Azure Securityinsights Securityinsights

Azure SecurityInsights is an API connector for Microsoft Sentinel security information and event management resources such as incidents, alerts, and analytics rules.

• Base URL: https://management.azure.com
• Auth: OAuth 2.0 (user-delegated) — attach an InTouch oauth credential. Mint one with itcli.py /oauth <provider> (device-code) or /google-auth (Google); the server auto-refreshes the access token before each run, so the connector never handles or stores tokens.

Operations

• operations_list — GET /providers/Microsoft.SecurityInsights/operations — Lists all operations available Azure Security Insights Resource Provider.
• alertrules_list — GET /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules — Gets all alert rules.
• alertrules_get — GET /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules/{ruleId} — Gets the alert rule.
• actions_listbyalertrule — GET /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules/{ruleId}/actions — Gets all actions of alert rule.
• alertrules_getaction — GET /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/alertRules/{ruleId}/actions/{actionId} — Gets the action of alert rule.
• dataconnectors_list — GET /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors — Gets all data connectors.

Inputs

• a linked oauth credential (no key inputs) — the server injects a fresh Authorization: Bearer from it
• operation — one of the operations above
• path parameters when an operation's path contains {...}
• query — optional JSON object of query params
• body — JSON object for create/update ops

Example

operation: operations_list
# (attach an 'oauth' credential to the task — no inline secrets)

Publishes

The keys a later task may reference as {{taskName.key}}. Referencing anything not listed here resolves to nothing at run time.

• error
• operation
• result
• status

Input Properties

Every property this tool accepts, from its own tool.iml.