-secure/creating-a-personal-access-token) to create or find your personal key",
          "instructions": [
            {
              "parameters": {
                "enable": "true",
                "userRequestPlaceHoldersInput": [
                  {
                    "displayText": "Organization Name",
                    "requestObjectKey": "apiEndpoint",
                    "placeHolderName": "{{placeHolder1}}",
                    "placeHolderValue": ""
                  }
                ]
              },
              "type": "APIKey"
            }
          ]
        }
      ]
    },
    "pollingConfig": {
      "auth": {
        "authType": "APIKey",
        "apiKeyIdentifier": "token",
        "apiKeyName": "Authorization"
      },
      "request": {
        "apiEndpoint": "https://api.github.com/organizations/{{placeHolder1}}/audit-log",
        "rateLimitQps": 50,
        "queryWindowInMin": 15,
        "httpMethod": "Get",
        "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ",
        "retryCount": 2,
        "timeoutInSeconds": 60,
        "headers": {
          "Accept": "application/json",
          "User-Agent": "Scuba"
        },
        "queryParameters": {
          "phrase": "created:{_QueryWindowStartTime}..{_QueryWindowEndTime}"
        }
      },
      "paging": {
        "pagingType": "LinkHeader",
        "pageSizeParaName": "per_page"
      },
      "response": {
        "eventsJsonPaths": [
          "$"
        ]
      }
    }
  }
}

Get a ASC data connector

Solicitação de exemplo

HTTP

GET https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/763f9fa1-c2d3-4fa2-93e9-bccd4899aa12?api-version=2024-01-01-preview

dotnet

using Azure;
using Azure.ResourceManager;
using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.SecurityInsights.Models;
using Azure.ResourceManager.SecurityInsights;

// Generated from example definition: specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2024-01-01-preview/examples/dataConnectors/GetAzureSecurityCenterById.json
// this example is just showing the usage of "DataConnectors_Get" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this OperationalInsightsWorkspaceSecurityInsightsResource created on azure
// for more information of creating OperationalInsightsWorkspaceSecurityInsightsResource, please refer to the document of OperationalInsightsWorkspaceSecurityInsightsResource
string subscriptionId = "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0";
string resourceGroupName = "myRg";
string workspaceName = "myWorkspace";
ResourceIdentifier operationalInsightsWorkspaceSecurityInsightsResourceId = OperationalInsightsWorkspaceSecurityInsightsResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, workspaceName);
OperationalInsightsWorkspaceSecurityInsightsResource operationalInsightsWorkspaceSecurityInsights = client.GetOperationalInsightsWorkspaceSecurityInsightsResource(operationalInsightsWorkspaceSecurityInsightsResourceId);

// get the collection of this SecurityInsightsDataConnectorResource
SecurityInsightsDataConnectorCollection collection = operationalInsightsWorkspaceSecurityInsights.GetSecurityInsightsDataConnectors();

// invoke the operation
string dataConnectorId = "763f9fa1-c2d3-4fa2-93e9-bccd4899aa12";
NullableResponse<SecurityInsightsDataConnectorResource> response = await collection.GetIfExistsAsync(dataConnectorId);
SecurityInsightsDataConnectorResource result = response.HasValue ? response.Value : null;

if (result == null)
{
    Console.WriteLine($"Succeeded with null as result");
}
else
{
    // the variable result is a resource, you could call other operations on this instance as well
    // but just for demo, we get its data from this resource instance
    SecurityInsightsDataConnectorData resourceData = result.Data;
    // for demo we just print out the id
    Console.WriteLine($"Succeeded on id: {resourceData.Id}");
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Resposta de exemplo

Código de status:

200

{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/763f9fa1-c2d3-4fa2-93e9-bccd4899aa12",
  "name": "763f9fa1-c2d3-4fa2-93e9-bccd4899aa12",
  "type": "Microsoft.SecurityInsights/dataConnectors",
  "kind": "AzureSecurityCenter",
  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
  "properties": {
    "subscriptionId": "c0688291-89d7-4bed-87a2-a7b1bff43f4c",
    "dataTypes": {
      "alerts": {
        "state": "Enabled"
      }
    }
  }
}

Get a Dynamics365 data connector

Solicitação de exemplo

HTTP

GET https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/c2541efb-c9a6-47fe-9501-87d1017d1512?api-version=2024-01-01-preview

dotnet

using Azure;
using Azure.ResourceManager;
using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.SecurityInsights.Models;
using Azure.ResourceManager.SecurityInsights;

// Generated from example definition: specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2024-01-01-preview/examples/dataConnectors/GetDynamics365DataConnectorById.json
// this example is just showing the usage of "DataConnectors_Get" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this OperationalInsightsWorkspaceSecurityInsightsResource created on azure
// for more information of creating OperationalInsightsWorkspaceSecurityInsightsResource, please refer to the document of OperationalInsightsWorkspaceSecurityInsightsResource
string subscriptionId = "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0";
string resourceGroupName = "myRg";
string workspaceName = "myWorkspace";
ResourceIdentifier operationalInsightsWorkspaceSecurityInsightsResourceId = OperationalInsightsWorkspaceSecurityInsightsResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, workspaceName);
OperationalInsightsWorkspaceSecurityInsightsResource operationalInsightsWorkspaceSecurityInsights = client.GetOperationalInsightsWorkspaceSecurityInsightsResource(operationalInsightsWorkspaceSecurityInsightsResourceId);

// get the collection of this SecurityInsightsDataConnectorResource
SecurityInsightsDataConnectorCollection collection = operationalInsightsWorkspaceSecurityInsights.GetSecurityInsightsDataConnectors();

// invoke the operation
string dataConnectorId = "c2541efb-c9a6-47fe-9501-87d1017d1512";
NullableResponse<SecurityInsightsDataConnectorResource> response = await collection.GetIfExistsAsync(dataConnectorId);
SecurityInsightsDataConnectorResource result = response.HasValue ? response.Value : null;

if (result == null)
{
    Console.WriteLine($"Succeeded with null as result");
}
else
{
    // the variable result is a resource, you could call other operations on this instance as well
    // but just for demo, we get its data from this resource instance
    SecurityInsightsDataConnectorData resourceData = result.Data;
    // for demo we just print out the id
    Console.WriteLine($"Succeeded on id: {resourceData.Id}");
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Resposta de exemplo

Código de status:

200

{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/3d3e955e-33eb-401d-89a7-251c81ddd660",
  "name": "c2541efb-c9a6-47fe-9501-87d1017d1512",
  "type": "Microsoft.SecurityInsights/dataConnectors",
  "kind": "Dynamics365",
  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
  "properties": {
    "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8",
    "dataTypes": {
      "dynamics365CdsActivities": {
        "state": "Enabled"
      }
    }
  }
}

Get a GCP data connector

Solicitação de exemplo

HTTP

GET https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/GCP_fce27b90-d6f5-4d30-991a-af509a2b50a1?api-version=2024-01-01-preview

dotnet

using Azure;
using Azure.ResourceManager;
using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.SecurityInsights.Models;
using Azure.ResourceManager.SecurityInsights;

// Generated from example definition: specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2024-01-01-preview/examples/dataConnectors/GetGoogleCloudPlatformById.json
// this example is just showing the usage of "DataConnectors_Get" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this OperationalInsightsWorkspaceSecurityInsightsResource created on azure
// for more information of creating OperationalInsightsWorkspaceSecurityInsightsResource, please refer to the document of OperationalInsightsWorkspaceSecurityInsightsResource
string subscriptionId = "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0";
string resourceGroupName = "myRg";
string workspaceName = "myWorkspace";
ResourceIdentifier operationalInsightsWorkspaceSecurityInsightsResourceId = OperationalInsightsWorkspaceSecurityInsightsResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, workspaceName);
OperationalInsightsWorkspaceSecurityInsightsResource operationalInsightsWorkspaceSecurityInsights = client.GetOperationalInsightsWorkspaceSecurityInsightsResource(operationalInsightsWorkspaceSecurityInsightsResourceId);

// get the collection of this SecurityInsightsDataConnectorResource
SecurityInsightsDataConnectorCollection collection = operationalInsightsWorkspaceSecurityInsights.GetSecurityInsightsDataConnectors();

// invoke the operation
string dataConnectorId = "GCP_fce27b90-d6f5-4d30-991a-af509a2b50a1";
NullableResponse<SecurityInsightsDataConnectorResource> response = await collection.GetIfExistsAsync(dataConnectorId);
SecurityInsightsDataConnectorResource result = response.HasValue ? response.Value : null;

if (result == null)
{
    Console.WriteLine($"Succeeded with null as result");
}
else
{
    // the variable result is a resource, you could call other operations on this instance as well
    // but just for demo, we get its data from this resource instance
    SecurityInsightsDataConnectorData resourceData = result.Data;
    // for demo we just print out the id
    Console.WriteLine($"Succeeded on id: {resourceData.Id}");
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Resposta de exemplo

Código de status:

200

{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/GCP_afef3743-0c88-469c-84ff-ca2e87dc1e48",
  "name": "GCP_fce27b90-d6f5-4d30-991a-af509a2b50a1",
  "type": "Microsoft.SecurityInsights/dataConnectors",
  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
  "kind": "GCP",
  "properties": {
    "connectorDefinitionName": "GcpConnector",
    "auth": {
      "serviceAccountEmail": "sentinel-service-account@project-id.iam.gserviceaccount.com",
      "projectNumber": "123456789012",
      "workloadIdentityProviderId": "sentinel-identity-provider",
      "type": "GCP"
    },
    "request": {
      "projectId": "project-id",
      "subscriptionNames": [
        "sentinel-subscription"
      ]
    }
  }
}

Get a GenericUI data connector

Solicitação de exemplo

HTTP

GET https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/316ec55e-7138-4d63-ab18-90c8a60fd1c8?api-version=2024-01-01-preview

dotnet

using Azure;
using Azure.ResourceManager;
using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.SecurityInsights.Models;
using Azure.ResourceManager.SecurityInsights;

// Generated from example definition: specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2024-01-01-preview/examples/dataConnectors/GetGenericUI.json
// this example is just showing the usage of "DataConnectors_Get" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this OperationalInsightsWorkspaceSecurityInsightsResource created on azure
// for more information of creating OperationalInsightsWorkspaceSecurityInsightsResource, please refer to the document of OperationalInsightsWorkspaceSecurityInsightsResource
string subscriptionId = "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0";
string resourceGroupName = "myRg";
string workspaceName = "myWorkspace";
ResourceIdentifier operationalInsightsWorkspaceSecurityInsightsResourceId = OperationalInsightsWorkspaceSecurityInsightsResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, workspaceName);
OperationalInsightsWorkspaceSecurityInsightsResource operationalInsightsWorkspaceSecurityInsights = client.GetOperationalInsightsWorkspaceSecurityInsightsResource(operationalInsightsWorkspaceSecurityInsightsResourceId);

// get the collection of this SecurityInsightsDataConnectorResource
SecurityInsightsDataConnectorCollection collection = operationalInsightsWorkspaceSecurityInsights.GetSecurityInsightsDataConnectors();

// invoke the operation
string dataConnectorId = "316ec55e-7138-4d63-ab18-90c8a60fd1c8";
NullableResponse<SecurityInsightsDataConnectorResource> response = await collection.GetIfExistsAsync(dataConnectorId);
SecurityInsightsDataConnectorResource result = response.HasValue ? response.Value : null;

if (result == null)
{
    Console.WriteLine($"Succeeded with null as result");
}
else
{
    // the variable result is a resource, you could call other operations on this instance as well
    // but just for demo, we get its data from this resource instance
    SecurityInsightsDataConnectorData resourceData = result.Data;
    // for demo we just print out the id
    Console.WriteLine($"Succeeded on id: {resourceData.Id}");
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Resposta de exemplo

Código de status:

200

{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/316ec55e-7138-4d63-ab18-90c8a60fd1c8",
  "name": "316ec55e-7138-4d63-ab18-90c8a60fd1c8",
  "etag": "\"1a00b074-0000-0100-0000-606ef5bd0000\"",
  "type": "Microsoft.SecurityInsights/dataConnectors",
  "kind": "GenericUI",
  "properties": {
    "connectorUiConfig": {
      "title": "Qualys Vulnerability Management (CCP DEMO)",
      "publisher": "Qualys",
      "descriptionMarkdown": "The [Qualys Vulnerability Management (VM)](https://www.qualys.com/apps/vulnerability-management/) data connector provides the capability to ingest vulnerability host detection data into Azure Sentinel through the Qualys API. The connector provides visibility into host detection data from vulerability scans. This connector provides Azure Sentinel the capability to view dashboards, create custom alerts, and improve investigation ",
      "customImage": "The image connector content",
      "graphQueriesTableName": "QualysHostDetection_CL",
      "graphQueries": [
        {
          "metricName": "Total data received",
          "legend": "{{graphQueriesTableName}}",
          "baseQuery": "{{graphQueriesTableName}}"
        }
      ],
      "sampleQueries": [
        {
          "description": "Top 10 Vulerabilities detected",
          "query": "{{graphQueriesTableName}}\n | mv-expand todynamic(Detections_s)\n | extend Vulnerability = tostring(Detections_s.Results)\n | summarize count() by Vulnerability\n | top 10 by count_"
        }
      ],
      "dataTypes": [
        {
          "name": "{{graphQueriesTableName}}",
          "lastDataReceivedQuery": "{{graphQueriesTableName}}\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "IsConnectedQuery",
          "value": [
            "{{graphQueriesTableName}}\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
          ]
        }
      ],
      "availability": {
        "status": 1,
        "isPreview": true
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "read and write permissions on the workspace are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": true
            }
          },
          {
            "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
            "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
            "providerDisplayName": "Keys",
            "scope": "Workspace",
            "requiredPermissions": {
              "action": true
            }
          }
        ],
        "customs": [
          {
            "name": "Microsoft.Web/sites permissions",
            "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)."
          },
          {
            "name": "Qualys API Key",
            "description": "A Qualys VM API username and password is required. [See the documentation to learn more about Qualys VM API](https://www.qualys.com/docs/qualys-api-vmpc-user-guide.pdf)."
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "",
          "description": ">**NOTE:** This connector uses Azure Functions to connect to Qualys VM to pull its logs into Azure Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details."
        },
        {
          "title": "",
          "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App."
        },
        {
          "title": "",
          "description": "**STEP 1 - Configuration steps for the Qualys VM API**\n\n1. Log into the Qualys Vulnerability Management console with an administrator account, select the **Users** tab and the **Users** subtab. \n2. Click on the **New** drop-down menu and select **Users..**\n3. Create a username and password for the API account. \n4. In the **User Roles** tab, ensure the account role is set to **Manager** and access is allowed to **GUI** and **API**\n4. Log out of the administrator account and log into the console with the new API credentials for validation, then log out of the API account. \n5. Log back into the console using an administrator account and modify the API accounts User Roles, removing access to **GUI**. \n6. Save all changes."
        },
        {
          "title": "",
          "description": "**STEP 2 - Choose ONE from the following two deployment options to deploy the connector and the associated Azure Function**\n\n>**IMPORTANT:** Before deploying the Qualys VM connector, have the Workspace ID and Workspace Primary Key (can be copied from the following), as well as the Qualys VM API Authorization Key(s), readily available.",
          "instructions": [
            {
              "parameters": {
                "fillWith": [
                  "WorkspaceId"
                ],
                "label": "Workspace ID"
              },
              "type": "CopyableLabel"
            },
            {
              "parameters": {
                "fillWith": [
                  "PrimaryKey"
                ],
                "label": "Primary Key"
              },
              "type": "CopyableLabel"
            }
          ]
        },
        {
          "title": "Option 1 - Azure Resource Manager (ARM) Template",
          "description": "Use this method for automated deployment of the Qualys VM connector using an ARM Tempate.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinelqualysvmazuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the **Workspace ID**, **Workspace Key**, **API Username**, **API Password** , update the **URI**, and any additional URI **Filter Parameters** (each filter should be separated by an \"&\" symbol, no spaces.) \n> - Enter the URI that corresponds to your region. The complete list of API Server URLs can be [found here](https://www.qualys.com/docs/qualys-api-vmpc-user-guide.pdf#G4.735348) -- There is no need to add a time suffix to the URI, the Function App will dynamically append the Time Value to the URI in the proper format. \n - The default **Time Interval** is set to pull the last five (5) minutes of data. If the time interval needs to be modified, it is recommended to change the Function App Timer Trigger accordingly (in the function.json file, post deployment) to prevent overlapping data ingestion. \n> - Note: If using Azure Key Vault secrets for any of the values above, use the`@Microsoft.KeyVault(SecretUri={Security Identifier})`schema in place of the string values. Refer to [Key Vault references documentation](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) for further details. \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy."
        },
        {
          "title": "Option 2 - Manual Deployment of Azure Functions",
          "description": "Use the following step-by-step instructions to deploy the Quayls VM connector manually with Azure Functions."
        },
        {
          "title": "",
          "description": "**1. Create a Function App**\n\n1.  From the Azure Portal, navigate to [Function App](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Web%2Fsites/kind/functionapp), and select **+ Add**.\n2. In the **Basics** tab, ensure Runtime stack is set to **Powershell Core**. \n3. In the **Hosting** tab, ensure the **Consumption (Serverless)** plan type is selected.\n4. Make other preferrable configuration changes, if needed, then click **Create**."
        },
        {
          "title": "",
          "description": "**2. Import Function App Code**\n\n1. In the newly created Function App, select **Functions** on the left pane and click **+ New Function**.\n2. Select **Timer Trigger**.\n3. Enter a unique Function **Name** and leave the default cron schedule of every 5 minutes, then click **Create**.\n5. Click on **Code + Test** on the left pane. \n6. Copy the [Function App Code](https://aka.ms/sentinelqualysvmazurefunctioncode) and paste into the Function App `run.ps1` editor.\n7. Click **Save**."
        },
        {
          "title": "",
          "description": "**3. Configure the Function App**\n\n1. In the Function App, select the Function App Name and select **Configuration**.\n2. In the **Application settings** tab, select **+ New application setting**.\n3. Add each of the following seven (7) application settings individually, with their respective string values (case-sensitive): \n\t\tapiUsername\n\t\tapiPassword\n\t\tworkspaceID\n\t\tworkspaceKey\n\t\turi\n\t\tfilterParameters\n\t\ttimeInterval\n> - Enter the URI that corresponds to your region. The complete list of API Server URLs can be [found here](https://www.qualys.com/docs/qualys-api-vmpc-user-guide.pdf#G4.735348). The `uri` value must follow the following schema: `https://<API Server>/api/2.0/fo/asset/host/vm/detection/?action=list&vm_processed_after=` -- There is no need to add a time suffix to the URI, the Function App will dynamically append the Time Value to the URI in the proper format.\n> - Add any additional filter parameters, for the `filterParameters` variable, that need to be appended to the URI. Each parameter should be seperated by an \"&\" symbol and should not include any spaces.\n> - Set the `timeInterval` (in minutes) to the value of `5` to correspond to the Timer Trigger of every `5` minutes. If the time interval needs to be modified, it is recommended to change the Function App Timer Trigger accordingly to prevent overlapping data ingestion.\n> - Note: If using Azure Key Vault, use the`@Microsoft.KeyVault(SecretUri={Security Identifier})`schema in place of the string values. Refer to [Key Vault references documentation](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) for further details.\n4. Once all application settings have been entered, click **Save**."
        },
        {
          "title": "",
          "description": "**4. Configure the host.json**.\n\nDue to the potentially large amount of Qualys host detection data being ingested, it can cause the execution time to surpass the default Function App timeout of five (5) minutes. Increase the default timeout duration to the maximum of ten (10) minutes, under the Consumption Plan, to allow more time for the Function App to execute.\n\n1. In the Function App, select the Function App Name and select the **App Service Editor** blade.\n2. Click **Go** to open the editor, then select the **host.json** file under the **wwwroot** directory.\n3. Add the line `\"functionTimeout\": \"00:10:00\",` above the `managedDependancy` line \n4. Ensure **SAVED** appears on the top right corner of the editor, then exit the editor.\n\n> NOTE: If a longer timeout duration is required, consider upgrading to an [App Service Plan](https://docs.microsoft.com/azure/azure-functions/functions-scale#timeout)"
        }
      ]
    }
  }
}

Get a IoT data connector

Solicitação de exemplo

HTTP

GET https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/d2e5dc7a-f3a2-429d-954b-939fa8c2932e?api-version=2024-01-01-preview

dotnet

using Azure;
using Azure.ResourceManager;
using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.SecurityInsights.Models;
using Azure.ResourceManager.SecurityInsights;

// Generated from example definition: specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2024-01-01-preview/examples/dataConnectors/GetIoTById.json
// this example is just showing the usage of "DataConnectors_Get" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this OperationalInsightsWorkspaceSecurityInsightsResource created on azure
// for more information of creating OperationalInsightsWorkspaceSecurityInsightsResource, please refer to the document of OperationalInsightsWorkspaceSecurityInsightsResource
string subscriptionId = "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0";
string resourceGroupName = "myRg";
string workspaceName = "myWorkspace";
ResourceIdentifier operationalInsightsWorkspaceSecurityInsightsResourceId = OperationalInsightsWorkspaceSecurityInsightsResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, workspaceName);
OperationalInsightsWorkspaceSecurityInsightsResource operationalInsightsWorkspaceSecurityInsights = client.GetOperationalInsightsWorkspaceSecurityInsightsResource(operationalInsightsWorkspaceSecurityInsightsResourceId);

// get the collection of this SecurityInsightsDataConnectorResource
SecurityInsightsDataConnectorCollection collection = operationalInsightsWorkspaceSecurityInsights.GetSecurityInsightsDataConnectors();

// invoke the operation
string dataConnectorId = "d2e5dc7a-f3a2-429d-954b-939fa8c2932e";
NullableResponse<SecurityInsightsDataConnectorResource> response = await collection.GetIfExistsAsync(dataConnectorId);
SecurityInsightsDataConnectorResource result = response.HasValue ? response.Value : null;

if (result == null)
{
    Console.WriteLine($"Succeeded with null as result");
}
else
{
    // the variable result is a resource, you could call other operations on this instance as well
    // but just for demo, we get its data from this resource instance
    SecurityInsightsDataConnectorData resourceData = result.Data;
    // for demo we just print out the id
    Console.WriteLine($"Succeeded on id: {resourceData.Id}");
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Resposta de exemplo

Código de status:

200

{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/d2e5dc7a-f3a2-429d-954b-939fa8c2932e",
  "name": "d2e5dc7a-f3a2-429d-954b-939fa8c2932e",
  "type": "Microsoft.SecurityInsights/dataConnectors",
  "kind": "IOT",
  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
  "properties": {
    "subscriptionId": "c0688291-89d7-4bed-87a2-a7b1bff43f4c",
    "dataTypes": {
      "alerts": {
        "state": "Enabled"
      }
    }
  }
}

Get a MCAS data connector

Solicitação de exemplo

HTTP

GET https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/b96d014d-b5c2-4a01-9aba-a8058f629d42?api-version=2024-01-01-preview

dotnet

using Azure;
using Azure.ResourceManager;
using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.SecurityInsights.Models;
using Azure.ResourceManager.SecurityInsights;

// Generated from example definition: specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2024-01-01-preview/examples/dataConnectors/GetMicrosoftCloudAppSecurityById.json
// this example is just showing the usage of "DataConnectors_Get" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this OperationalInsightsWorkspaceSecurityInsightsResource created on azure
// for more information of creating OperationalInsightsWorkspaceSecurityInsightsResource, please refer to the document of OperationalInsightsWorkspaceSecurityInsightsResource
string subscriptionId = "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0";
string resourceGroupName = "myRg";
string workspaceName = "myWorkspace";
ResourceIdentifier operationalInsightsWorkspaceSecurityInsightsResourceId = OperationalInsightsWorkspaceSecurityInsightsResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, workspaceName);
OperationalInsightsWorkspaceSecurityInsightsResource operationalInsightsWorkspaceSecurityInsights = client.GetOperationalInsightsWorkspaceSecurityInsightsResource(operationalInsightsWorkspaceSecurityInsightsResourceId);

// get the collection of this SecurityInsightsDataConnectorResource
SecurityInsightsDataConnectorCollection collection = operationalInsightsWorkspaceSecurityInsights.GetSecurityInsightsDataConnectors();

// invoke the operation
string dataConnectorId = "b96d014d-b5c2-4a01-9aba-a8058f629d42";
NullableResponse<SecurityInsightsDataConnectorResource> response = await collection.GetIfExistsAsync(dataConnectorId);
SecurityInsightsDataConnectorResource result = response.HasValue ? response.Value : null;

if (result == null)
{
    Console.WriteLine($"Succeeded with null as result");
}
else
{
    // the variable result is a resource, you could call other operations on this instance as well
    // but just for demo, we get its data from this resource instance
    SecurityInsightsDataConnectorData resourceData = result.Data;
    // for demo we just print out the id
    Console.WriteLine($"Succeeded on id: {resourceData.Id}");
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Resposta de exemplo

Código de status:

200

{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/b96d014d-b5c2-4a01-9aba-a8058f629d42",
  "name": "b96d014d-b5c2-4a01-9aba-a8058f629d42",
  "type": "Microsoft.SecurityInsights/dataConnectors",
  "kind": "MicrosoftCloudAppSecurity",
  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
  "properties": {
    "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8",
    "dataTypes": {
      "alerts": {
        "state": "Enabled"
      },
      "discoveryLogs": {
        "state": "Enabled"
      }
    }
  }
}

Get a MDATP data connector

Solicitação de exemplo

HTTP

GET https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/06b3ccb8-1384-4bcc-aec7-852f6d57161b?api-version=2024-01-01-preview

dotnet

using Azure;
using Azure.ResourceManager;
using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.SecurityInsights.Models;
using Azure.ResourceManager.SecurityInsights;

// Generated from example definition: specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2024-01-01-preview/examples/dataConnectors/GetMicrosoftDefenderAdvancedThreatProtectionById.json
// this example is just showing the usage of "DataConnectors_Get" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this OperationalInsightsWorkspaceSecurityInsightsResource created on azure
// for more information of creating OperationalInsightsWorkspaceSecurityInsightsResource, please refer to the document of OperationalInsightsWorkspaceSecurityInsightsResource
string subscriptionId = "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0";
string resourceGroupName = "myRg";
string workspaceName = "myWorkspace";
ResourceIdentifier operationalInsightsWorkspaceSecurityInsightsResourceId = OperationalInsightsWorkspaceSecurityInsightsResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, workspaceName);
OperationalInsightsWorkspaceSecurityInsightsResource operationalInsightsWorkspaceSecurityInsights = client.GetOperationalInsightsWorkspaceSecurityInsightsResource(operationalInsightsWorkspaceSecurityInsightsResourceId);

// get the collection of this SecurityInsightsDataConnectorResource
SecurityInsightsDataConnectorCollection collection = operationalInsightsWorkspaceSecurityInsights.GetSecurityInsightsDataConnectors();

// invoke the operation
string dataConnectorId = "06b3ccb8-1384-4bcc-aec7-852f6d57161b";
NullableResponse<SecurityInsightsDataConnectorResource> response = await collection.GetIfExistsAsync(dataConnectorId);
SecurityInsightsDataConnectorResource result = response.HasValue ? response.Value : null;

if (result == null)
{
    Console.WriteLine($"Succeeded with null as result");
}
else
{
    // the variable result is a resource, you could call other operations on this instance as well
    // but just for demo, we get its data from this resource instance
    SecurityInsightsDataConnectorData resourceData = result.Data;
    // for demo we just print out the id
    Console.WriteLine($"Succeeded on id: {resourceData.Id}");
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Resposta de exemplo

Código de status:

200

{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/06b3ccb8-1384-4bcc-aec7-852f6d57161b",
  "name": "06b3ccb8-1384-4bcc-aec7-852f6d57161b",
  "type": "Microsoft.SecurityInsights/dataConnectors",
  "kind": "MicrosoftDefenderAdvancedThreatProtection",
  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
  "properties": {
    "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8",
    "dataTypes": {
      "alerts": {
        "state": "Enabled"
      }
    }
  }
}

Get a MicrosoftPurviewInformationProtection data connector

Solicitação de exemplo

HTTP

GET https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/73e01a99-5cd7-4139-a149-9f2736ff2ab5?api-version=2024-01-01-preview

dotnet

using Azure;
using Azure.ResourceManager;
using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.SecurityInsights.Models;
using Azure.ResourceManager.SecurityInsights;

// Generated from example definition: specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2024-01-01-preview/examples/dataConnectors/GetMicrosoftPurviewInformationProtectionDataConnetorById.json
// this example is just showing the usage of "DataConnectors_Get" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this OperationalInsightsWorkspaceSecurityInsightsResource created on azure
// for more information of creating OperationalInsightsWorkspaceSecurityInsightsResource, please refer to the document of OperationalInsightsWorkspaceSecurityInsightsResource
string subscriptionId = "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0";
string resourceGroupName = "myRg";
string workspaceName = "myWorkspace";
ResourceIdentifier operationalInsightsWorkspaceSecurityInsightsResourceId = OperationalInsightsWorkspaceSecurityInsightsResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, workspaceName);
OperationalInsightsWorkspaceSecurityInsightsResource operationalInsightsWorkspaceSecurityInsights = client.GetOperationalInsightsWorkspaceSecurityInsightsResource(operationalInsightsWorkspaceSecurityInsightsResourceId);

// get the collection of this SecurityInsightsDataConnectorResource
SecurityInsightsDataConnectorCollection collection = operationalInsightsWorkspaceSecurityInsights.GetSecurityInsightsDataConnectors();

// invoke the operation
string dataConnectorId = "73e01a99-5cd7-4139-a149-9f2736ff2ab5";
NullableResponse<SecurityInsightsDataConnectorResource> response = await collection.GetIfExistsAsync(dataConnectorId);
SecurityInsightsDataConnectorResource result = response.HasValue ? response.Value : null;

if (result == null)
{
    Console.WriteLine($"Succeeded with null as result");
}
else
{
    // the variable result is a resource, you could call other operations on this instance as well
    // but just for demo, we get its data from this resource instance
    SecurityInsightsDataConnectorData resourceData = result.Data;
    // for demo we just print out the id
    Console.WriteLine($"Succeeded on id: {resourceData.Id}");
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Resposta de exemplo

Código de status:

200

{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
  "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
  "type": "Microsoft.SecurityInsights/dataConnectors",
  "kind": "MicrosoftPurviewInformationProtection",
  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
  "properties": {
    "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8",
    "dataTypes": {
      "logs": {
        "state": "Enabled"
      }
    }
  }
}

Get a MicrosoftThreatIntelligence data connector

Solicitação de exemplo

HTTP

GET https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/c345bf40-8509-4ed2-b947-50cb773aaf04?api-version=2024-01-01-preview

dotnet

using Azure;
using Azure.ResourceManager;
using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.SecurityInsights.Models;
using Azure.ResourceManager.SecurityInsights;

// Generated from example definition: specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2024-01-01-preview/examples/dataConnectors/GetMicrosoftThreatIntelligenceById.json
// this example is just showing the usage of "DataConnectors_Get" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this OperationalInsightsWorkspaceSecurityInsightsResource created on azure
// for more information of creating OperationalInsightsWorkspaceSecurityInsightsResource, please refer to the document of OperationalInsightsWorkspaceSecurityInsightsResource
string subscriptionId = "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0";
string resourceGroupName = "myRg";
string workspaceName = "myWorkspace";
ResourceIdentifier operationalInsightsWorkspaceSecurityInsightsResourceId = OperationalInsightsWorkspaceSecurityInsightsResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, workspaceName);
OperationalInsightsWorkspaceSecurityInsightsResource operationalInsightsWorkspaceSecurityInsights = client.GetOperationalInsightsWorkspaceSecurityInsightsResource(operationalInsightsWorkspaceSecurityInsightsResourceId);

// get the collection of this SecurityInsightsDataConnectorResource
SecurityInsightsDataConnectorCollection collection = operationalInsightsWorkspaceSecurityInsights.GetSecurityInsightsDataConnectors();

// invoke the operation
string dataConnectorId = "c345bf40-8509-4ed2-b947-50cb773aaf04";
NullableResponse<SecurityInsightsDataConnectorResource> response = await collection.GetIfExistsAsync(dataConnectorId);
SecurityInsightsDataConnectorResource result = response.HasValue ? response.Value : null;

if (result == null)
{
    Console.WriteLine($"Succeeded with null as result");
}
else
{
    // the variable result is a resource, you could call other operations on this instance as well
    // but just for demo, we get its data from this resource instance
    SecurityInsightsDataConnectorData resourceData = result.Data;
    // for demo we just print out the id
    Console.WriteLine($"Succeeded on id: {resourceData.Id}");
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Resposta de exemplo

Código de status:

200

{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/c345bf40-8509-4ed2-b947-50cb773aaf04",
  "name": "c345bf40-8509-4ed2-b947-50cb773aaf04",
  "type": "Microsoft.SecurityInsights/dataConnectors",
  "kind": "MicrosoftThreatIntelligence",
  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
  "properties": {
    "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8",
    "dataTypes": {
      "microsoftEmergingThreatFeed": {
        "state": "Enabled",
        "lookbackPeriod": "01/01/1970 00:00:00"
      }
    }
  }
}

Get a MicrosoftThreatProtection data connector

Solicitação de exemplo

HTTP

GET https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/c345bf40-8509-4ed2-b947-50cb773aaf04?api-version=2024-01-01-preview

dotnet

using Azure;
using Azure.ResourceManager;
using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.SecurityInsights.Models;
using Azure.ResourceManager.SecurityInsights;

// Generated from example definition: specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2024-01-01-preview/examples/dataConnectors/GetMicrosoftThreatProtectionById.json
// this example is just showing the usage of "DataConnectors_Get" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this OperationalInsightsWorkspaceSecurityInsightsResource created on azure
// for more information of creating OperationalInsightsWorkspaceSecurityInsightsResource, please refer to the document of OperationalInsightsWorkspaceSecurityInsightsResource
string subscriptionId = "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0";
string resourceGroupName = "myRg";
string workspaceName = "myWorkspace";
ResourceIdentifier operationalInsightsWorkspaceSecurityInsightsResourceId = OperationalInsightsWorkspaceSecurityInsightsResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, workspaceName);
OperationalInsightsWorkspaceSecurityInsightsResource operationalInsightsWorkspaceSecurityInsights = client.GetOperationalInsightsWorkspaceSecurityInsightsResource(operationalInsightsWorkspaceSecurityInsightsResourceId);

// get the collection of this SecurityInsightsDataConnectorResource
SecurityInsightsDataConnectorCollection collection = operationalInsightsWorkspaceSecurityInsights.GetSecurityInsightsDataConnectors();

// invoke the operation
string dataConnectorId = "c345bf40-8509-4ed2-b947-50cb773aaf04";
NullableResponse<SecurityInsightsDataConnectorResource> response = await collection.GetIfExistsAsync(dataConnectorId);
SecurityInsightsDataConnectorResource result = response.HasValue ? response.Value : null;

if (result == null)
{
    Console.WriteLine($"Succeeded with null as result");
}
else
{
    // the variable result is a resource, you could call other operations on this instance as well
    // but just for demo, we get its data from this resource instance
    SecurityInsightsDataConnectorData resourceData = result.Data;
    // for demo we just print out the id
    Console.WriteLine($"Succeeded on id: {resourceData.Id}");
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Resposta de exemplo

Código de status:

200

{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/c345bf40-8509-4ed2-b947-50cb773aaf04",
  "name": "c345bf40-8509-4ed2-b947-50cb773aaf04",
  "type": "Microsoft.SecurityInsights/dataConnectors",
  "kind": "MicrosoftThreatProtection",
  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
  "properties": {
    "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8",
    "dataTypes": {
      "incidents": {
        "state": "Enabled"
      },
      "alerts": {
        "state": "Enabled"
      }
    },
    "filteredProviders": {
      "alerts": [
        "microsoftDefenderForCloudApps"
      ]
    }
  }
}

Get a RestApiPoller data connector

Solicitação de exemplo

HTTP

GET https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/RestApiPoller_fce27b90-d6f5-4d30-991a-af509a2b50a1?api-version=2024-01-01-preview

dotnet

using Azure;
using Azure.ResourceManager;
using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.SecurityInsights.Models;
using Azure.ResourceManager.SecurityInsights;

// Generated from example definition: specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2024-01-01-preview/examples/dataConnectors/GetRestApiPollerById.json
// this example is just showing the usage of "DataConnectors_Get" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this OperationalInsightsWorkspaceSecurityInsightsResource created on azure
// for more information of creating OperationalInsightsWorkspaceSecurityInsightsResource, please refer to the document of OperationalInsightsWorkspaceSecurityInsightsResource
string subscriptionId = "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0";
string resourceGroupName = "myRg";
string workspaceName = "myWorkspace";
ResourceIdentifier operationalInsightsWorkspaceSecurityInsightsResourceId = OperationalInsightsWorkspaceSecurityInsightsResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, workspaceName);
OperationalInsightsWorkspaceSecurityInsightsResource operationalInsightsWorkspaceSecurityInsights = client.GetOperationalInsightsWorkspaceSecurityInsightsResource(operationalInsightsWorkspaceSecurityInsightsResourceId);

// get the collection of this SecurityInsightsDataConnectorResource
SecurityInsightsDataConnectorCollection collection = operationalInsightsWorkspaceSecurityInsights.GetSecurityInsightsDataConnectors();

// invoke the operation
string dataConnectorId = "RestApiPoller_fce27b90-d6f5-4d30-991a-af509a2b50a1";
NullableResponse<SecurityInsightsDataConnectorResource> response = await collection.GetIfExistsAsync(dataConnectorId);
SecurityInsightsDataConnectorResource result = response.HasValue ? response.Value : null;

if (result == null)
{
    Console.WriteLine($"Succeeded with null as result");
}
else
{
    // the variable result is a resource, you could call other operations on this instance as well
    // but just for demo, we get its data from this resource instance
    SecurityInsightsDataConnectorData resourceData = result.Data;
    // for demo we just print out the id
    Console.WriteLine($"Succeeded on id: {resourceData.Id}");
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Resposta de exemplo

Código de status:

200

{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/RestApiPoller_afef3743-0c88-469c-84ff-ca2e87dc1e48",
  "name": "RestApiPoller_fce27b90-d6f5-4d30-991a-af509a2b50a1",
  "type": "Microsoft.SecurityInsights/dataConnectors",
  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
  "kind": "RestApiPoller",
  "properties": {
    "connectorDefinitionName": "RestApiPollerDefinition",
    "auth": {
      "type": "APIKey",
      "apiKey": "6bec40cf957de430a6f1f2baa056b99a4fac9ea0",
      "apiKeyName": "X-Cisco-Meraki-API-Key"
    },
    "dcrConfig": {
      "streamName": "Meraki",
      "dataCollectionEndpoint": "data collection Endpoint",
      "dataCollectionRuleImmutableId": "data collection rule immutableId"
    },
    "request": {
      "apiEndpoint": "https://api.meraki.com/api/v1/organizations/573083052582915028/networks",
      "rateLimitQPS": 10,
      "queryWindowInMin": 6,
      "httpMethod": "GET",
      "queryTimeFormat": "UnixTimestamp",
      "startTimeAttributeName": "t0",
      "endTimeAttributeName": "t1",
      "retryCount": 3,
      "timeoutInSeconds": 60,
      "headers": {
        "Accept": "application/json",
        "User-Agent": "Scuba"
      },
      "queryParameters": {
        "perPage": 1000
      }
    },
    "paging": {
      "pagingType": "LinkHeader"
    },
    "response": {
      "eventsJsonPaths": [
        "$"
      ]
    }
  }
}

Get a TI data connector

Solicitação de exemplo

HTTP

GET https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/c345bf40-8509-4ed2-b947-50cb773aaf04?api-version=2024-01-01-preview

dotnet

using Azure;
using Azure.ResourceManager;
using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.SecurityInsights.Models;
using Azure.ResourceManager.SecurityInsights;

// Generated from example definition: specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2024-01-01-preview/examples/dataConnectors/GetThreatIntelligenceById.json
// this example is just showing the usage of "DataConnectors_Get" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this OperationalInsightsWorkspaceSecurityInsightsResource created on azure
// for more information of creating OperationalInsightsWorkspaceSecurityInsightsResource, please refer to the document of OperationalInsightsWorkspaceSecurityInsightsResource
string subscriptionId = "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0";
string resourceGroupName = "myRg";
string workspaceName = "myWorkspace";
ResourceIdentifier operationalInsightsWorkspaceSecurityInsightsResourceId = OperationalInsightsWorkspaceSecurityInsightsResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, workspaceName);
OperationalInsightsWorkspaceSecurityInsightsResource operationalInsightsWorkspaceSecurityInsights = client.GetOperationalInsightsWorkspaceSecurityInsightsResource(operationalInsightsWorkspaceSecurityInsightsResourceId);

// get the collection of this SecurityInsightsDataConnectorResource
SecurityInsightsDataConnectorCollection collection = operationalInsightsWorkspaceSecurityInsights.GetSecurityInsightsDataConnectors();

// invoke the operation
string dataConnectorId = "c345bf40-8509-4ed2-b947-50cb773aaf04";
NullableResponse<SecurityInsightsDataConnectorResource> response = await collection.GetIfExistsAsync(dataConnectorId);
SecurityInsightsDataConnectorResource result = response.HasValue ? response.Value : null;

if (result == null)
{
    Console.WriteLine($"Succeeded with null as result");
}
else
{
    // the variable result is a resource, you could call other operations on this instance as well
    // but just for demo, we get its data from this resource instance
    SecurityInsightsDataConnectorData resourceData = result.Data;
    // for demo we just print out the id
    Console.WriteLine($"Succeeded on id: {resourceData.Id}");
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Resposta de exemplo

Código de status:

200

{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/c345bf40-8509-4ed2-b947-50cb773aaf04",
  "name": "c345bf40-8509-4ed2-b947-50cb773aaf04",
  "type": "Microsoft.SecurityInsights/dataConnectors",
  "kind": "ThreatIntelligence",
  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
  "properties": {
    "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8",
    "tipLookbackPeriod": "2020-01-01T13:00:30.123Z",
    "dataTypes": {
      "indicators": {
        "state": "Enabled"
      }
    }
  }
}

Get a TI Taxii data connector.

Solicitação de exemplo

HTTP

GET https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/c39bb458-02a7-4b3f-b0c8-71a1d2692652?api-version=2024-01-01-preview

dotnet

using Azure;
using Azure.ResourceManager;
using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.SecurityInsights.Models;
using Azure.ResourceManager.SecurityInsights;

// Generated from example definition: specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2024-01-01-preview/examples/dataConnectors/GetThreatIntelligenceTaxiiById.json
// this example is just showing the usage of "DataConnectors_Get" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this OperationalInsightsWorkspaceSecurityInsightsResource created on azure
// for more information of creating OperationalInsightsWorkspaceSecurityInsightsResource, please refer to the document of OperationalInsightsWorkspaceSecurityInsightsResource
string subscriptionId = "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0";
string resourceGroupName = "myRg";
string workspaceName = "myWorkspace";
ResourceIdentifier operationalInsightsWorkspaceSecurityInsightsResourceId = OperationalInsightsWorkspaceSecurityInsightsResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, workspaceName);
OperationalInsightsWorkspaceSecurityInsightsResource operationalInsightsWorkspaceSecurityInsights = client.GetOperationalInsightsWorkspaceSecurityInsightsResource(operationalInsightsWorkspaceSecurityInsightsResourceId);

// get the collection of this SecurityInsightsDataConnectorResource
SecurityInsightsDataConnectorCollection collection = operationalInsightsWorkspaceSecurityInsights.GetSecurityInsightsDataConnectors();

// invoke the operation
string dataConnectorId = "c39bb458-02a7-4b3f-b0c8-71a1d2692652";
NullableResponse<SecurityInsightsDataConnectorResource> response = await collection.GetIfExistsAsync(dataConnectorId);
SecurityInsightsDataConnectorResource result = response.HasValue ? response.Value : null;

if (result == null)
{
    Console.WriteLine($"Succeeded with null as result");
}
else
{
    // the variable result is a resource, you could call other operations on this instance as well
    // but just for demo, we get its data from this resource instance
    SecurityInsightsDataConnectorData resourceData = result.Data;
    // for demo we just print out the id
    Console.WriteLine($"Succeeded on id: {resourceData.Id}");
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Resposta de exemplo

Código de status:

200

{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/c39bb458-02a7-4b3f-b0c8-71a1d2692652",
  "name": "c39bb458-02a7-4b3f-b0c8-71a1d2692652",
  "type": "Microsoft.SecurityInsights/dataConnectors",
  "kind": "ThreatIntelligenceTaxii",
  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
  "properties": {
    "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8",
    "workspaceId": "8b014a77-4695-4ef4-96bb-6623afb121a2",
    "friendlyName": "My TI Taxii Connector",
    "taxiiServer": "https://mytaxiiserver.com/taxiing/v2/api",
    "collectionId": "e0b1f32d-1188-48f7-a7a3-de71924e4b5e",
    "userName": "",
    "password": "",
    "taxiiLookbackPeriod": "2020-01-01T13:00:30.123Z",
    "pollingFrequency": "OnceADay",
    "dataTypes": {
      "taxiiClient": {
        "state": "Enabled"
      }
    }
  }
}

Get an AADIP (Azure Active Directory Identity Protection) data connector

Solicitação de exemplo

HTTP

GET https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/f0cd27d2-5f03-4c06-ba31-d2dc82dcb51d?api-version=2024-01-01-preview

dotnet

using Azure;
using Azure.ResourceManager;
using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.SecurityInsights.Models;
using Azure.ResourceManager.SecurityInsights;

// Generated from example definition: specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2024-01-01-preview/examples/dataConnectors/GetAzureActiveDirectoryById.json
// this example is just showing the usage of "DataConnectors_Get" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this OperationalInsightsWorkspaceSecurityInsightsResource created on azure
// for more information of creating OperationalInsightsWorkspaceSecurityInsightsResource, please refer to the document of OperationalInsightsWorkspaceSecurityInsightsResource
string subscriptionId = "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0";
string resourceGroupName = "myRg";
string workspaceName = "myWorkspace";
ResourceIdentifier operationalInsightsWorkspaceSecurityInsightsResourceId = OperationalInsightsWorkspaceSecurityInsightsResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, workspaceName);
OperationalInsightsWorkspaceSecurityInsightsResource operationalInsightsWorkspaceSecurityInsights = client.GetOperationalInsightsWorkspaceSecurityInsightsResource(operationalInsightsWorkspaceSecurityInsightsResourceId);

// get the collection of this SecurityInsightsDataConnectorResource
SecurityInsightsDataConnectorCollection collection = operationalInsightsWorkspaceSecurityInsights.GetSecurityInsightsDataConnectors();

// invoke the operation
string dataConnectorId = "f0cd27d2-5f03-4c06-ba31-d2dc82dcb51d";
NullableResponse<SecurityInsightsDataConnectorResource> response = await collection.GetIfExistsAsync(dataConnectorId);
SecurityInsightsDataConnectorResource result = response.HasValue ? response.Value : null;

if (result == null)
{
    Console.WriteLine($"Succeeded with null as result");
}
else
{
    // the variable result is a resource, you could call other operations on this instance as well
    // but just for demo, we get its data from this resource instance
    SecurityInsightsDataConnectorData resourceData = result.Data;
    // for demo we just print out the id
    Console.WriteLine($"Succeeded on id: {resourceData.Id}");
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Resposta de exemplo

Código de status:

200

{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/f0cd27d2-5f03-4c06-ba31-d2dc82dcb51d",
  "name": "f0cd27d2-5f03-4c06-ba31-d2dc82dcb51d",
  "type": "Microsoft.SecurityInsights/dataConnectors",
  "kind": "AzureActiveDirectory",
  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
  "properties": {
    "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8",
    "dataTypes": {
      "alerts": {
        "state": "Enabled"
      }
    }
  }
}

Get an AATP data connector

Solicitação de exemplo

HTTP

GET https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/07e42cb3-e658-4e90-801c-efa0f29d3d44?api-version=2024-01-01-preview

dotnet

using Azure;
using Azure.ResourceManager;
using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.SecurityInsights.Models;
using Azure.ResourceManager.SecurityInsights;

// Generated from example definition: specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2024-01-01-preview/examples/dataConnectors/GetAzureAdvancedThreatProtectionById.json
// this example is just showing the usage of "DataConnectors_Get" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this OperationalInsightsWorkspaceSecurityInsightsResource created on azure
// for more information of creating OperationalInsightsWorkspaceSecurityInsightsResource, please refer to the document of OperationalInsightsWorkspaceSecurityInsightsResource
string subscriptionId = "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0";
string resourceGroupName = "myRg";
string workspaceName = "myWorkspace";
ResourceIdentifier operationalInsightsWorkspaceSecurityInsightsResourceId = OperationalInsightsWorkspaceSecurityInsightsResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, workspaceName);
OperationalInsightsWorkspaceSecurityInsightsResource operationalInsightsWorkspaceSecurityInsights = client.GetOperationalInsightsWorkspaceSecurityInsightsResource(operationalInsightsWorkspaceSecurityInsightsResourceId);

// get the collection of this SecurityInsightsDataConnectorResource
SecurityInsightsDataConnectorCollection collection = operationalInsightsWorkspaceSecurityInsights.GetSecurityInsightsDataConnectors();

// invoke the operation
string dataConnectorId = "07e42cb3-e658-4e90-801c-efa0f29d3d44";
NullableResponse<SecurityInsightsDataConnectorResource> response = await collection.GetIfExistsAsync(dataConnectorId);
SecurityInsightsDataConnectorResource result = response.HasValue ? response.Value : null;

if (result == null)
{
    Console.WriteLine($"Succeeded with null as result");
}
else
{
    // the variable result is a resource, you could call other operations on this instance as well
    // but just for demo, we get its data from this resource instance
    SecurityInsightsDataConnectorData resourceData = result.Data;
    // for demo we just print out the id
    Console.WriteLine($"Succeeded on id: {resourceData.Id}");
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Resposta de exemplo

Código de status:

200

{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/07e42cb3-e658-4e90-801c-efa0f29d3d44",
  "name": "07e42cb3-e658-4e90-801c-efa0f29d3d44",
  "type": "Microsoft.SecurityInsights/dataConnectors",
  "kind": "AzureAdvancedThreatProtection",
  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
  "properties": {
    "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8",
    "dataTypes": {
      "alerts": {
        "state": "Enabled"
      }
    }
  }
}

Get an Aws S3 data connector

Solicitação de exemplo

HTTP

GET https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/afef3743-0c88-469c-84ff-ca2e87dc1e48?api-version=2024-01-01-preview

dotnet

using Azure;
using Azure.ResourceManager;
using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.SecurityInsights.Models;
using Azure.ResourceManager.SecurityInsights;

// Generated from example definition: specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2024-01-01-preview/examples/dataConnectors/GetAmazonWebServicesS3ById.json
// this example is just showing the usage of "DataConnectors_Get" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this OperationalInsightsWorkspaceSecurityInsightsResource created on azure
// for more information of creating OperationalInsightsWorkspaceSecurityInsightsResource, please refer to the document of OperationalInsightsWorkspaceSecurityInsightsResource
string subscriptionId = "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0";
string resourceGroupName = "myRg";
string workspaceName = "myWorkspace";
ResourceIdentifier operationalInsightsWorkspaceSecurityInsightsResourceId = OperationalInsightsWorkspaceSecurityInsightsResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, workspaceName);
OperationalInsightsWorkspaceSecurityInsightsResource operationalInsightsWorkspaceSecurityInsights = client.GetOperationalInsightsWorkspaceSecurityInsightsResource(operationalInsightsWorkspaceSecurityInsightsResourceId);

// get the collection of this SecurityInsightsDataConnectorResource
SecurityInsightsDataConnectorCollection collection = operationalInsightsWorkspaceSecurityInsights.GetSecurityInsightsDataConnectors();

// invoke the operation
string dataConnectorId = "afef3743-0c88-469c-84ff-ca2e87dc1e48";
NullableResponse<SecurityInsightsDataConnectorResource> response = await collection.GetIfExistsAsync(dataConnectorId);
SecurityInsightsDataConnectorResource result = response.HasValue ? response.Value : null;

if (result == null)
{
    Console.WriteLine($"Succeeded with null as result");
}
else
{
    // the variable result is a resource, you could call other operations on this instance as well
    // but just for demo, we get its data from this resource instance
    SecurityInsightsDataConnectorData resourceData = result.Data;
    // for demo we just print out the id
    Console.WriteLine($"Succeeded on id: {resourceData.Id}");
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Resposta de exemplo

Código de status:

200

{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/afef3743-0c88-469c-84ff-ca2e87dc1e48",
  "name": "afef3743-0c88-469c-84ff-ca2e87dc1e48",
  "type": "Microsoft.SecurityInsights/dataConnectors",
  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
  "kind": "AmazonWebServicesS3",
  "properties": {
    "destinationTable": "AWSVPCFlow",
    "roleArn": "arn:aws:iam::072643944673:role/RoleName",
    "sqsUrls": [
      "https://sqs.us-west-1.amazonaws.com/111111111111/sqsTestName"
    ],
    "dataTypes": {
      "logs": {
        "state": "Enabled"
      }
    }
  }
}

Get an AwsCloudTrail data connector

Solicitação de exemplo

HTTP

GET https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/c345bf40-8509-4ed2-b947-50cb773aaf04?api-version=2024-01-01-preview

dotnet

using Azure;
using Azure.ResourceManager;
using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.SecurityInsights.Models;
using Azure.ResourceManager.SecurityInsights;

// Generated from example definition: specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2024-01-01-preview/examples/dataConnectors/GetAmazonWebServicesCloudTrailById.json
// this example is just showing the usage of "DataConnectors_Get" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this OperationalInsightsWorkspaceSecurityInsightsResource created on azure
// for more information of creating OperationalInsightsWorkspaceSecurityInsightsResource, please refer to the document of OperationalInsightsWorkspaceSecurityInsightsResource
string subscriptionId = "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0";
string resourceGroupName = "myRg";
string workspaceName = "myWorkspace";
ResourceIdentifier operationalInsightsWorkspaceSecurityInsightsResourceId = OperationalInsightsWorkspaceSecurityInsightsResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, workspaceName);
OperationalInsightsWorkspaceSecurityInsightsResource operationalInsightsWorkspaceSecurityInsights = client.GetOperationalInsightsWorkspaceSecurityInsightsResource(operationalInsightsWorkspaceSecurityInsightsResourceId);

// get the collection of this SecurityInsightsDataConnectorResource
SecurityInsightsDataConnectorCollection collection = operationalInsightsWorkspaceSecurityInsights.GetSecurityInsightsDataConnectors();

// invoke the operation
string dataConnectorId = "c345bf40-8509-4ed2-b947-50cb773aaf04";
NullableResponse<SecurityInsightsDataConnectorResource> response = await collection.GetIfExistsAsync(dataConnectorId);
SecurityInsightsDataConnectorResource result = response.HasValue ? response.Value : null;

if (result == null)
{
    Console.WriteLine($"Succeeded with null as result");
}
else
{
    // the variable result is a resource, you could call other operations on this instance as well
    // but just for demo, we get its data from this resource instance
    SecurityInsightsDataConnectorData resourceData = result.Data;
    // for demo we just print out the id
    Console.WriteLine($"Succeeded on id: {resourceData.Id}");
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Resposta de exemplo

Código de status:

200

{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/c345bf40-8509-4ed2-b947-50cb773aaf04",
  "name": "c345bf40-8509-4ed2-b947-50cb773aaf04",
  "type": "Microsoft.SecurityInsights/dataConnectors",
  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
  "kind": "AmazonWebServicesCloudTrail",
  "properties": {
    "awsRoleArn": "myAwsRoleArn",
    "dataTypes": {
      "logs": {
        "state": "Enabled"
      }
    }
  }
}

Get an Office ATP data connector

Solicitação de exemplo

HTTP

GET https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/3d3e955e-33eb-401d-89a7-251c81ddd660?api-version=2024-01-01-preview

dotnet

using Azure;
using Azure.ResourceManager;
using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.SecurityInsights.Models;
using Azure.ResourceManager.SecurityInsights;

// Generated from example definition: specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2024-01-01-preview/examples/dataConnectors/GetOffice365AdvancedThreatProtectionById.json
// this example is just showing the usage of "DataConnectors_Get" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this OperationalInsightsWorkspaceSecurityInsightsResource created on azure
// for more information of creating OperationalInsightsWorkspaceSecurityInsightsResource, please refer to the document of OperationalInsightsWorkspaceSecurityInsightsResource
string subscriptionId = "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0";
string resourceGroupName = "myRg";
string workspaceName = "myWorkspace";
ResourceIdentifier operationalInsightsWorkspaceSecurityInsightsResourceId = OperationalInsightsWorkspaceSecurityInsightsResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, workspaceName);
OperationalInsightsWorkspaceSecurityInsightsResource operationalInsightsWorkspaceSecurityInsights = client.GetOperationalInsightsWorkspaceSecurityInsightsResource(operationalInsightsWorkspaceSecurityInsightsResourceId);

// get the collection of this SecurityInsightsDataConnectorResource
SecurityInsightsDataConnectorCollection collection = operationalInsightsWorkspaceSecurityInsights.GetSecurityInsightsDataConnectors();

// invoke the operation
string dataConnectorId = "3d3e955e-33eb-401d-89a7-251c81ddd660";
NullableResponse<SecurityInsightsDataConnectorResource> response = await collection.GetIfExistsAsync(dataConnectorId);
SecurityInsightsDataConnectorResource result = response.HasValue ? response.Value : null;

if (result == null)
{
    Console.WriteLine($"Succeeded with null as result");
}
else
{
    // the variable result is a resource, you could call other operations on this instance as well
    // but just for demo, we get its data from this resource instance
    SecurityInsightsDataConnectorData resourceData = result.Data;
    // for demo we just print out the id
    Console.WriteLine($"Succeeded on id: {resourceData.Id}");
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Resposta de exemplo

Código de status:

200

{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/3d3e955e-33eb-401d-89a7-251c81ddd660",
  "name": "3d3e955e-33eb-401d-89a7-251c81ddd660",
  "type": "Microsoft.SecurityInsights/dataConnectors",
  "kind": "OfficeATP",
  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
  "properties": {
    "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8",
    "dataTypes": {
      "alerts": {
        "state": "Enabled"
      }
    }
  }
}

Get an Office IRM data connector

Solicitação de exemplo

HTTP

GET https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/3d3e955e-33eb-401d-89a7-251c81ddd660?api-version=2024-01-01-preview

dotnet

using Azure;
using Azure.ResourceManager;
using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.SecurityInsights.Models;
using Azure.ResourceManager.SecurityInsights;

// Generated from example definition: specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2024-01-01-preview/examples/dataConnectors/GetMicrosoftInsiderRiskManagementById.json
// this example is just showing the usage of "DataConnectors_Get" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this OperationalInsightsWorkspaceSecurityInsightsResource created on azure
// for more information of creating OperationalInsightsWorkspaceSecurityInsightsResource, please refer to the document of OperationalInsightsWorkspaceSecurityInsightsResource
string subscriptionId = "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0";
string resourceGroupName = "myRg";
string workspaceName = "myWorkspace";
ResourceIdentifier operationalInsightsWorkspaceSecurityInsightsResourceId = OperationalInsightsWorkspaceSecurityInsightsResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, workspaceName);
OperationalInsightsWorkspaceSecurityInsightsResource operationalInsightsWorkspaceSecurityInsights = client.GetOperationalInsightsWorkspaceSecurityInsightsResource(operationalInsightsWorkspaceSecurityInsightsResourceId);

// get the collection of this SecurityInsightsDataConnectorResource
SecurityInsightsDataConnectorCollection collection = operationalInsightsWorkspaceSecurityInsights.GetSecurityInsightsDataConnectors();

// invoke the operation
string dataConnectorId = "3d3e955e-33eb-401d-89a7-251c81ddd660";
NullableResponse<SecurityInsightsDataConnectorResource> response = await collection.GetIfExistsAsync(dataConnectorId);
SecurityInsightsDataConnectorResource result = response.HasValue ? response.Value : null;

if (result == null)
{
    Console.WriteLine($"Succeeded with null as result");
}
else
{
    // the variable result is a resource, you could call other operations on this instance as well
    // but just for demo, we get its data from this resource instance
    SecurityInsightsDataConnectorData resourceData = result.Data;
    // for demo we just print out the id
    Console.WriteLine($"Succeeded on id: {resourceData.Id}");
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Resposta de exemplo

Código de status:

200

{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/3d3e955e-33eb-401d-89a7-251c81ddd660",
  "name": "3d3e955e-33eb-401d-89a7-251c81ddd660",
  "type": "Microsoft.SecurityInsights/dataConnectors",
  "kind": "OfficeIRM",
  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
  "properties": {
    "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8",
    "dataTypes": {
      "alerts": {
        "state": "Enabled"
      }
    }
  }
}

Get an Office365 data connector.

Solicitação de exemplo

HTTP

GET https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/73e01a99-5cd7-4139-a149-9f2736ff2ab5?api-version=2024-01-01-preview

dotnet

using Azure;
using Azure.ResourceManager;
using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.SecurityInsights.Models;
using Azure.ResourceManager.SecurityInsights;

// Generated from example definition: specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2024-01-01-preview/examples/dataConnectors/GetOfficeDataConnetorById.json
// this example is just showing the usage of "DataConnectors_Get" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this OperationalInsightsWorkspaceSecurityInsightsResource created on azure
// for more information of creating OperationalInsightsWorkspaceSecurityInsightsResource, please refer to the document of OperationalInsightsWorkspaceSecurityInsightsResource
string subscriptionId = "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0";
string resourceGroupName = "myRg";
string workspaceName = "myWorkspace";
ResourceIdentifier operationalInsightsWorkspaceSecurityInsightsResourceId = OperationalInsightsWorkspaceSecurityInsightsResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, workspaceName);
OperationalInsightsWorkspaceSecurityInsightsResource operationalInsightsWorkspaceSecurityInsights = client.GetOperationalInsightsWorkspaceSecurityInsightsResource(operationalInsightsWorkspaceSecurityInsightsResourceId);

// get the collection of this SecurityInsightsDataConnectorResource
SecurityInsightsDataConnectorCollection collection = operationalInsightsWorkspaceSecurityInsights.GetSecurityInsightsDataConnectors();

// invoke the operation
string dataConnectorId = "73e01a99-5cd7-4139-a149-9f2736ff2ab5";
NullableResponse<SecurityInsightsDataConnectorResource> response = await collection.GetIfExistsAsync(dataConnectorId);
SecurityInsightsDataConnectorResource result = response.HasValue ? response.Value : null;

if (result == null)
{
    Console.WriteLine($"Succeeded with null as result");
}
else
{
    // the variable result is a resource, you could call other operations on this instance as well
    // but just for demo, we get its data from this resource instance
    SecurityInsightsDataConnectorData resourceData = result.Data;
    // for demo we just print out the id
    Console.WriteLine($"Succeeded on id: {resourceData.Id}");
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Resposta de exemplo

Código de status:

200

{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
  "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
  "type": "Microsoft.SecurityInsights/dataConnectors",
  "kind": "Office365",
  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
  "properties": {
    "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8",
    "dataTypes": {
      "sharePoint": {
        "state": "Enabled"
      },
      "exchange": {
        "state": "Enabled"
      },
      "teams": {
        "state": "Enabled"
      }
    }
  }
}

Get an Office365 PowerBI data connector

Solicitação de exemplo

HTTP

GET https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/73e01a99-5cd7-4139-a149-9f2736ff2ab5?api-version=2024-01-01-preview

dotnet

using Azure;
using Azure.ResourceManager;
using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.SecurityInsights.Models;
using Azure.ResourceManager.SecurityInsights;

// Generated from example definition: specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2024-01-01-preview/examples/dataConnectors/GetOfficePowerBIDataConnetorById.json
// this example is just showing the usage of "DataConnectors_Get" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this OperationalInsightsWorkspaceSecurityInsightsResource created on azure
// for more information of creating OperationalInsightsWorkspaceSecurityInsightsResource, please refer to the document of OperationalInsightsWorkspaceSecurityInsightsResource
string subscriptionId = "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0";
string resourceGroupName = "myRg";
string workspaceName = "myWorkspace";
ResourceIdentifier operationalInsightsWorkspaceSecurityInsightsResourceId = OperationalInsightsWorkspaceSecurityInsightsResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, workspaceName);
OperationalInsightsWorkspaceSecurityInsightsResource operationalInsightsWorkspaceSecurityInsights = client.GetOperationalInsightsWorkspaceSecurityInsightsResource(operationalInsightsWorkspaceSecurityInsightsResourceId);

// get the collection of this SecurityInsightsDataConnectorResource
SecurityInsightsDataConnectorCollection collection = operationalInsightsWorkspaceSecurityInsights.GetSecurityInsightsDataConnectors();

// invoke the operation
string dataConnectorId = "73e01a99-5cd7-4139-a149-9f2736ff2ab5";
NullableResponse<SecurityInsightsDataConnectorResource> response = await collection.GetIfExistsAsync(dataConnectorId);
SecurityInsightsDataConnectorResource result = response.HasValue ? response.Value : null;

if (result == null)
{
    Console.WriteLine($"Succeeded with null as result");
}
else
{
    // the variable result is a resource, you could call other operations on this instance as well
    // but just for demo, we get its data from this resource instance
    SecurityInsightsDataConnectorData resourceData = result.Data;
    // for demo we just print out the id
    Console.WriteLine($"Succeeded on id: {resourceData.Id}");
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Resposta de exemplo

Código de status:

200

{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
  "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
  "type": "Microsoft.SecurityInsights/dataConnectors",
  "kind": "OfficePowerBI",
  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
  "properties": {
    "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8",
    "dataTypes": {
      "logs": {
        "state": "Enabled"
      }
    }
  }
}

Get an Office365 Project data connector

Solicitação de exemplo

HTTP

GET https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/73e01a99-5cd7-4139-a149-9f2736ff2ab5?api-version=2024-01-01-preview

dotnet

using Azure;
using Azure.ResourceManager;
using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.SecurityInsights.Models;
using Azure.ResourceManager.SecurityInsights;

// Generated from example definition: specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2024-01-01-preview/examples/dataConnectors/GetOffice365ProjectDataConnetorById.json
// this example is just showing the usage of "DataConnectors_Get" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this OperationalInsightsWorkspaceSecurityInsightsResource created on azure
// for more information of creating OperationalInsightsWorkspaceSecurityInsightsResource, please refer to the document of OperationalInsightsWorkspaceSecurityInsightsResource
string subscriptionId = "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0";
string resourceGroupName = "myRg";
string workspaceName = "myWorkspace";
ResourceIdentifier operationalInsightsWorkspaceSecurityInsightsResourceId = OperationalInsightsWorkspaceSecurityInsightsResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, workspaceName);
OperationalInsightsWorkspaceSecurityInsightsResource operationalInsightsWorkspaceSecurityInsights = client.GetOperationalInsightsWorkspaceSecurityInsightsResource(operationalInsightsWorkspaceSecurityInsightsResourceId);

// get the collection of this SecurityInsightsDataConnectorResource
SecurityInsightsDataConnectorCollection collection = operationalInsightsWorkspaceSecurityInsights.GetSecurityInsightsDataConnectors();

// invoke the operation
string dataConnectorId = "73e01a99-5cd7-4139-a149-9f2736ff2ab5";
NullableResponse<SecurityInsightsDataConnectorResource> response = await collection.GetIfExistsAsync(dataConnectorId);
SecurityInsightsDataConnectorResource result = response.HasValue ? response.Value : null;

if (result == null)
{
    Console.WriteLine($"Succeeded with null as result");
}
else
{
    // the variable result is a resource, you could call other operations on this instance as well
    // but just for demo, we get its data from this resource instance
    SecurityInsightsDataConnectorData resourceData = result.Data;
    // for demo we just print out the id
    Console.WriteLine($"Succeeded on id: {resourceData.Id}");
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Resposta de exemplo

Código de status:

200

{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/73e01a99-5cd7-4139-a149-9f2736ff2ab5",
  "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
  "type": "Microsoft.SecurityInsights/dataConnectors",
  "kind": "Office365Project",
  "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
  "properties": {
    "tenantId": "2070ecc9-b4d5-4ae4-adaa-936fa1954fa8",
    "dataTypes": {
      "logs": {
        "state": "Enabled"
      }
    }
  }
}

Definições

Nome	Description
AADDataConnector	Representa o conector de dados do AADIP (Azure Active Directory Identity Protection).
AATPDataConnector	Representa o conector de dados AATP (Proteção Avançada contra Ameaças do Azure).
Alerts	Alerta o tipo de dados para o conector de dados das Plataformas de Proteção contra Ameaças da Microsoft.
AlertsDataTypeOfDataConnector	Alertas de tipo de dados para conectores de dados.
ApiKeyAuthModel	Modelo de autenticação com a Chave de API. Resultará em cabeçalho adicional na solicitação (comportamento padrão) para o servidor remoto: 'ApiKeyName: ApiKeyIdentifier ApiKey'. Se 'IsApiKeyInPostPayload' for true, ele o enviará no corpo da solicitação e não no cabeçalho.
ASCDataConnector	Representa o conector de dados asc (Central de Segurança do Azure).
Availability	Status de disponibilidade do conector
AvailabilityStatus	O status de disponibilidade do conector
AWSAuthModel	Modelo para autenticação de API com a AWS.
AwsCloudTrailDataConnector	Representa o conector de dados CloudTrail do Amazon Web Services.
AwsCloudTrailDataConnectorDataTypes	Os tipos de dados disponíveis para o conector de dados CloudTrail do Amazon Web Services.
AwsS3DataConnector	Representa o conector de dados do Amazon Web Services S3.
AwsS3DataConnectorDataTypes	Os tipos de dados disponíveis para o conector de dados do Amazon Web Services S3.
BasicAuthModel	Modelo de autenticação de API com fluxo básico – nome de usuário + senha.
CcpAuthType	Tipo de paginação
CcpResponseConfig	Uma configuração de resposta personalizada para uma regra.
CloudError	Estrutura de resposta de erro.
CloudErrorBody	Detalhes do erro.
CodelessApiPollingDataConnector	Representa o conector de dados sondagem de API sem código.
CodelessConnectorPollingAuthProperties	Descrever as propriedades de autenticação necessárias para autenticar com êxito com o servidor
CodelessConnectorPollingConfigProperties	Configuração para descrever a configuração de sondagem para o conector do sondador de API
CodelessConnectorPollingPagingProperties	Descrever as propriedades necessárias para fazer uma chamada de paginação
CodelessConnectorPollingRequestProperties	Descrever as propriedades de solicitação necessárias para efetuar pull com êxito do servidor
CodelessConnectorPollingResponseProperties	Descreve a resposta do servidor externo
CodelessUiConnectorConfigProperties	Configuração para descrever a folha de instruções
CodelessUiDataConnector	Representa o conector de dados da interface do usuário sem código.
ConnectivityCriteria	Configuração para a conectividade de verificação do conector
ConnectivityType	tipo de conectividade
createdByType	O tipo de identidade que criou o recurso.
Customs	Permissões alfandegárias necessárias para o conector
DataConnectorDataTypeCommon	Campo comum para tipo de dados em conectores de dados.
DataConnectorKind	O tipo do conector de dados
DataTypes	Tipos de dados para verificar se há últimos dados recebidos
DataTypeState	Descreva se essa conexão de tipo de dados está habilitada ou não.
DCRConfiguration	A configuração do destino dos dados.
Dynamics365CdsActivities	Conexão de tipo de dados do Common Data Service.
Dynamics365DataConnector	Representa o conector de dados do Dynamics365.
Dynamics365DataConnectorDataTypes	Os tipos de dados disponíveis para o conector de dados do Dynamics365.
Exchange	Conexão de tipo de dados do Exchange.
GCPAuthModel	Modelo de autenticação de API para todos os conectores do tipo GCP.
GCPAuthProperties	Propriedades da seção de autenticação do Google Cloud Platform.
GCPDataConnector	Representa o conector de dados do Google Cloud Platform.
GCPRequestProperties	Propriedades da seção de solicitação do Google Cloud Platform.
GenericBlobSbsAuthModel	Modelo de autenticação de API para trabalhar com o barramento de serviço ou a conta de armazenamento.
GitHubAuthModel	Modelo de autenticação de API para GitHub. Para essa autenticação primeiro, precisamos aprovar o aplicativo Roteador (Microsoft Security DevOps) para acessar a conta do GitHub, então só precisamos da InstallationId para obter o token de acesso do https://api.github.com/app/installations/{installId}/access_tokens.
GraphQueries	A consulta de grafo para mostrar o status dos dados atuais
httpMethodVerb	O método HTTP, valor padrão GET.
Incidents	Tipo de dados de incidentes para o conector de dados das Plataformas de Proteção contra Ameaças da Microsoft.
Indicators	Tipo de dados para conexão de indicadores.
Instructions	Detalhes da etapa de instrução
InstructionSteps	Etapas de instrução para habilitar o conector
IoTDataConnector	Representa o conector de dados IoT.
JwtAuthModel	Modelo para autenticação de API com JWT. Troca simples entre nome de usuário + senha para acessar o token.
Logs	Tipo de dados de logs.
MCASDataConnector	Representa o conector de dados MCAS (Microsoft Cloud App Security).
MCASDataConnectorDataTypes	Os tipos de dados disponíveis para o conector de dados do MCAS (Microsoft Cloud App Security).
MDATPDataConnector	Representa o conector de dados MDATP (Proteção Avançada contra Ameaças do Microsoft Defender).
MicrosoftEmergingThreatFeed	Tipo de dados para o conector de dados das Plataformas de Inteligência contra Ameaças da Microsoft.
MicrosoftPurviewInformationProtectionConnectorDataTypes	Os tipos de dados disponíveis para o conector de dados da Proteção de Informações do Microsoft Purview.
MicrosoftPurviewInformationProtectionDataConnector	Representa o conector de dados da Proteção de Informações do Microsoft Purview.
MSTIDataConnector	Representa o conector de dados do Microsoft Threat Intelligence.
MSTIDataConnectorDataTypes	Os tipos de dados disponíveis para o conector de dados das Plataformas de Inteligência contra Ameaças da Microsoft.
MTPDataConnector	Representa o conector de dados MTP (Proteção contra Ameaças da Microsoft).
MTPDataConnectorDataTypes	Os tipos de dados disponíveis para o conector de dados das Plataformas de Proteção contra Ameaças da Microsoft.
MtpFilteredProviders	Representa os provedores filtrados do conector
MtpProvider	Os provedores de dados disponíveis.
NoneAuthModel	Modelo para autenticação de API sem método de autenticação – API pública.
OAuthModel	Modelo para autenticação de API com OAuth2.
Office365ProjectConnectorDataTypes	Os tipos de dados disponíveis para o conector de dados do Office Microsoft Project.
Office365ProjectDataConnector	Representa o conector de dados do Office Microsoft Project.
OfficeATPDataConnector	Representa o conector de dados do OfficeATP (Proteção Avançada contra Ameaças do Office 365).
OfficeDataConnector	Representa o conector de dados do Office.
OfficeDataConnectorDataTypes	Os tipos de dados disponíveis para o conector de dados do Office.
OfficeIRMDataConnector	Representa o conector de dados do OfficeIRM (Microsoft Insider Risk Management).
OfficePowerBIConnectorDataTypes	Os tipos de dados disponíveis para o conector de dados do Microsoft PowerBI do Office.
OfficePowerBIDataConnector	Representa o conector de dados do Microsoft PowerBI do Office.
OracleAuthModel	Modelo de autenticação de API para Oracle.
PermissionProviderScope	Escopo do provedor de permissões
Permissions	Permissões necessárias para o conector
PollingFrequency	A frequência de sondagem para o servidor TAXII.
ProviderName	Nome do provedor
RequiredPermissions	Permissões necessárias para o conector
ResourceProvider	Permissões do provedor de recursos necessárias para o conector
RestApiPollerDataConnector	Representa o conector de dados rest da API Poller.
RestApiPollerRequestConfig	A configuração da solicitação.
RestApiPollerRequestPagingConfig	A configuração de paginação de solicitação.
RestApiPollerRequestPagingKind	Tipo de paginação
SampleQueries	As consultas de exemplo para o conector
SessionAuthModel	Modelo de autenticação de API com cookie de sessão.
SettingType	O tipo de configuração
SharePoint	Conexão de tipo de dados do SharePoint.
systemData	Metadados relativos à criação e última modificação do recurso.
TaxiiClient	Tipo de dados para conector TAXII.
Teams	Conexão de tipo de dados do Teams.
TIDataConnector	Representa o conector de dados de inteligência contra ameaças.
TIDataConnectorDataTypes	Os tipos de dados disponíveis para o conector de dados ti (Inteligência contra Ameaças).
TiTaxiiDataConnector	Conector de dados para efetuar pull de dados de inteligência contra ameaças do servidor TAXII 2.0/2.1
TiTaxiiDataConnectorDataTypes	Os tipos de dados disponíveis para o conector de dados TAXII da Inteligência contra Ameaças.

AADDataConnector

Objeto

Representa o conector de dados do AADIP (Azure Active Directory Identity Protection).

Nome	Tipo	Description
etag	string	Etag do recurso do azure
id	string	ID de recurso totalmente qualificada para o recurso. Por exemplo, "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
kind	string: AzureActiveDirectory	O tipo de conector de dados
name	string	O nome do recurso
properties.dataTypes	AlertsDataTypeOfDataConnector	Os tipos de dados disponíveis para o conector.
properties.tenantId	string	A ID do locatário à qual se conectar e obter os dados.
systemData	systemData	Metadados do Azure Resource Manager que contêm informações createdBy e modifiedBy.
type	string	O tipo do recurso. Por exemplo, "Microsoft.Compute/virtualMachines" ou "Microsoft.Storage/storageAccounts"

AATPDataConnector

Objeto

Representa o conector de dados AATP (Proteção Avançada contra Ameaças do Azure).

Nome	Tipo	Description
etag	string	Etag do recurso do azure
id	string	ID de recurso totalmente qualificada para o recurso. Por exemplo, "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
kind	string: AzureAdvancedThreatProtection	O tipo de conector de dados
name	string	O nome do recurso
properties.dataTypes	AlertsDataTypeOfDataConnector	Os tipos de dados disponíveis para o conector.
properties.tenantId	string	A ID do locatário à qual se conectar e obter os dados.
systemData	systemData	Metadados do Azure Resource Manager que contêm informações createdBy e modifiedBy.
type	string	O tipo do recurso. Por exemplo, "Microsoft.Compute/virtualMachines" ou "Microsoft.Storage/storageAccounts"

Alerts

Objeto

Alerta o tipo de dados para o conector de dados das Plataformas de Proteção contra Ameaças da Microsoft.

Nome	Tipo	Description
state	DataTypeState	Descreva se essa conexão de tipo de dados está habilitada ou não.

AlertsDataTypeOfDataConnector

Objeto

Alertas de tipo de dados para conectores de dados.

Nome	Tipo	Description
alerts	DataConnectorDataTypeCommon	Alertas de conexão de tipo de dados.

ApiKeyAuthModel

Objeto

Modelo de autenticação com a Chave de API. Resultará em cabeçalho adicional na solicitação (comportamento padrão) para o servidor remoto: 'ApiKeyName: ApiKeyIdentifier ApiKey'. Se 'IsApiKeyInPostPayload' for true, ele o enviará no corpo da solicitação e não no cabeçalho.

Nome	Tipo	Description
apiKey	string	Chave de API para a credencial de chave secreta do usuário
apiKeyIdentifier	string	Identificador de chave de API
apiKeyName	string	Nome da chave de API
isApiKeyInPostPayload	boolean	Sinalizar para indicar se a chave de API está definida no conteúdo HTTP POST
type	string: APIKey	O tipo de autenticação

ASCDataConnector

Objeto

Representa o conector de dados asc (Central de Segurança do Azure).

Nome	Tipo	Description
etag	string	Etag do recurso do azure
id	string	ID de recurso totalmente qualificada para o recurso. Por exemplo, "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
kind	string: AzureSecurityCenter	O tipo de conector de dados
name	string	O nome do recurso
properties.dataTypes	AlertsDataTypeOfDataConnector	Os tipos de dados disponíveis para o conector.
properties.subscriptionId	string	A ID da assinatura à qual se conectar e obter os dados.
systemData	systemData	Metadados do Azure Resource Manager que contêm informações createdBy e modifiedBy.
type	string	O tipo do recurso. Por exemplo, "Microsoft.Compute/virtualMachines" ou "Microsoft.Storage/storageAccounts"

Availability

Objeto

Status de disponibilidade do conector

Nome	Tipo	Description
isPreview	boolean	Definir o conector como visualização
status	AvailabilityStatus	O status de disponibilidade do conector

AvailabilityStatus

Enumeração

O status de disponibilidade do conector

Valor	Description
1

AWSAuthModel

Objeto

Modelo para autenticação de API com a AWS.

Nome	Tipo	Description
externalId	string	O STS do AWS assume a ID externa da função. Isso é usado para evitar o problema de deputado confuso: 'https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html'
roleArn	string	AWS STS assume função ARN
type	string: AWS	O tipo de autenticação

AwsCloudTrailDataConnector

Objeto

Representa o conector de dados CloudTrail do Amazon Web Services.

Nome	Tipo	Description
etag	string	Etag do recurso do azure
id	string	ID de recurso totalmente qualificada para o recurso. Por exemplo, "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
kind	string: AmazonWebServicesCloudTrail	O tipo de conector de dados
name	string	O nome do recurso
properties.awsRoleArn	string	O Aws Role Arn (com a política CloudTrailReadOnly) que é usado para acessar a conta do Aws.
properties.dataTypes	AwsCloudTrailDataConnectorDataTypes	Os tipos de dados disponíveis para o conector.
systemData	systemData	Metadados do Azure Resource Manager que contêm informações createdBy e modifiedBy.
type	string	O tipo do recurso. Por exemplo, "Microsoft.Compute/virtualMachines" ou "Microsoft.Storage/storageAccounts"

AwsCloudTrailDataConnectorDataTypes

Objeto

Os tipos de dados disponíveis para o conector de dados CloudTrail do Amazon Web Services.

Nome	Tipo	Description
logs	Logs	Tipo de dados de logs.

AwsS3DataConnector

Objeto

Representa o conector de dados do Amazon Web Services S3.

Nome	Tipo	Description
etag	string	Etag do recurso do azure
id	string	ID de recurso totalmente qualificada para o recurso. Por exemplo, "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
kind	string: AmazonWebServicesS3	O tipo de conector de dados
name	string	O nome do recurso
properties.dataTypes	AwsS3DataConnectorDataTypes	Os tipos de dados disponíveis para o conector.
properties.destinationTable	string	O nome da tabela de destino de logs no LogAnalytics.
properties.roleArn	string	O Aws Role Arn usado para acessar a conta do Aws.
properties.sqsUrls	string[]	As URLs sqs do AWS para o conector.
systemData	systemData	Metadados do Azure Resource Manager que contêm informações createdBy e modifiedBy.
type	string	O tipo do recurso. Por exemplo, "Microsoft.Compute/virtualMachines" ou "Microsoft.Storage/storageAccounts"

AwsS3DataConnectorDataTypes

Objeto

Os tipos de dados disponíveis para o conector de dados do Amazon Web Services S3.

Nome	Tipo	Description
logs	Logs	Tipo de dados de logs.

BasicAuthModel

Objeto

Modelo de autenticação de API com fluxo básico – nome de usuário + senha.

Nome	Tipo	Description
password	string	A senha
type	string: Basic	O tipo de autenticação
userName	string	O nome de usuário.

CcpAuthType

Enumeração

Tipo de paginação

Valor	Description
APIKey
AWS
Basic
GCP
GitHub
JwtToken
None
OAuth2
Oracle
ServiceBus
Session

CcpResponseConfig

Objeto

Uma configuração de resposta personalizada para uma regra.

Nome	Tipo	Valor padrão	Description
compressionAlgo	string		O algoritmo de compactação.
convertChildPropertiesToArray	boolean		O valor que indica se a resposta não é uma matriz de eventos/logs. Ao definir esse sinalizador como true, significa que o servidor remoto responderá com um objeto que cada propriedade tem como valor uma matriz de eventos/logs.
csvDelimiter	string		O delimitador csv, caso o formato de resposta seja CSV.
csvEscape	string	"	Caractere Th usado para escapar de caracteres em CSV.
eventsJsonPaths	string[]		Os caminhos json, '$' char é a raiz json.
format	string	json	O formato de resposta. os valores possíveis são json, csv, xml
hasCsvBoundary	boolean		O valor que indica se a resposta tem limite de CSV caso a resposta seja no formato CSV.
hasCsvHeader	boolean		O valor que indica se a resposta tem cabeçalhos no caso da resposta no formato CSV.
isGzipCompressed	boolean		O valor que indica se o servidor remoto dá suporte a Gzip e devemos esperar uma resposta Gzip.
successStatusJsonPath	string		O valor em que a mensagem/código de status deve aparecer na resposta.
successStatusValue	string		O valor do status.

CloudError

Objeto

Estrutura de resposta de erro.

Nome	Tipo	Description
error	CloudErrorBody	Dados de erro

CloudErrorBody

Objeto

Detalhes do erro.

Nome	Tipo	Description
code	string	Um identificador para o erro. Os códigos são invariáveis e devem ser consumidos programaticamente.
message	string	Uma mensagem que descreve o erro, destinada a ser adequada para exibição em uma interface do usuário.

CodelessApiPollingDataConnector

Objeto

Representa o conector de dados sondagem de API sem código.

Nome	Tipo	Description
etag	string	Etag do recurso do azure
id	string	ID de recurso totalmente qualificada para o recurso. Por exemplo, "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
kind	string: APIPolling	O tipo de conector de dados
name	string	O nome do recurso
properties.connectorUiConfig	CodelessUiConnectorConfigProperties	Configuração para descrever a folha de instruções
properties.pollingConfig	CodelessConnectorPollingConfigProperties	Configuração para descrever as instruções de sondagem
systemData	systemData	Metadados do Azure Resource Manager que contêm informações createdBy e modifiedBy.
type	string	O tipo do recurso. Por exemplo, "Microsoft.Compute/virtualMachines" ou "Microsoft.Storage/storageAccounts"

CodelessConnectorPollingAuthProperties

Objeto

Descrever as propriedades de autenticação necessárias para autenticar com êxito com o servidor

Nome	Tipo	Description
apiKeyIdentifier	string	Um prefixo enviar no cabeçalho antes do token real
apiKeyName	string	O nome do cabeçalho com o qual o token é enviado
authType	string	O tipo de autenticação
authorizationEndpoint	string	O ponto de extremidade usado para autorizar o usuário, usado no fluxo Oauth 2.0
authorizationEndpointQueryParameters	object	Os parâmetros de consulta usados na solicitação de autorização, usados no fluxo Oauth 2.0
flowName	string	Descreve o nome do fluxo, por exemplo, 'AuthCode' para Oauth 2.0
isApiKeyInPostPayload	string	Marca se a chave deve ser enviada no cabeçalho
isClientSecretInHeader	boolean	Marca se devemos enviar o segredo do cliente em cabeçalho ou conteúdo, usado no fluxo Oauth 2.0
redirectionEndpoint	string	O ponto de extremidade de redirecionamento em que obteremos o código de autorização, usado no fluxo Oauth 2.0
scope	string	O escopo do token OAuth
tokenEndpoint	string	O ponto de extremidade usado para emitir um token, usado no fluxo Oauth 2.0
tokenEndpointHeaders	object	Os cabeçalhos de consulta usados na solicitação de token, usados no fluxo Oauth 2.0
tokenEndpointQueryParameters	object	Os parâmetros de consulta usados na solicitação de token, usados no fluxo Oauth 2.0

CodelessConnectorPollingConfigProperties

Objeto

Configuração para descrever a configuração de sondagem para o conector do sondador de API

Nome	Tipo	Description
auth	CodelessConnectorPollingAuthProperties	Descrever o tipo de autenticação do poller
isActive	boolean	O status ativo do sondador
paging	CodelessConnectorPollingPagingProperties	Descrever a configuração de paginação da solicitação de votação do sondador
request	CodelessConnectorPollingRequestProperties	Descrever os parâmetros de configuração da solicitação de votação do sondador
response	CodelessConnectorPollingResponseProperties	Descrever os parâmetros de configuração de resposta do sondador

CodelessConnectorPollingPagingProperties

Objeto

Descrever as propriedades necessárias para fazer uma chamada de paginação

Nome	Tipo	Description
nextPageParaName	string	Define o nome de um atributo de próxima página
nextPageTokenJsonPath	string	Define o caminho para um JSON de token de próxima página
pageCountAttributePath	string	Define o caminho para um atributo de contagem de páginas
pageSize	integer	Define o tamanho da paginação
pageSizeParaName	string	Define o nome do parâmetro de tamanho de página
pageTimeStampAttributePath	string	Define o caminho para um atributo de carimbo de data/hora de paginação
pageTotalCountAttributePath	string	Define o caminho para um atributo de contagem total de páginas
pagingType	string	Descreve o tipo. pode ser 'None', 'PageToken', 'PageCount', 'TimeStamp'
searchTheLatestTimeStampFromEventsList	string	Determina se o carimbo de data/hora mais recente deve ser pesquisado na lista de eventos

CodelessConnectorPollingRequestProperties

Objeto

Descrever as propriedades de solicitação necessárias para efetuar pull com êxito do servidor

Nome	Tipo	Description
apiEndpoint	string	Descrever o ponto de extremidade do qual devemos extrair os dados
endTimeAttributeName	string	Isso será usado nos eventos de consulta do final da janela de tempo
headers	object	Descrever os cabeçalhos enviados na solicitação de votação
httpMethod	string	O tipo de método http que usaremos na solicitação de pesquisa, GET ou POST
queryParameters	object	Descrever os parâmetros de consulta enviados na solicitação de sondagem
queryParametersTemplate	string	Para cenários avançados, por exemplo, nome de usuário/senha inserido no conteúdo JSON aninhado
queryTimeFormat	string	O formato de hora será usado nos eventos de consulta em uma janela específica
queryWindowInMin	integer	O intervalo de janela que usaremos para efetuar pull dos dados
rateLimitQps	integer	Define o QPS do limite de taxa
retryCount	integer	Descrever a quantidade de tempo que devemos tentar sondar os dados em caso de falha
startTimeAttributeName	string	Isso será usado nos eventos de consulta desde o início da janela de tempo
timeoutInSeconds	integer	O número de segundos que consideraremos como um tempo limite de solicitação

CodelessConnectorPollingResponseProperties

Objeto

Descreve a resposta do servidor externo

Nome	Tipo	Description
eventsJsonPaths	string[]	Descreve o caminho que devemos extrair os dados na resposta
isGzipCompressed	boolean	Descreve se os dados na resposta são Gzip
successStatusJsonPath	string	Descreve o caminho que devemos extrair o código de status na resposta
successStatusValue	string	Descreve o caminho que devemos extrair o valor de status na resposta

CodelessUiConnectorConfigProperties

Objeto

Configuração para descrever a folha de instruções

Nome	Tipo	Description
availability	Availability	Status de disponibilidade do conector
connectivityCriteria	ConnectivityCriteria[]	Definir a maneira como o conector verifica a conectividade
customImage	string	Uma imagem personalizada opcional a ser usada ao exibir o conector na galeria do conector do Azure Sentinel
dataTypes	DataTypes[]	Tipos de dados para verificar se há últimos dados recebidos
descriptionMarkdown	string	Descrição do conector
graphQueries	GraphQueries[]	A consulta de grafo para mostrar o status dos dados atuais
graphQueriesTableName	string	Nome da tabela à qual o conector inserirá os dados
instructionSteps	InstructionSteps[]	Etapas de instrução para habilitar o conector
permissions	Permissions	Permissões necessárias para o conector
publisher	string	Nome do editor do conector
sampleQueries	SampleQueries[]	As consultas de exemplo para o conector
title	string	Título da folha do conector

CodelessUiDataConnector

Objeto

Representa o conector de dados da interface do usuário sem código.

Nome	Tipo	Description
etag	string	Etag do recurso do azure
id	string	ID de recurso totalmente qualificada para o recurso. Por exemplo, "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
kind	string: GenericUI	O tipo de conector de dados
name	string	O nome do recurso
properties.connectorUiConfig	CodelessUiConnectorConfigProperties	Configuração para descrever a folha de instruções
systemData	systemData	Metadados do Azure Resource Manager que contêm informações createdBy e modifiedBy.
type	string	O tipo do recurso. Por exemplo, "Microsoft.Compute/virtualMachines" ou "Microsoft.Storage/storageAccounts"

ConnectivityCriteria

Objeto

Configuração para a conectividade de verificação do conector

Nome	Tipo	Description
type	ConnectivityType	tipo de conectividade
value	string[]	Consultas para verificar a conectividade

ConnectivityType

Enumeração

tipo de conectividade

Valor	Description
IsConnectedQuery

createdByType

Enumeração

O tipo de identidade que criou o recurso.

Valor	Description
Application
Key
ManagedIdentity
User

Customs

Objeto

Permissões alfandegárias necessárias para o conector

Nome	Tipo	Description
description	string	Descrição de permissões alfandegárias
name	string	Nome das permissões alfandegárias

DataConnectorDataTypeCommon

Objeto

Campo comum para tipo de dados em conectores de dados.

Nome	Tipo	Description
state	DataTypeState	Descreva se essa conexão de tipo de dados está habilitada ou não.

DataConnectorKind

Enumeração

O tipo do conector de dados

Valor	Description
APIPolling
AmazonWebServicesCloudTrail
AmazonWebServicesS3
AzureActiveDirectory
AzureAdvancedThreatProtection
AzureSecurityCenter
Dynamics365
GCP
GenericUI
IOT
MicrosoftCloudAppSecurity
MicrosoftDefenderAdvancedThreatProtection
MicrosoftPurviewInformationProtection
MicrosoftThreatIntelligence
MicrosoftThreatProtection
Office365
Office365Project
OfficeATP
OfficeIRM
OfficePowerBI
RestApiPoller
ThreatIntelligence
ThreatIntelligenceTaxii

DataTypes

Objeto

Tipos de dados para verificar se há últimos dados recebidos

Nome	Tipo	Description
lastDataReceivedQuery	string	Consulta para indicar os últimos dados recebidos
name	string	Nome do tipo de dados a ser mostrado no grafo. pode ser usado com o espaço reservado {{graphQueriesTableName}}

DataTypeState

Enumeração

Descreva se essa conexão de tipo de dados está habilitada ou não.

Valor	Description
Disabled
Enabled

DCRConfiguration

Objeto

A configuração do destino dos dados.

Nome	Tipo	Description
dataCollectionEndpoint	string	Representa o ponto de extremidade de ingestão de coleta de dados no log analytics.
dataCollectionRuleImmutableId	string	A ID imutável da regra de coleta de dados, a regra define a transformação e o destino dos dados.
streamName	string	O fluxo para o qual estamos enviando os dados.

Dynamics365CdsActivities

Objeto

Conexão de tipo de dados do Common Data Service.

Nome	Tipo	Description
state	DataTypeState	Descreva se essa conexão de tipo de dados está habilitada ou não.

Dynamics365DataConnector

Objeto

Representa o conector de dados do Dynamics365.

Nome	Tipo	Description
etag	string	Etag do recurso do azure
id	string	ID de recurso totalmente qualificada para o recurso. Por exemplo, "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
kind	string: Dynamics365	O tipo de conector de dados
name	string	O nome do recurso
properties.dataTypes	Dynamics365DataConnectorDataTypes	Os tipos de dados disponíveis para o conector.
properties.tenantId	string	A ID do locatário à qual se conectar e obter os dados.
systemData	systemData	Metadados do Azure Resource Manager que contêm informações createdBy e modifiedBy.
type	string	O tipo do recurso. Por exemplo, "Microsoft.Compute/virtualMachines" ou "Microsoft.Storage/storageAccounts"

Dynamics365DataConnectorDataTypes

Objeto

Os tipos de dados disponíveis para o conector de dados do Dynamics365.

Nome	Tipo	Description
dynamics365CdsActivities	Dynamics365CdsActivities	Conexão de tipo de dados do Common Data Service.

Exchange

Objeto

Conexão de tipo de dados do Exchange.

Nome	Tipo	Description
state	DataTypeState	Descreva se essa conexão de tipo de dados está habilitada ou não.

GCPAuthModel

Objeto

Modelo de autenticação de API para todos os conectores do tipo GCP.

Nome	Tipo	Description
projectNumber	string	Número do projeto GCP
serviceAccountEmail	string	Email da conta de serviço GCP
type	string: GCP	O tipo de autenticação
workloadIdentityProviderId	string	ID do provedor de identidade da carga de trabalho do GCP

GCPAuthProperties

Objeto

Propriedades da seção de autenticação do Google Cloud Platform.

Nome	Tipo	Description
projectNumber	string	O número do projeto GCP.
serviceAccountEmail	string	A conta de serviço usada para acessar o projeto GCP.
workloadIdentityProviderId	string	A ID do provedor de identidade da carga de trabalho usada para obter acesso ao projeto GCP.

GCPDataConnector

Objeto

Representa o conector de dados do Google Cloud Platform.

Nome	Tipo	Description
etag	string	Etag do recurso do azure
id	string	ID de recurso totalmente qualificada para o recurso. Por exemplo, "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
kind	string: GCP	O tipo de conector de dados
name	string	O nome do recurso
properties.auth	GCPAuthProperties	A seção de autenticação do conector.
properties.connectorDefinitionName	string	O nome da definição do conector que representa a configuração da interface do usuário.
properties.dcrConfig	DCRConfiguration	A configuração do destino dos dados.
properties.request	GCPRequestProperties	A seção de solicitação do conector.
systemData	systemData	Metadados do Azure Resource Manager que contêm informações createdBy e modifiedBy.
type	string	O tipo do recurso. Por exemplo, "Microsoft.Compute/virtualMachines" ou "Microsoft.Storage/storageAccounts"

GCPRequestProperties

Objeto

Propriedades da seção de solicitação do Google Cloud Platform.

Nome	Tipo	Description
projectId	string	A ID do projeto GCP.
subscriptionNames	string[]	Os nomes de assinatura de pub/sub do GCP.

GenericBlobSbsAuthModel

Objeto

Modelo de autenticação de API para trabalhar com o barramento de serviço ou a conta de armazenamento.

Nome	Tipo	Description
credentialsConfig	object	Credenciais para namespace do barramento de serviço, keyvault uri para chave de acesso
storageAccountCredentialsConfig	object	Credenciais para a conta de armazenamento, keyvault uri para chave de acesso
type	string: ServiceBus	O tipo de autenticação

GitHubAuthModel

Objeto

Modelo de autenticação de API para GitHub. Para essa autenticação primeiro, precisamos aprovar o aplicativo Roteador (Microsoft Security DevOps) para acessar a conta do GitHub, então só precisamos da InstallationId para obter o token de acesso do https://api.github.com/app/installations/{installId}/access_tokens.

Nome	Tipo	Description
installationId	string	A ID de instalação de autenticação do GitHubApp.
type	string: GitHub	O tipo de autenticação

GraphQueries

Objeto

A consulta de grafo para mostrar o status dos dados atuais

Nome	Tipo	Description
baseQuery	string	A consulta base para o grafo
legend	string	A legenda do grafo
metricName	string	a métrica que a consulta está verificando

httpMethodVerb

Enumeração

O método HTTP, valor padrão GET.

Valor	Description
DELETE
GET
POST
PUT

Incidents

Objeto

Tipo de dados de incidentes para o conector de dados das Plataformas de Proteção contra Ameaças da Microsoft.

Nome	Tipo	Description
state	DataTypeState	Descreva se essa conexão de tipo de dados está habilitada ou não.

Indicators

Objeto

Tipo de dados para conexão de indicadores.

Nome	Tipo	Description
state	DataTypeState	Descreva se essa conexão de tipo de dados está habilitada ou não.

Instructions

Objeto

Detalhes da etapa de instrução

Nome	Tipo	Description
parameters	object	Os parâmetros para a configuração
type	SettingType	O tipo de configuração

InstructionSteps

Objeto

Etapas de instrução para habilitar o conector

Nome	Tipo	Description
description	string	Descrição da etapa de instrução
instructions	Instructions[]	Detalhes da etapa de instrução
title	string	Título da etapa de instrução

IoTDataConnector

Objeto

Representa o conector de dados IoT.

Nome	Tipo	Description
etag	string	Etag do recurso do azure
id	string	ID de recurso totalmente qualificada para o recurso. Por exemplo, "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
kind	string: IOT	O tipo de conector de dados
name	string	O nome do recurso
properties.dataTypes	AlertsDataTypeOfDataConnector	Os tipos de dados disponíveis para o conector.
properties.subscriptionId	string	A ID da assinatura à qual se conectar e obter os dados.
systemData	systemData	Metadados do Azure Resource Manager que contêm informações createdBy e modifiedBy.
type	string	O tipo do recurso. Por exemplo, "Microsoft.Compute/virtualMachines" ou "Microsoft.Storage/storageAccounts"

JwtAuthModel

Objeto

Modelo para autenticação de API com JWT. Troca simples entre nome de usuário + senha para acessar o token.

Nome	Tipo	Valor padrão	Description
headers	object		Os cabeçalhos personalizados que queremos adicionar depois de enviarmos a solicitação ao ponto de extremidade do token.
isCredentialsInHeaders	boolean		Sinalizador indicando se queremos enviar o nome de usuário e a senha para o ponto de extremidade de token nos cabeçalhos.
isJsonRequest	boolean	False	Sinalizador indicando se a solicitação do corpo é JSON (cabeçalho Content-Type = application/json), o que significa que é uma solicitação codificada pela URL do Formulário (cabeçalho Content-Type = application/x-www-form-urlencoded).
password	object		A senha
queryParameters	object		O parâmetro de consulta personalizado que desejamos adicionar quando enviarmos a solicitação para o ponto de extremidade do token.
requestTimeoutInSeconds	integer	100	Tempo limite da solicitação em segundos.
tokenEndpoint	string		Ponto de extremidade de token para solicitar JWT
type	string: JwtToken		O tipo de autenticação
userName	object		O nome de usuário. Se o nome de usuário e a senha forem enviados na solicitação de cabeçalho, só precisaremos preencher a propriedade value com o nome de usuário (o mesmo que a autenticação básica). Se o nome de usuário e a senha forem enviados na solicitação do corpo, precisaremos especificar o Key e Value.

Logs

Objeto

Tipo de dados de logs.

Nome	Tipo	Description
state	DataTypeState	Descreva se essa conexão de tipo de dados está habilitada ou não.

MCASDataConnector

Objeto

Representa o conector de dados MCAS (Microsoft Cloud App Security).

Nome	Tipo	Description
etag	string	Etag do recurso do azure
id	string	ID de recurso totalmente qualificada para o recurso. Por exemplo, "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
kind	string: MicrosoftCloudAppSecurity	O tipo de conector de dados
name	string	O nome do recurso
properties.dataTypes	MCASDataConnectorDataTypes	Os tipos de dados disponíveis para o conector.
properties.tenantId	string	A ID do locatário à qual se conectar e obter os dados.
systemData	systemData	Metadados do Azure Resource Manager que contêm informações createdBy e modifiedBy.
type	string	O tipo do recurso. Por exemplo, "Microsoft.Compute/virtualMachines" ou "Microsoft.Storage/storageAccounts"

MCASDataConnectorDataTypes

Objeto

Os tipos de dados disponíveis para o conector de dados do MCAS (Microsoft Cloud App Security).

Nome	Tipo	Description
alerts	DataConnectorDataTypeCommon	Alertas de conexão de tipo de dados.
discoveryLogs	DataConnectorDataTypeCommon	Conexão de tipo de dados de log de descoberta.

MDATPDataConnector

Objeto

Representa o conector de dados MDATP (Proteção Avançada contra Ameaças do Microsoft Defender).

Nome	Tipo	Description
etag	string	Etag do recurso do azure
id	string	ID de recurso totalmente qualificada para o recurso. Por exemplo, "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
kind	string: MicrosoftDefenderAdvancedThreatProtection	O tipo de conector de dados
name	string	O nome do recurso
properties.dataTypes	AlertsDataTypeOfDataConnector	Os tipos de dados disponíveis para o conector.
properties.tenantId	string	A ID do locatário à qual se conectar e obter os dados.
systemData	systemData	Metadados do Azure Resource Manager que contêm informações createdBy e modifiedBy.
type	string	O tipo do recurso. Por exemplo, "Microsoft.Compute/virtualMachines" ou "Microsoft.Storage/storageAccounts"

MicrosoftEmergingThreatFeed

Objeto

Tipo de dados para o conector de dados das Plataformas de Inteligência contra Ameaças da Microsoft.

Nome	Tipo	Description
lookbackPeriod	string	O período de pesquisa para o feed a ser importado.
state	DataTypeState	Descreva se essa conexão de tipo de dados está habilitada ou não.

MicrosoftPurviewInformationProtectionConnectorDataTypes

Objeto

Os tipos de dados disponíveis para o conector de dados da Proteção de Informações do Microsoft Purview.

Nome	Tipo	Description
logs	Logs	Tipo de dados de logs.

MicrosoftPurviewInformationProtectionDataConnector

Objeto

Representa o conector de dados da Proteção de Informações do Microsoft Purview.

Nome	Tipo	Description
etag	string	Etag do recurso do azure
id	string	ID de recurso totalmente qualificada para o recurso. Por exemplo, "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
kind	string: MicrosoftPurviewInformationProtection	O tipo de conector de dados
name	string	O nome do recurso
properties.dataTypes	MicrosoftPurviewInformationProtectionConnectorDataTypes	Os tipos de dados disponíveis para o conector.
properties.tenantId	string	A ID do locatário à qual se conectar e obter os dados.
systemData	systemData	Metadados do Azure Resource Manager que contêm informações createdBy e modifiedBy.
type	string	O tipo do recurso. Por exemplo, "Microsoft.Compute/virtualMachines" ou "Microsoft.Storage/storageAccounts"

MSTIDataConnector

Objeto

Representa o conector de dados do Microsoft Threat Intelligence.

Nome	Tipo	Description
etag	string	Etag do recurso do azure
id	string	ID de recurso totalmente qualificada para o recurso. Por exemplo, "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
kind	string: MicrosoftThreatIntelligence	O tipo de conector de dados
name	string	O nome do recurso
properties.dataTypes	MSTIDataConnectorDataTypes	Os tipos de dados disponíveis para o conector.
properties.tenantId	string	A ID do locatário à qual se conectar e obter os dados.
systemData	systemData	Metadados do Azure Resource Manager que contêm informações createdBy e modifiedBy.
type	string	O tipo do recurso. Por exemplo, "Microsoft.Compute/virtualMachines" ou "Microsoft.Storage/storageAccounts"

MSTIDataConnectorDataTypes

Objeto

Os tipos de dados disponíveis para o conector de dados das Plataformas de Inteligência contra Ameaças da Microsoft.

Nome	Tipo	Description
microsoftEmergingThreatFeed	MicrosoftEmergingThreatFeed	Tipo de dados para o conector de dados das Plataformas de Inteligência contra Ameaças da Microsoft.

MTPDataConnector

Objeto

Representa o conector de dados MTP (Proteção contra Ameaças da Microsoft).

Nome	Tipo	Description
etag	string	Etag do recurso do azure
id	string	ID de recurso totalmente qualificada para o recurso. Por exemplo, "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
kind	string: MicrosoftThreatProtection	O tipo de conector de dados
name	string	O nome do recurso
properties.dataTypes	MTPDataConnectorDataTypes	Os tipos de dados disponíveis para o conector.
properties.filteredProviders	MtpFilteredProviders	Os provedores filtrados disponíveis para o conector.
properties.tenantId	string	A ID do locatário à qual se conectar e obter os dados.
systemData	systemData	Metadados do Azure Resource Manager que contêm informações createdBy e modifiedBy.
type	string	O tipo do recurso. Por exemplo, "Microsoft.Compute/virtualMachines" ou "Microsoft.Storage/storageAccounts"

MTPDataConnectorDataTypes

Objeto

Os tipos de dados disponíveis para o conector de dados das Plataformas de Proteção contra Ameaças da Microsoft.

Nome	Tipo	Description
alerts	Alerts	Alerta o tipo de dados para o conector de dados das Plataformas de Proteção contra Ameaças da Microsoft.
incidents	Incidents	Tipo de dados de incidentes para o conector de dados das Plataformas de Proteção contra Ameaças da Microsoft.

MtpFilteredProviders

Objeto

Representa os provedores filtrados do conector

Nome	Tipo	Description
alerts	MtpProvider[]	Alertas filtrados provedores. Quando os filtros não forem aplicados, todos os alertas serão transmitidos pelo pipeline mtp, ainda em versão prévia privada para todos os produtos, EXCETO MDA e MDI, que estão no estado ga.

MtpProvider

Enumeração

Os provedores de dados disponíveis.

Valor	Description
microsoftDefenderForCloudApps
microsoftDefenderForIdentity

NoneAuthModel

Objeto

Modelo para autenticação de API sem método de autenticação – API pública.

Nome	Tipo	Description
type	string: None	O tipo de autenticação

OAuthModel

Objeto

Modelo para autenticação de API com OAuth2.

Nome	Tipo	Valor padrão	Description
accessTokenPrepend	string		Prepend do token de acesso. O padrão é "Portador".
authorizationCode	string		O código de autorização do usuário.
authorizationEndpoint	string		O ponto de extremidade de autorização.
authorizationEndpointHeaders	object		Os cabeçalhos do ponto de extremidade de autorização.
authorizationEndpointQueryParameters	object		Os parâmetros de consulta do ponto de extremidade de autorização.
clientId	string		A ID do aplicativo (cliente) que o provedor OAuth atribuiu ao seu aplicativo.
clientSecret	string		O segredo do aplicativo (cliente) que o provedor OAuth atribuiu ao seu aplicativo.
grantType	string		O tipo de concessão, geralmente, será "código de autorização".
isCredentialsInHeaders	boolean	False	Indicando se queremos enviar o clientId e clientSecret para o ponto de extremidade de token nos cabeçalhos.
isJwtBearerFlow	boolean		Um valor que indica se é um fluxo JWT.
redirectUri	string		A URL de redirecionamento de aplicativo que o usuário configura no provedor OAuth.
scope	string		O escopo do aplicativo (cliente) que o provedor OAuth atribuiu ao seu aplicativo.
tokenEndpoint	string		O ponto de extremidade do token. Define o token de atualização OAuth2.
tokenEndpointHeaders	object		Os cabeçalhos do ponto de extremidade do token.
tokenEndpointQueryParameters	object		Os parâmetros de consulta de ponto de extremidade de token.
type	string: OAuth2		O tipo de autenticação

Office365ProjectConnectorDataTypes

Objeto

Os tipos de dados disponíveis para o conector de dados do Office Microsoft Project.

Nome	Tipo	Description
logs	Logs	Tipo de dados de logs.

Office365ProjectDataConnector

Objeto

Representa o conector de dados do Office Microsoft Project.

Nome	Tipo	Description
etag	string	Etag do recurso do azure
id	string	ID de recurso totalmente qualificada para o recurso. Por exemplo, "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
kind	string: Office365Project	O tipo de conector de dados
name	string	O nome do recurso
properties.dataTypes	Office365ProjectConnectorDataTypes	Os tipos de dados disponíveis para o conector.
properties.tenantId	string	A ID do locatário à qual se conectar e obter os dados.
systemData	systemData	Metadados do Azure Resource Manager que contêm informações createdBy e modifiedBy.
type	string	O tipo do recurso. Por exemplo, "Microsoft.Compute/virtualMachines" ou "Microsoft.Storage/storageAccounts"

OfficeATPDataConnector

Objeto

Representa o conector de dados do OfficeATP (Proteção Avançada contra Ameaças do Office 365).

Nome	Tipo	Description
etag	string	Etag do recurso do azure
id	string	ID de recurso totalmente qualificada para o recurso. Por exemplo, "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
kind	string: OfficeATP	O tipo de conector de dados
name	string	O nome do recurso
properties.dataTypes	AlertsDataTypeOfDataConnector	Os tipos de dados disponíveis para o conector.
properties.tenantId	string	A ID do locatário à qual se conectar e obter os dados.
systemData	systemData	Metadados do Azure Resource Manager que contêm informações createdBy e modifiedBy.
type	string	O tipo do recurso. Por exemplo, "Microsoft.Compute/virtualMachines" ou "Microsoft.Storage/storageAccounts"

OfficeDataConnector

Objeto

Representa o conector de dados do Office.

Nome	Tipo	Description
etag	string	Etag do recurso do azure
id	string	ID de recurso totalmente qualificada para o recurso. Por exemplo, "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
kind	string: Office365	O tipo de conector de dados
name	string	O nome do recurso
properties.dataTypes	OfficeDataConnectorDataTypes	Os tipos de dados disponíveis para o conector.
properties.tenantId	string	A ID do locatário à qual se conectar e obter os dados.
systemData	systemData	Metadados do Azure Resource Manager que contêm informações createdBy e modifiedBy.
type	string	O tipo do recurso. Por exemplo, "Microsoft.Compute/virtualMachines" ou "Microsoft.Storage/storageAccounts"

OfficeDataConnectorDataTypes

Objeto

Os tipos de dados disponíveis para o conector de dados do Office.

Nome	Tipo	Description
exchange	Exchange	Conexão de tipo de dados do Exchange.
sharePoint	SharePoint	Conexão de tipo de dados do SharePoint.
teams	Teams	Conexão de tipo de dados do Teams.

OfficeIRMDataConnector

Objeto

Representa o conector de dados do OfficeIRM (Microsoft Insider Risk Management).

Nome	Tipo	Description
etag	string	Etag do recurso do azure
id	string	ID de recurso totalmente qualificada para o recurso. Por exemplo, "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
kind	string: OfficeIRM	O tipo de conector de dados
name	string	O nome do recurso
properties.dataTypes	AlertsDataTypeOfDataConnector	Os tipos de dados disponíveis para o conector.
properties.tenantId	string	A ID do locatário à qual se conectar e obter os dados.
systemData	systemData	Metadados do Azure Resource Manager que contêm informações createdBy e modifiedBy.
type	string	O tipo do recurso. Por exemplo, "Microsoft.Compute/virtualMachines" ou "Microsoft.Storage/storageAccounts"

OfficePowerBIConnectorDataTypes

Objeto

Os tipos de dados disponíveis para o conector de dados do Microsoft PowerBI do Office.

Nome	Tipo	Description
logs	Logs	Tipo de dados de logs.

OfficePowerBIDataConnector

Objeto

Representa o conector de dados do Microsoft PowerBI do Office.

Nome	Tipo	Description
etag	string	Etag do recurso do azure
id	string	ID de recurso totalmente qualificada para o recurso. Por exemplo, "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
kind	string: OfficePowerBI	O tipo de conector de dados
name	string	O nome do recurso
properties.dataTypes	OfficePowerBIConnectorDataTypes	Os tipos de dados disponíveis para o conector.
properties.tenantId	string	A ID do locatário à qual se conectar e obter os dados.
systemData	systemData	Metadados do Azure Resource Manager que contêm informações createdBy e modifiedBy.
type	string	O tipo do recurso. Por exemplo, "Microsoft.Compute/virtualMachines" ou "Microsoft.Storage/storageAccounts"

OracleAuthModel

Objeto

Modelo de autenticação de API para Oracle.

Nome	Tipo	Description
pemFile	string	Conteúdo do arquivo PRM
publicFingerprint	string	Impressão digital pública
tenantId	string	ID do locatário do Oracle
type	string: Oracle	O tipo de autenticação
userId	string	ID de usuário do Oracle

PermissionProviderScope

Enumeração

Escopo do provedor de permissões

Valor	Description
ResourceGroup
Subscription
Workspace

Permissions

Objeto

Permissões necessárias para o conector

Nome	Tipo	Description
customs	Customs[]	Permissões alfandegárias necessárias para o conector
resourceProvider	ResourceProvider[]	Permissões do provedor de recursos necessárias para o conector

PollingFrequency

Enumeração

A frequência de sondagem para o servidor TAXII.

Valor	Description
OnceADay	Uma vez por dia
OnceAMinute	Uma vez por minuto
OnceAnHour	Uma vez por hora

ProviderName

Enumeração

Nome do provedor

Valor	Description
Microsoft.Authorization/policyAssignments
Microsoft.OperationalInsights/solutions
Microsoft.OperationalInsights/workspaces
Microsoft.OperationalInsights/workspaces/datasources
Microsoft.OperationalInsights/workspaces/sharedKeys
microsoft.aadiam/diagnosticSettings

RequiredPermissions

Objeto

Permissões necessárias para o conector

Nome	Tipo	Description
action	boolean	permissão de ação
delete	boolean	permissão de exclusão
read	boolean	permissão de leitura
write	boolean	permissão de gravação

ResourceProvider

Objeto

Permissões do provedor de recursos necessárias para o conector

Nome	Tipo	Description
permissionsDisplayText	string	Texto de descrição da permissão
provider	ProviderName	Nome do provedor
providerDisplayName	string	Nome de exibição do provedor de permissão
requiredPermissions	RequiredPermissions	Permissões necessárias para o conector
scope	PermissionProviderScope	Escopo do provedor de permissões

RestApiPollerDataConnector

Objeto

Representa o conector de dados rest da API Poller.

Nome	Tipo	Description
etag	string	Etag do recurso do azure
id	string	ID de recurso totalmente qualificada para o recurso. Por exemplo, "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
kind	string: RestApiPoller	O tipo de conector de dados
name	string	O nome do recurso
properties.addOnAttributes	object	A adição de atributos. O nome da chave se tornará o nome do atributo (uma coluna) e o valor se tornará o valor do atributo no conteúdo.
properties.auth	CcpAuthConfig: AWSAuthModel ApiKeyAuthModel BasicAuthModel GCPAuthModel GenericBlobSbsAuthModel GitHubAuthModel JwtAuthModel NoneAuthModel OAuthModel OracleAuthModel SessionAuthModel	O modelo de autenticação.
properties.connectorDefinitionName	string	O nome da definição do conector (a ID do recurso dataConnectorDefinition).
properties.dataType	string	O destino da tabela do Log Analytics.
properties.dcrConfig	DCRConfiguration	As propriedades relacionadas ao DCR.
properties.isActive	boolean	Indica se o conector está ativo ou não.
properties.paging	RestApiPollerRequestPagingConfig	A configuração de paginação.
properties.request	RestApiPollerRequestConfig	A configuração da solicitação.
properties.response	CcpResponseConfig	A configuração de resposta.
systemData	systemData	Metadados do Azure Resource Manager que contêm informações createdBy e modifiedBy.
type	string	O tipo do recurso. Por exemplo, "Microsoft.Compute/virtualMachines" ou "Microsoft.Storage/storageAccounts"

RestApiPollerRequestConfig

Objeto

A configuração da solicitação.

Nome	Tipo	Description
apiEndpoint	string	O ponto de extremidade da API.
endTimeAttributeName	string	O nome do parâmetro de consulta que o servidor remoto espera encerrar a consulta. Esta propriedade vai lado a lado com startTimeAttributeName
headers	object	O cabeçalho da solicitação do servidor remoto.
httpMethod	httpMethodVerb	O método HTTP, valor padrão GET.
isPostPayloadJson	boolean	Sinalizador para indicar se a carga HTTP POST está no formato JSON (vs form-urlencoded).
queryParameters		Os parâmetros de consulta HTTP para a API RESTful.
queryParametersTemplate	string	o modelo de parâmetros de consulta. Define o modelo de parâmetros de consulta a ser usado ao passar parâmetros de consulta em cenários avançados.
queryTimeFormat	string	O formato de hora da consulta. Um servidor remoto pode ter uma consulta para efetuar pull de dados do intervalo 'start' a 'end'. Essa propriedade indica qual é o formato de tempo esperado que o servidor remoto sabe analisar.
queryTimeIntervalAttributeName	string	O nome do parâmetro de consulta que precisamos enviar ao servidor para logs de consulta no intervalo de tempo. Deve ser definido com queryTimeIntervalPrepend e queryTimeIntervalDelimiter
queryTimeIntervalDelimiter	string	A cadeia de caracteres delimitador entre 2 QueryTimeFormat no parâmetro de consulta queryTimeIntervalAttributeName.
queryTimeIntervalPrepend	string	O prepend de cadeia de caracteres para o valor do parâmetro de consulta em queryTimeIntervalAttributeName.
queryWindowInMin	integer	A janela de consulta em minutos para a solicitação.
rateLimitQPS	integer	As consultas de limite de taxa por segundo para a solicitação..
retryCount	integer	A contagem de repetições.
startTimeAttributeName	string	O nome do parâmetro de consulta que o servidor remoto espera iniciar a consulta. Esta propriedade vai lado a lado com endTimeAttributeName.
timeoutInSeconds	integer	O tempo limite em segundos.

RestApiPollerRequestPagingConfig

Objeto

A configuração de paginação de solicitação.

Nome	Tipo	Description
pageSize	integer	Tamanho da página
pageSizeParameterName	string	Nome do parâmetro de tamanho da página
pagingType	RestApiPollerRequestPagingKind	Tipo de paginação

RestApiPollerRequestPagingKind

Enumeração

Tipo de paginação

Valor	Description
CountBasedPaging
LinkHeader
NextPageToken
NextPageUrl
Offset
PersistentLinkHeader
PersistentToken

SampleQueries

Objeto

As consultas de exemplo para o conector

Nome	Tipo	Description
description	string	A descrição da consulta de exemplo
query	string	a consulta de exemplo

SessionAuthModel

Objeto

Modelo de autenticação de API com cookie de sessão.

Nome	Tipo	Description
headers	object	Cabeçalhos de solicitação HTTP para o ponto de extremidade do serviço de sessão.
isPostPayloadJson	boolean	Indicando se a chave de API está definida no conteúdo HTTP POST.
password	object	O nome do atributo de senha.
queryParameters		Consultar parâmetros para o ponto de extremidade do serviço de sessão.
sessionIdName	string	Nome do atributo ID da sessão do cabeçalho de resposta HTTP.
sessionLoginRequestUri	string	URL de solicitação HTTP para o ponto de extremidade do serviço de sessão.
sessionTimeoutInMinutes	integer	Tempo limite da sessão em minutos.
type	string: Session	O tipo de autenticação
userName	object	O valor da chave de atributo de nome de usuário.

SettingType

Enumeração

O tipo de configuração

Valor	Description
CopyableLabel
InfoMessage
InstructionStepsGroup

SharePoint

Objeto

Conexão de tipo de dados do SharePoint.

Nome	Tipo	Description
state	DataTypeState	Descreva se essa conexão de tipo de dados está habilitada ou não.

systemData

Objeto

Metadados relativos à criação e última modificação do recurso.

Nome	Tipo	Description
createdAt	string	O carimbo de data/hora da criação de recursos (UTC).
createdBy	string	A identidade que criou o recurso.
createdByType	createdByType	O tipo de identidade que criou o recurso.
lastModifiedAt	string	O carimbo de data/hora da última modificação do recurso (UTC)
lastModifiedBy	string	A identidade que modificou o recurso pela última vez.
lastModifiedByType	createdByType	O tipo de identidade que modificou o recurso pela última vez.

TaxiiClient

Objeto

Tipo de dados para conector TAXII.

Nome	Tipo	Description
state	DataTypeState	Descreva se essa conexão de tipo de dados está habilitada ou não.

Teams

Objeto

Conexão de tipo de dados do Teams.

Nome	Tipo	Description
state	DataTypeState	Descreva se essa conexão de tipo de dados está habilitada ou não.

TIDataConnector

Objeto

Representa o conector de dados de inteligência contra ameaças.

Nome	Tipo	Description
etag	string	Etag do recurso do azure
id	string	ID de recurso totalmente qualificada para o recurso. Por exemplo, "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
kind	string: ThreatIntelligence	O tipo de conector de dados
name	string	O nome do recurso
properties.dataTypes	TIDataConnectorDataTypes	Os tipos de dados disponíveis para o conector.
properties.tenantId	string	A ID do locatário à qual se conectar e obter os dados.
properties.tipLookbackPeriod	string	O período de pesquisa para o feed a ser importado.
systemData	systemData	Metadados do Azure Resource Manager que contêm informações createdBy e modifiedBy.
type	string	O tipo do recurso. Por exemplo, "Microsoft.Compute/virtualMachines" ou "Microsoft.Storage/storageAccounts"

TIDataConnectorDataTypes

Objeto

Os tipos de dados disponíveis para o conector de dados ti (Inteligência contra Ameaças).

Nome	Tipo	Description
indicators	Indicators	Tipo de dados para conexão de indicadores.

TiTaxiiDataConnector

Objeto

Conector de dados para efetuar pull de dados de inteligência contra ameaças do servidor TAXII 2.0/2.1

Nome	Tipo	Description
etag	string	Etag do recurso do azure
id	string	ID de recurso totalmente qualificada para o recurso. Por exemplo, "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
kind	string: ThreatIntelligenceTaxii	O tipo de conector de dados
name	string	O nome do recurso
properties.collectionId	string	A ID da coleção do servidor TAXII.
properties.dataTypes	TiTaxiiDataConnectorDataTypes	Os tipos de dados disponíveis para o conector de dados TAXII da Inteligência contra Ameaças.
properties.friendlyName	string	O nome amigável do servidor TAXII.
properties.password	string	A senha do servidor TAXII.
properties.pollingFrequency	PollingFrequency	A frequência de sondagem para o servidor TAXII.
properties.taxiiLookbackPeriod	string	O período de pesquisa do servidor TAXII.
properties.taxiiServer	string	A raiz da API para o servidor TAXII.
properties.tenantId	string	A ID do locatário à qual se conectar e obter os dados.
properties.userName	string	O userName para o servidor TAXII.
properties.workspaceId	string	A ID do workspace.
systemData	systemData	Metadados do Azure Resource Manager que contêm informações createdBy e modifiedBy.
type	string	O tipo do recurso. Por exemplo, "Microsoft.Compute/virtualMachines" ou "Microsoft.Storage/storageAccounts"

TiTaxiiDataConnectorDataTypes

Objeto

Os tipos de dados disponíveis para o conector de dados TAXII da Inteligência contra Ameaças.

Nome	Tipo	Description
taxiiClient	TaxiiClient	Tipo de dados para conector TAXII.