Iot Security Solutions Analytics Aggregated Alert - List

參考

服務:: Defender for Cloud

API 版本:: 2019-08-01

使用此方法可取得IoT安全性解決方案的匯總警示清單。

GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/iotSecuritySolutions/{solutionName}/analyticsModels/default/aggregatedAlerts?api-version=2019-08-01

含選擇性參數:

GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/iotSecuritySolutions/{solutionName}/analyticsModels/default/aggregatedAlerts?api-version=2019-08-01&$top={$top}

URI 參數

名稱	位於	必要	類型	Description
resourceGroupName	path	True	string	用戶訂用帳戶內的資源組名。名稱不區分大小寫。 Regex 模式: `^[-\w\._]+$`
solutionName	path	True	string	IoT 安全性解決方案的名稱。
subscriptionId	path	True	string	Azure 訂用帳戶標識碼 Regex 模式: `^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$`
api-version	query	True	string	作業的 API 版本
$top	query		integer int32	要擷取的結果數目。

回應

名稱	類型	Description
200 OK	IoTSecurityAggregatedAlertList	還行
Other Status Codes	CloudError	描述作業失敗原因的錯誤回應。

安全性

azure_auth

Azure Active Directory OAuth2 Flow

類型: oauth2
Flow: implicit
授權 URL: https://login.microsoftonline.com/common/oauth2/authorize

範圍

名稱	Description
user_impersonation	模擬您的用戶帳戶

範例

Get the aggregated alert list of yours IoT Security solution

範例要求

GET https://management.azure.com/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/iotSecuritySolutions/default/analyticsModels/default/aggregatedAlerts?api-version=2019-08-01


/**
 * Samples for IotSecuritySolutionsAnalyticsAggregatedAlert List.
 */
public final class Main {
    /*
     * x-ms-original-file: specification/security/resource-manager/Microsoft.Security/stable/2019-08-01/examples/
     * IoTSecuritySolutionsAnalytics/GetIoTSecuritySolutionsSecurityAggregatedAlertList.json
     */
    /**
     * Sample code: Get the aggregated alert list of yours IoT Security solution.
     * 
     * @param manager Entry point to SecurityManager.
     */
    public static void getTheAggregatedAlertListOfYoursIoTSecuritySolution(
        com.azure.resourcemanager.security.SecurityManager manager) {
        manager.iotSecuritySolutionsAnalyticsAggregatedAlerts().list("MyGroup", "default", null,
            com.azure.core.util.Context.NONE);
    }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

package armsecurity_test

import (
	"context"
	"log"

	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/security/armsecurity"
)

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/9ac34f238dd6b9071f486b57e9f9f1a0c43ec6f6/specification/security/resource-manager/Microsoft.Security/stable/2019-08-01/examples/IoTSecuritySolutionsAnalytics/GetIoTSecuritySolutionsSecurityAggregatedAlertList.json
func ExampleIotSecuritySolutionsAnalyticsAggregatedAlertClient_NewListPager() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armsecurity.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	pager := clientFactory.NewIotSecuritySolutionsAnalyticsAggregatedAlertClient().NewListPager("MyGroup", "default", &armsecurity.IotSecuritySolutionsAnalyticsAggregatedAlertClientListOptions{Top: nil})
	for pager.More() {
		page, err := pager.NextPage(ctx)
		if err != nil {
			log.Fatalf("failed to advance page: %v", err)
		}
		for _, v := range page.Value {
			// You could use page here. We use blank identifier for just demo purposes.
			_ = v
		}
		// If the HTTP response code is 200 as defined in example definition, your page structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
		// page.IoTSecurityAggregatedAlertList = armsecurity.IoTSecurityAggregatedAlertList{
		// 	Value: []*armsecurity.IoTSecurityAggregatedAlert{
		// 		{
		// 			Name: to.Ptr("/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/IoT_Bruteforce_Fail/2019-02-02"),
		// 			Type: to.Ptr("Microsoft.Security/iotSecuritySolutions/analyticsModels/aggregatedAlerts"),
		// 			ID: to.Ptr("/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/IoT_Bruteforce_Fail/2019-02-02"),
		// 			Properties: &armsecurity.IoTSecurityAggregatedAlertProperties{
		// 				Description: to.Ptr("Multiple unsuccsseful login attempts identified. A Bruteforce attack on the device failed."),
		// 				ActionTaken: to.Ptr("Detected"),
		// 				AggregatedDateUTC: to.Ptr(func() time.Time { t, _ := time.Parse("2006-01-02", "2019-02-02"); return t}()),
		// 				AlertDisplayName: to.Ptr("Failed Bruteforce"),
		// 				AlertType: to.Ptr("IoT_Bruteforce_Fail"),
		// 				Count: to.Ptr[int64](50),
		// 				EffectedResourceType: to.Ptr("IoT Device"),
		// 				LogAnalyticsQuery: to.Ptr("SecurityAlert | where tolower(ResourceId) == tolower('/subscriptions/b77ec8a9-04ed-48d2-a87a-e5887b978ba6/resourceGroups/IoT-Solution-DemoEnv/providers/Microsoft.Devices/IotHubs/rtogm-hub') and tolower(AlertName) == tolower('Custom Alert - number of device to cloud messages in MQTT protocol is not in the allowed range') | extend DeviceId=parse_json(ExtendedProperties)['DeviceId'] | project DeviceId, TimeGenerated, DisplayName, AlertSeverity, Description, RemediationSteps, ExtendedProperties"),
		// 				RemediationSteps: to.Ptr(""),
		// 				ReportedSeverity: to.Ptr(armsecurity.ReportedSeverityLow),
		// 				SystemSource: to.Ptr("Devices"),
		// 				TopDevicesList: []*armsecurity.IoTSecurityAggregatedAlertPropertiesTopDevicesListItem{
		// 					{
		// 						AlertsCount: to.Ptr[int64](45),
		// 						DeviceID: to.Ptr("testDevice1"),
		// 						LastOccurrence: to.Ptr("10:42"),
		// 					},
		// 					{
		// 						AlertsCount: to.Ptr[int64](30),
		// 						DeviceID: to.Ptr("testDevice2"),
		// 						LastOccurrence: to.Ptr("15:42"),
		// 				}},
		// 				VendorName: to.Ptr("Microsoft"),
		// 			},
		// 		},
		// 		{
		// 			Name: to.Ptr("/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/IoT_Bruteforce_Success/2019-02-02"),
		// 			Type: to.Ptr("Microsoft.Security/iotSecuritySolutions/analyticsModels/aggregatedAlerts"),
		// 			ID: to.Ptr("/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/IoT_Bruteforce_Success/2019-02-02"),
		// 			Properties: &armsecurity.IoTSecurityAggregatedAlertProperties{
		// 				Description: to.Ptr("Multiple unsuccsseful login attempts identified followed by a succssful login. A Bruteforce attack on the device was Successfule"),
		// 				ActionTaken: to.Ptr("Detected"),
		// 				AggregatedDateUTC: to.Ptr(func() time.Time { t, _ := time.Parse("2006-01-02", "2019-02-02"); return t}()),
		// 				AlertDisplayName: to.Ptr("Successful Bruteforce"),
		// 				AlertType: to.Ptr("IoT_Bruteforce_Success"),
		// 				Count: to.Ptr[int64](600000),
		// 				EffectedResourceType: to.Ptr("IoT Device"),
		// 				LogAnalyticsQuery: to.Ptr("SecurityAlert | where tolower(ResourceId) == tolower('/subscriptions/b77ec8a9-04ed-48d2-a87a-e5887b978ba6/resourceGroups/IoT-Solution-DemoEnv/providers/Microsoft.Devices/IotHubs/rtogm-hub') and tolower(AlertName) == tolower('Custom Alert - number of device to cloud messages in MQTT protocol is not in the allowed range') | extend DeviceId=parse_json(ExtendedProperties)['DeviceId'] | project DeviceId, TimeGenerated, DisplayName, AlertSeverity, Description, RemediationSteps, ExtendedProperties"),
		// 				RemediationSteps: to.Ptr(""),
		// 				ReportedSeverity: to.Ptr(armsecurity.ReportedSeverityLow),
		// 				SystemSource: to.Ptr("Devices"),
		// 				TopDevicesList: []*armsecurity.IoTSecurityAggregatedAlertPropertiesTopDevicesListItem{
		// 					{
		// 						AlertsCount: to.Ptr[int64](12321),
		// 						DeviceID: to.Ptr("testDevice1"),
		// 						LastOccurrence: to.Ptr("10:42"),
		// 					},
		// 					{
		// 						AlertsCount: to.Ptr[int64](455),
		// 						DeviceID: to.Ptr("testDevice2"),
		// 						LastOccurrence: to.Ptr("15:42"),
		// 				}},
		// 				VendorName: to.Ptr("Microsoft"),
		// 			},
		// 	}},
		// }
	}
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

const { SecurityCenter } = require("@azure/arm-security");
const { DefaultAzureCredential } = require("@azure/identity");

/**
 * This sample demonstrates how to Use this method to get the aggregated alert list of yours IoT Security solution.
 *
 * @summary Use this method to get the aggregated alert list of yours IoT Security solution.
 * x-ms-original-file: specification/security/resource-manager/Microsoft.Security/stable/2019-08-01/examples/IoTSecuritySolutionsAnalytics/GetIoTSecuritySolutionsSecurityAggregatedAlertList.json
 */
async function getTheAggregatedAlertListOfYoursIoTSecuritySolution() {
  const subscriptionId =
    process.env["SECURITY_SUBSCRIPTION_ID"] || "20ff7fc3-e762-44dd-bd96-b71116dcdc23";
  const resourceGroupName = process.env["SECURITY_RESOURCE_GROUP"] || "MyGroup";
  const solutionName = "default";
  const credential = new DefaultAzureCredential();
  const client = new SecurityCenter(credential, subscriptionId);
  const resArray = new Array();
  for await (let item of client.iotSecuritySolutionsAnalyticsAggregatedAlert.list(
    resourceGroupName,
    solutionName,
  )) {
    resArray.push(item);
  }
  console.log(resArray);
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

using System;
using System.Threading.Tasks;
using Azure;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager;
using Azure.ResourceManager.SecurityCenter;

// Generated from example definition: specification/security/resource-manager/Microsoft.Security/stable/2019-08-01/examples/IoTSecuritySolutionsAnalytics/GetIoTSecuritySolutionsSecurityAggregatedAlertList.json
// this example is just showing the usage of "IotSecuritySolutionsAnalyticsAggregatedAlert_List" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this IotSecuritySolutionAnalyticsModelResource created on azure
// for more information of creating IotSecuritySolutionAnalyticsModelResource, please refer to the document of IotSecuritySolutionAnalyticsModelResource
string subscriptionId = "20ff7fc3-e762-44dd-bd96-b71116dcdc23";
string resourceGroupName = "MyGroup";
string solutionName = "default";
ResourceIdentifier iotSecuritySolutionAnalyticsModelResourceId = IotSecuritySolutionAnalyticsModelResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, solutionName);
IotSecuritySolutionAnalyticsModelResource iotSecuritySolutionAnalyticsModel = client.GetIotSecuritySolutionAnalyticsModelResource(iotSecuritySolutionAnalyticsModelResourceId);

// get the collection of this IotSecurityAggregatedAlertResource
IotSecurityAggregatedAlertCollection collection = iotSecuritySolutionAnalyticsModel.GetIotSecurityAggregatedAlerts();

// invoke the operation and iterate over the result
await foreach (IotSecurityAggregatedAlertResource item in collection.GetAllAsync())
{
    // the variable item is a resource, you could call other operations on this instance as well
    // but just for demo, we get its data from this resource instance
    IotSecurityAggregatedAlertData resourceData = item.Data;
    // for demo we just print out the id
    Console.WriteLine($"Succeeded on id: {resourceData.Id}");
}

Console.WriteLine($"Succeeded");

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

範例回覆

狀態碼:: 200

{
  "value": [
    {
      "id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/IoT_Bruteforce_Fail/2019-02-02",
      "name": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/IoT_Bruteforce_Fail/2019-02-02",
      "type": "Microsoft.Security/iotSecuritySolutions/analyticsModels/aggregatedAlerts",
      "properties": {
        "alertType": "IoT_Bruteforce_Fail",
        "alertDisplayName": "Failed Bruteforce",
        "aggregatedDateUtc": "2019-02-02",
        "vendorName": "Microsoft",
        "reportedSeverity": "Low",
        "remediationSteps": "",
        "description": "Multiple unsuccsseful login attempts identified. A Bruteforce attack on the device failed.",
        "count": 50,
        "effectedResourceType": "IoT Device",
        "systemSource": "Devices",
        "actionTaken": "Detected",
        "logAnalyticsQuery": "SecurityAlert | where tolower(ResourceId) == tolower('/subscriptions/b77ec8a9-04ed-48d2-a87a-e5887b978ba6/resourceGroups/IoT-Solution-DemoEnv/providers/Microsoft.Devices/IotHubs/rtogm-hub') and tolower(AlertName) == tolower('Custom Alert - number of device to cloud messages in MQTT protocol is not in the allowed range') | extend DeviceId=parse_json(ExtendedProperties)['DeviceId'] | project DeviceId, TimeGenerated, DisplayName, AlertSeverity, Description, RemediationSteps, ExtendedProperties",
        "topDevicesList": [
          {
            "deviceId": "testDevice1",
            "alertsCount": 45,
            "lastOccurrence": "10:42"
          },
          {
            "deviceId": "testDevice2",
            "alertsCount": 30,
            "lastOccurrence": "15:42"
          }
        ]
      }
    },
    {
      "id": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/IoT_Bruteforce_Success/2019-02-02",
      "name": "/subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/MyGroup/providers/Microsoft.Security/IoTSecuritySolutions/Locations/eastus/default/IoT_Bruteforce_Success/2019-02-02",
      "type": "Microsoft.Security/iotSecuritySolutions/analyticsModels/aggregatedAlerts",
      "properties": {
        "alertType": "IoT_Bruteforce_Success",
        "alertDisplayName": "Successful Bruteforce",
        "aggregatedDateUtc": "2019-02-02",
        "vendorName": "Microsoft",
        "reportedSeverity": "Low",
        "remediationSteps": "",
        "description": "Multiple unsuccsseful login attempts identified followed by a succssful login. A Bruteforce attack on the device was Successfule",
        "count": 600000,
        "effectedResourceType": "IoT Device",
        "systemSource": "Devices",
        "actionTaken": "Detected",
        "logAnalyticsQuery": "SecurityAlert | where tolower(ResourceId) == tolower('/subscriptions/b77ec8a9-04ed-48d2-a87a-e5887b978ba6/resourceGroups/IoT-Solution-DemoEnv/providers/Microsoft.Devices/IotHubs/rtogm-hub') and tolower(AlertName) == tolower('Custom Alert - number of device to cloud messages in MQTT protocol is not in the allowed range') | extend DeviceId=parse_json(ExtendedProperties)['DeviceId'] | project DeviceId, TimeGenerated, DisplayName, AlertSeverity, Description, RemediationSteps, ExtendedProperties",
        "topDevicesList": [
          {
            "deviceId": "testDevice1",
            "alertsCount": 12321,
            "lastOccurrence": "10:42"
          },
          {
            "deviceId": "testDevice2",
            "alertsCount": 455,
            "lastOccurrence": "15:42"
          }
        ]
      }
    }
  ]
}

定義

名稱	Description
CloudError	所有 Azure Resource Manager API 的常見錯誤回應，以傳回失敗作業的錯誤詳細數據。（這也遵循 OData 錯誤回應格式。）。
CloudErrorBody	錯誤詳細數據。
ErrorAdditionalInfo	資源管理錯誤其他資訊。
IoTSecurityAggregatedAlert	安全性解決方案匯總警示資訊
IoTSecurityAggregatedAlertList	IoT 安全性解決方案匯總警示數據的清單。
reportedSeverity	評估的警示嚴重性。
TopDevicesList	10 部裝置，此警示類型出現次數最多的裝置，在這一天。

CloudError

所有 Azure Resource Manager API 的常見錯誤回應，以傳回失敗作業的錯誤詳細數據。（這也遵循 OData 錯誤回應格式。）。

名稱	類型	Description
error.additionalInfo	ErrorAdditionalInfo[]	錯誤其他資訊。
error.code	string	錯誤碼。
error.details	CloudErrorBody[]	錯誤詳細數據。
error.message	string	錯誤訊息。
error.target	string	錯誤目標。

CloudErrorBody

錯誤詳細數據。

名稱	類型	Description
additionalInfo	ErrorAdditionalInfo[]	錯誤其他資訊。
code	string	錯誤碼。
details	CloudErrorBody[]	錯誤詳細數據。
message	string	錯誤訊息。
target	string	錯誤目標。

ErrorAdditionalInfo

資源管理錯誤其他資訊。

名稱	類型	Description
info	object	其他資訊。
type	string	其他信息類型。

IoTSecurityAggregatedAlert

安全性解決方案匯總警示資訊

名稱	類型	Description
id	string	資源標識碼
name	string	資源名稱
properties.actionTaken	string	IoT 安全性解決方案警示回應。
properties.aggregatedDateUtc	string	偵測日期。
properties.alertDisplayName	string	警示類型的顯示名稱。
properties.alertType	string	警示類型的名稱。
properties.count	integer	匯總時間範圍內發生的警示數目。
properties.description	string	可疑弱點和意義的描述。
properties.effectedResourceType	string	收到警示之資源的 Azure 資源識別符。
properties.logAnalyticsQuery	string	用於取得受影響裝置/警示清單的記錄分析查詢。
properties.remediationSteps	string	補救的建議步驟。
properties.reportedSeverity	reportedSeverity	評估的警示嚴重性。
properties.systemSource	string	警示資源的類型（Azure、非 Azure）。
properties.topDevicesList	TopDevicesList[]	10 部裝置，此警示類型出現次數最多的裝置，在這一天。
properties.vendorName	string	引發警示的組織名稱。
tags	object	資源標籤
type	string	資源類型

IoTSecurityAggregatedAlertList

IoT 安全性解決方案匯總警示數據的清單。

名稱	類型	Description
nextLink	string	當某個頁面有太多警示數據時，請使用此 URI 來擷取下一頁。
value	IoTSecurityAggregatedAlert[]	匯總的警示數據清單。

reportedSeverity

評估的警示嚴重性。

名稱	類型	Description
High	string
Informational	string
Low	string
Medium	string

TopDevicesList

10 部裝置，此警示類型出現次數最多的裝置，在這一天。

名稱	類型	Description
alertsCount	integer	此裝置引發的警示數目。
deviceId	string	裝置的名稱。
lastOccurrence	string	此裝置最近一次引發此裝置的警示。

共用方式為

Iot Security Solutions Analytics Aggregated Alert - List

URI 參數

回應

安全性

azure_auth

範圍

範例

Get the aggregated alert list of yours IoT Security solution

範例要求

範例回覆

定義

CloudError

CloudErrorBody

ErrorAdditionalInfo

IoTSecurityAggregatedAlert

IoTSecurityAggregatedAlertList

reportedSeverity

TopDevicesList

其他資源